Last updated: 14 October 2026
The short version: your data is yours. We collect what we need to run your QR codes and show you their analytics, we never sell personal data, and you can export or delete everything from your account at any time.
Who we are
QRCodable provides tools to create, manage and track QR codes — dynamic codes, scan analytics, landing pages, file pages and team features. This policy explains what we collect, why we collect it, and the choices you have.
What we collect
- Account details — your name, email address and a securely hashed password. Passwords are never stored in readable form.
- Your content — the QR codes, destination links, landing pages, uploaded files and settings you create, plus anything visitors submit through forms you publish.
- Scan analytics — when someone scans one of your dynamic QR codes we record the time, device type, operating system, browser, language, referring website and the approximate location (country, region and city where our network provider can infer it). The visitor's IP address is stored only as a one-way hash, so it cannot be turned back into an address.
- Website usage — we count visits to our public website and keep a standard access log (page, time, device and approximate location) that we use to operate and protect the service.
- Support conversations — messages you send us through live chat, the contact form or email.
- Billing records — your plan, invoices and payment status. Card details are entered on our payment provider's secure checkout and never touch our servers.
Why we use it
- To run the service — show your dashboard, redirect your dynamic codes, display your pages and deliver the analytics you signed up for.
- To keep accounts secure — sign-in, optional two-factor authentication, rate limiting and audit logs.
- To communicate — transactional emails such as password resets and security notices, plus reports or summaries you ask for.
- To get paid — billing, invoices, refunds and fraud prevention together with our payment provider.
- To improve the product — aggregate, de-identified statistics about how features are used.
What we never do
- We do not sell or rent personal data.
- We do not use advertising cookies or third-party ad trackers on your dashboard, your scan pages or this website.
- We do not read your leads or content except when you ask us to (for example in a support conversation) or where the law requires it.
Cookies
We use a small number of essential cookies only: one that keeps you signed in, one that remembers an open support chat, and security tokens that protect forms against cross-site attacks. No advertising, profiling or cross-site tracking cookies are used.
Who we share with
We never sell personal data. We share it only with the providers that make the service work — for example our hosting infrastructure, email delivery and our payment providers (Paddle, or Stripe where enabled) — and with integrations you choose to connect yourself, such as Slack, Zapier or Google Sheets. Those providers act under contracts that limit them to processing data on our behalf.
How long we keep it
Your data lives on our servers for as long as your account exists, so your analytics and reports stay useful. Closing your account permanently deletes your codes, analytics, leads and pages. Backups rotate on a short cycle, so copies of deleted data expire shortly after deletion.
Your rights
You can access, correct, export or delete your data at any time: export CSVs from Reports, edit or delete codes, leads and pages in the app, and permanently close your account (confirmed with your password) from the Account page. Where data-protection laws such as the GDPR or CCPA apply to you, you also have the right to object to or restrict certain processing and to complain to your local data-protection authority. To exercise any right, contact us — we respond within 30 days.
Security
All traffic is encrypted in transit, passwords are hashed, API keys are stored hashed and shown only once, and access is protected by rate limiting, optional two-factor login and audit logs. Visitor IP addresses in analytics are stored only as one-way hashes.
Children
The service is built for businesses and is not directed at children under 16. We do not knowingly collect personal data from children.
Changes
If we make a material change to this policy we will publish the new version on this page and update the date at the top. Continuing to use the service after a change means you accept the updated policy.
Contact
Reach us any time through the contact page on this website. We usually reply within one business day.