Privacy Policy

Last updated: October 6, 2026

1. Information We Collect

Account Information

When you create an account, we collect your email address, display name, and profile photo (if signing in with Google). This is used for authentication and account management.

QR Code Data

We store the QR codes you create, including their names, destination URLs, and configuration. Dynamic QR codes are associated with your account.

Scan Analytics

When someone scans a dynamic QR code, we collect anonymized data including: approximate geographic location (country, city, region derived from IP address), device type, browser type, and timestamp. IP addresses are truncated and not stored long-term.

Payment Information

Payment processing is handled entirely by Stripe. We do not store credit card numbers or payment details. We receive only your Stripe customer ID and subscription status.

2. How We Use Your Information

• To provide and maintain the Service
• To process payments and manage subscriptions
• To provide scan analytics for your QR codes
• To send transactional emails (subscription confirmations, payment alerts)
• To prevent abuse and enforce our Terms of Service

3. Data Sharing

We do not sell your personal data. We share data only with:

• Firebase (Google) - Authentication and database hosting
• Stripe - Payment processing
• Vercel - Application hosting and CDN
• Resend - Transactional email delivery

4. Data Retention

Account data is retained as long as your account is active. QR code data and scan analytics are retained for the lifetime of the QR code. When you delete a QR code, its associated scan data is also deleted. When you delete your account, all associated data is removed.

5. Your Rights

You have the right to:

• Access your personal data through your account dashboard
• Update your account information
• Delete your QR codes and associated scan data
• Delete your account entirely
• Export your scan analytics data
• Request a copy of all data we hold about you

6. Cookies

We use essential cookies for authentication (Firebase session). We do not use tracking cookies or third-party advertising cookies.

7. Security

We implement industry-standard security measures including encrypted connections (HTTPS), secure authentication, and access controls. However, no method of transmission over the Internet is 100% secure.

8. Children

The Service is not intended for users under 13 years of age. We do not knowingly collect data from children under 13.

9. Changes

We may update this policy from time to time. We will notify you of significant changes by email or through the Service.

10. Contact

For privacy-related questions or requests, contact us at support@qrcodebro.com.