Privacy Notice

Controller

What data we process

Account data: when you create an account we process your email address, an optional display name, and a user id issued by Firebase. If you sign in with Google we additionally receive the profile data Google shares (name, email address, profile picture).

Content: the QR codes you create are stored together with their content — depending on the type that may be URLs, text, contact details (vCard), WiFi credentials, events or coordinates. Uploaded logos are downscaled and stored as image data alongside the QR code. You decide this content yourself; please do not enter third-party data without their knowledge.

Dynamic QR codes: we additionally store the target address, a scan counter and the time of the last scan. We deliberately do not record IP addresses, location or device data, and we build no profiles of the people scanning.

Server logs: when the site is accessed, our hosting provider processes technically necessary access data such as IP address, time, requested address and browser identifier. These serve secure operation and are deleted after a short period.

QR pages (published pages)

What we store: when you create a QR page – for example a menu, a contact page or guest information – we store its content: template, title, subtitle, header colour, the rows of text and value, and the buttons with their label and target (web address, phone number or email address). We also store the pictures you upload: a header picture, a logo and photos for individual rows, at most 26 per page. Pictures are downscaled and re-encoded in your browser before they are transmitted; embedded camera and location data (EXIF) is removed in the process. In addition we store the user id of your account, the time of creation and a counter of how many pages your account has. An account may hold at most 20 pages.

Public access: a QR page can be opened by anyone who knows its address or has the QR code; no sign-in is needed. We mark these pages as not to be indexed by search engines, but we cannot prevent the address or the QR code from being passed on. Therefore do not put anything confidential there, and no personal data of other people without their consent; this also applies to photos in which people can be recognised. Only upload pictures you are allowed to use. You are responsible for the content of your page.

Visitors of a QR page: opening one produces the server logs described above, and the technically necessary language cookie is set. On QR pages we load no statistics, count no views and embed no third-party content; the pictures of a page are delivered from our own domain. Buttons lead to destinations chosen by the creator of the page, such as another website, a phone call or an email; the respective provider is responsible for processing there.

Reports and blocking: every QR page carries the link “Report content”. It opens an email to us; we then process your email address and the content of your report in order to review and answer it. For the review we see the reported page and the user id of the account that created it. We take unlawful or abusive pages offline: they and their pictures are then no longer publicly available but remain stored; after a block, pictures may remain in caches for up to ten minutes. The creator sees the block in their account and can change or delete the page.

Legal bases

Providing your account and managing your QR codes is performance of the usage contract (Art. 6(1)(b) GDPR).

Server logs, security measures and scan counting rest on our legitimate interest in a secure and functioning service (Art. 6(1)(f) GDPR).

Optional statistics cookies are used solely on the basis of your consent (Art. 6(1)(a) GDPR). You may withdraw consent at any time with effect for the future.

Providing and publicly delivering your QR pages is likewise performance of the usage contract (Art. 6(1)(b) GDPR). Limiting the number of pages per account, reviewing reports and blocking pages rest on our legitimate interest in preventing abuse and unlawful content on our service (Art. 6(1)(f) GDPR); where we are legally obliged to review or remove content, on Art. 6(1)(c) GDPR.

Recipients and third-country transfers

Authentication and database: Google Ireland Limited / Google LLC (Firebase Authentication, Cloud Firestore), acting as processor; standard contractual clauses are in place for transfers to the United States.

Hosting and delivery: Vercel Inc. Standard contractual clauses also apply here for third-country transfers.

We do not sell data, operate no advertising networks, and do not share your data for advertising purposes.

Retention

Saved and dynamic QR codes are kept until you delete them or close your account. Deleting a code under “My QR codes” or “Dynamic QR codes” takes effect immediately.

Server logs are retained only briefly by the hosting provider. Your cookie choice is stored in your browser for twelve months.

Please note: if you delete a dynamic QR code, codes already printed or distributed will stop working.

QR pages are kept until you delete them or close your account; deleting one under “QR pages” takes effect immediately, and a printed QR code then leads nowhere. A page's pictures are deleted together with it; a picture you replace or remove is deleted when you save. A blocked page remains stored until its creator deletes it. Reports sent by email are kept for as long as is necessary to handle and document the matter.

Data security

All transmission is encrypted via TLS. Access to stored QR codes is restricted to your own account by database rules.

The target address of a dynamic QR code is technically publicly readable so that the redirect works when scanned. Do not put confidential content there.

QR pages are displayed as your text and your pictures only: text is rendered as text, pictures are accepted only in JPEG, PNG and WebP format and delivered only as pictures. Buttons can only lead to web addresses (https), phone numbers or email addresses. Only the account that created a page can change or delete it; the operator can only block a page or release it again, not alter its content.

No automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

Changes to this notice

We update this notice when the service or the legal situation changes. The version published on this page always applies; the date above indicates the current status.

Cookies and local storage

We set only the following entries. Statistics entries are created only after your consent.

Your rights

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, a message to the email address above is sufficient.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority — in particular in the member state of your residence, place of work, or the place of the alleged infringement.