Privacy Policy

1. Who We Are

QRtracer ("we", "us", "our") is a free QR code generator with optional scan tracking. Here's what we collect and why.

2. Data We Collect

2.1 Account holders

When you create an account, we store your email address and a hashed password. We need this to run your dashboard.

2.2 QR code scan analytics

When someone scans a tracked QR code we store: approximate country and city (from the request edge, not a stored IP), device type, browser, operating system, timestamp, and an HMAC IP hash salted with the UTC date. The hash is same-day only — it cannot link a visitor across days. New scans do not store a raw IP. Historical rows may still contain an IP until we complete a one-time null-out (flagged for review). We do not collect names or emails from scanners.

2.3 QR generation events

We record successful QR creation events to count generator usage, including creation without an account. New records contain the generator type, website page, source, timestamp, tracking status at creation, and your account ID if you are signed in. For website QR codes, we record the destination URL without login credentials, query strings or fragments. Static QR contents, such as Wi-Fi passwords, text, contact details or payment information, stay in your browser and are never logged. New events do not retain IP addresses or browser user-agents. Older records may contain those fields. This operational log is separate from optional site analytics.

2.4 Optional site analytics

If you accept analytics, QRtracer activity reporting, Google Analytics, Vercel Web Analytics, and Vercel Speed Insights may receive a scrubbed page path and technical information needed to measure visits, product actions, and performance. We remove query strings and redact likely identifiers from paths before sending them. Advertising storage, advertising user data, and ad personalization signals are disabled. These services are not loaded before you accept.

Our own optional activity report stores the page path without query strings, event type, language, generator type and download format. It does not store QR contents, destination URLs, raw IP addresses or visitor identifiers. Random event IDs prevent duplicate delivery. Short-lived, keyed network hashes limit abuse; hashes older than one day are removed as new events arrive. Activity events older than 180 days are removed as new events arrive. Separate save records retain a code ID, creation time and source for operational counts, including after a code is deleted.

2.5 QR link checks and MCP connections

QR images are decoded in your browser. When you check a web link, its URL is sent to our server to request the public destination and follow a limited number of redirects. The requested destination may receive the checker request. Checker reporting stores the outcome and duration, without the QR image or destination URL.

If you connect an AI client through OAuth, we store the client registration, your approved QR permissions, connection times and hashed connection tokens. The connected client can receive the QR details and aggregate scan data allowed by your approval and plan. It cannot access billing through these tools. You can revoke a connection at Settings → AI connections. Download links are limited to one QR export and expire after ten minutes.

MCP operational reporting stores tool names, outcomes, durations and keyed account/client hashes for up to 90 days, with daily cleanup. It does not store prompts, connection tokens, QR payloads or destination URLs. Access tokens expire after 15 minutes; rotating refresh tokens expire after 30 days. Used refresh-token hashes may remain while their token family is active to detect replay. Expired requests and download tickets are removed by daily cleanup after one day; revoked connections are removed after 30 days.

3. How We Use Your Data

• To provide and improve QRtracer's services
• To display scan analytics in your dashboard
• To send transactional emails (verification, password reset)

We do not sell personal data or use site analytics for advertising.

4. Data Processor

We use Supabase as our database and authentication provider. Supabase acts as a data processor on our behalf. If you accept optional analytics, Google and Vercel also process the analytics and performance data described above. Their processing locations and retention are governed by our service configuration and their applicable terms.

5. Your Rights (GDPR)

EU/EEA residents can:

• Access their personal data
• Correct or delete their data
• Export their data
• Object to processing
• Withdraw consent at any time

To exercise any of these rights, contact us at privacy@qrtracer.io.

6. Cookies

QRtracer uses essential browser storage for authentication and product preferences. We store your analytics choice in localStorage. If you accept analytics, Google Analytics may set measurement cookies; you can withdraw consent at any time through the Privacy settings button. Declining analytics does not affect QR creation or account features.

7. Data Retention

Account data is retained while your account is active. Scan user-agent and referrer are trimmed after 180 days; parsed device/browser/OS, country, city, and bot flags stay. Aggregates are kept. You can export or delete your account from Settings — deleting an account deletes your codes (printed codes will stop resolving) and cascaded scans.

8. Changes to This Policy

If we change this policy, we'll email registered users about anything significant.

9. Contact

For privacy-related questions, email privacy@qrtracer.io. For anything else, reach us at hello@qrtracer.io.