Privacy

What a scan records

When someone scans one of your codes, the following is recorded against that code. It is what you see in your dashboard.

Time of the scan

To the second.

Country and city

Derived from the request, at city level only.

Device type

Phone, tablet or desktop. Not a device identifier.

Referrer

Where the scan came from, when the scanning app sends it.

A salted hash of the IP address

The original IP address is not stored in the scan record. The hash is used only to count repeat scans.

The scan record does not include the name, email or account of the person scanning. The redirect sets no cookie and loads no third-party analytics. Our hosting provider also keeps standard request logs, described below.

Cookies

Google Analytics is loaded on the website pages. Its consent state starts as denied: until you accept analytics in the cookie banner, Google sets no cookie and receives no advertising identifier. These are all the cookies this site can set:

sb-<project>-auth-token

Keeps you signed in. Strictly necessary: without it you cannot use an account. Up to 400 days, renewed while you use the app, and removed when you sign out.

_ga

Google Analytics, set only if you accepted analytics. It holds a random id so that several visits by one person are counted as one visitor. Two years, unless you delete it.

_ga_<container>

Google Analytics session state for this site, set together with _ga and under the same condition. Two years, unless you delete it.

qr_consent

Your answer to the cookie question, including a refusal, so you are not asked again on every page. Strictly necessary. One year.

qr_evt

Set only if you accepted analytics, right after you sign up or sign in, so that page can count it. It holds the event's name and how you signed in, never who you are, and is deleted as soon as it is read. At most two minutes.

qr-password-recovery

Allows a password reset after a recovery link has been verified. Strictly necessary. Up to 10 minutes, and removed once the password is changed.

tz

Your timezone, set when you open your dashboard, so dates show in your local time. It holds no identifier. One year.

Who else processes your data

Google (Tag Manager and Analytics): Website statistics, measured with cookies only after you accept

Page views and interactions on the website. Until you accept, consent is denied and Google receives only cookieless signals with no advertising identifier. It is never loaded on the scan redirect, the Wi-Fi page or sign-in links.

Supabase: Database, sign-in and file storage

Your account email, your codes, and the scan records described above.

Vercel: Hosting and website statistics

Standard request logs, including the IP address and browser type of each request, plus two measurements on the website pages: Vercel Web Analytics (page views and referrer) and Vercel Speed Insights (how fast each page loads, with the browser, device type and country). Neither uses a cookie or a persistent identifier, and neither sends anything from the scan redirect, the Wi-Fi page or sign-in links.

Stripe: Payments, for Pro subscriptions only

Card details go to Stripe directly and never reach this service. We keep the customer and subscription ids, the subscription status and billing period, and the records needed to manage payments.

Google (Gemini): Suggested campaign tags, only when you press the button

The sentence you type, plus the destination URL and code name if set. Nothing is sent on any other action.

Resend: Sends the monthly summary email to Pro accounts that have not switched it off

Your account email, the subject and the message body (the same sentences as your dashboard, including the names you gave your codes), and delivery events such as sent or bounced, kept in Resend's email log. The message carries no tracking pixel and no click tracking.

What this service does not do

• No advertising tracking on scans. No advertising identifier, no cross-site profile and no cookie on the redirect. Scans are counted, and a pseudonymous identifier recognises repeat scans.
• No raw IP addresses in scan records. An IP address is turned into a salted hash so repeat scans can be counted. The original address is not stored in the scan record.
• Nothing sold or shared for advertising. Your codes, destinations and scan data are not sold, rented or given to an advertising network.
• No advertising page on a scan. A website code goes straight to its destination.

Why we may process it

Under Article 6 of the GDPR, each use described above relies on one of these legal bases.

Contract, Article 6(1)(b) GDPR

Your account, your codes and their destinations, and your subscription, which the service cannot be provided without. If you act for an organisation that is the customer, your contact and account details are processed on the basis of legitimate interests in managing that relationship.

Legitimate interests, Article 6(1)(f) GDPR

Recording scans so the owner of a code can see how it performs, and protecting the service against abuse with request limits and a pseudonymous identifier derived from the IP address. We keep this to what is needed for those purposes, and a scan redirect sets no cookie.

Consent, Article 6(1)(a) GDPR

Analytics cookies on the website, only after you accept them. You can withdraw consent at any time by deleting this site's cookies in your browser, after which you are asked again.

Legal obligation, Article 6(1)(c) GDPR

Invoices and payment records, which accounting and tax law require us to keep.

How long it is kept

• Codes and destinations: until you delete them. They are not removed after a set time, because a printed code that stops working is the failure this product exists to prevent. When you close your account and choose to keep your codes working, the destinations needed for the redirect are kept.
• Scan records: kept while the code exists. Deleting a code, or closing your account, deletes its scan detail.
• Billing records: kept for as long as accounting and tax law require, which can be longer than the account exists.

Your rights, and getting your data out

Every account can export a complete JSON backup of its codes at any time, on any plan, from Settings. No plan and no ended subscription blocks it.

Closing your account asks a separate question: whether the codes you have printed should keep working or be destroyed.

• Keep them. Your account and the scan detail are erased, and the short links keep redirecting. The destination addresses remain, so remove any personal information from them first.
• Destroy them. This cannot be undone, and every printed code stops working.
• Either way, records the law requires us to keep, such as invoices, are kept for the legal period.

Under the conditions set by the GDPR, you have the rights below, whether or not you have an account. To use any of them, write to the address below.

• Your rights. Access, rectification, erasure, restriction of processing and data portability, and the right to object.
• No automated decisions. This service makes no decision based solely on automated processing that has legal or similarly significant effects on you.
• An answer within one month. If the law allows an extension for a complex request, you are told why within that month.
• A complaint. You can also complain to the data protection authority where you live or work. In Romania that is ANSPDCP.

• Privacy requests: support@qrsteady.com

Security

Data is encrypted in transit and at rest by the providers listed above.

• Access controls. They are designed so that one account cannot read another account's data.
• Account passwords. They pass through this service only to sign you in or change them, and are stored in hashed form by the sign-in provider.
• Wi-Fi passwords. A Wi-Fi password you add to a code is stored with that code and shown to the people who scan it.

No service can guarantee that a breach will never happen. What this service does is keep very little about the person scanning a code, so a breach would expose less.

Where data is held, and children

Account and scan data are stored in the European Union. Where a provider listed above processes data outside the European Economic Area, the transfer relies on an adequacy decision or on the European Commission's standard contractual clauses. You can ask for a copy of those safeguards at the privacy address above.

This service is not intended for children under 16, who should not create an account. Scanning a printed code produces the scan record described above, whatever the age of the person scanning.

Changes to this policy

If what is collected changes, this page is updated and account holders are told by email before the change takes effect.

Who operates this service

This service is run jointly by the two companies below, which act as joint data controllers. Their legal details will appear here once they are final. Until then, write to the contact address below.

Contact: support@qrsteady.com