Privacy Policy

Short version: the QR codes you make and the codes you scan are handled in your browser. What you type, the images you scan and the logos you add never reach our server. We don’t use analytics or advertising cookies.

Who we are

SnapQR (snapqr.org) is a small independent project. For anything about your privacy, email [email protected]. In privacy-law terms, we are the “controller” of the little personal data described below.

What stays on your device

These things are processed only in your browser. We never receive them, so we can’t see, store or share them:

• What you put in a QR code — links, text, WiFi names and passwords, contact details, phone numbers, messages.
• Images you scan, whether you upload, drop or paste them, and the content of the codes found in them.
• Camera video. The scanner reads single frames on your device. Nothing is recorded or uploaded, and the camera switches off as soon as a code is read or you stop it.
• Logos and images you add to a code. They’re resized and trimmed in your browser.
• Your clipboard. We only read an image from it when you paste one yourself (Ctrl+V or the Paste button).

You can check this yourself: open your browser’s developer tools, go to the Network tab, and make or scan a code. No request carries your content.

What our server receives

Like every website, our server gets a standard request when you load a page: your IP address, the page address, the time, your browser type (user agent) and the page that linked to us (referrer). We use this only to deliver the site, keep it secure and fix errors. These server logs are deleted automatically after 14 days. We don’t use them to build profiles, and we don’t combine them with other data.

The site is delivered through Cloudflare, which protects it from attacks and caches pages close to you. Cloudflare processes the same request information on our behalf.

Cookies and browser storage

SnapQR itself uses no tracking cookies. We store a few settings in your browser’s local storage, and they never leave your device:

• theme — your light or dark mode choice.
• snapqr.history.enabled and snapqr.history.v1 — only if you turn on scan history (it’s off by default). It keeps your last 30 scans so you can find them again. Two-factor (2FA) setup codes are never saved. Turning history off, or pressing “Clear all history”, deletes it straight away.

Clearing your browser’s site data removes all of it.

Why we’re allowed to process this data

If you’re in the EU, the UK or a similar jurisdiction, the law asks us to name a reason (a “legal basis”):

• Server logs and security — our legitimate interest in running a safe, working website.
• Emails you send us — our legitimate interest in answering you.

If you email us

If you write to [email protected], we keep your message and email address so we can reply and follow up. We delete support emails when they’re no longer needed, at most two years after the conversation ends. We never add you to a mailing list. Please don’t send WiFi passwords or other private details — we don’t need them to fix a bug.

Who we share data with

We don’t sell your personal data, and we don’t share it except with the services that make the site work: our hosting and Cloudflare. We would only disclose information if the law requires it.

Some of these providers are based outside your country (for example in the United States). Where data leaves the EU or UK, they rely on legal safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

Your rights

Depending on where you live, you can ask us to see, correct or delete personal data we hold about you, object to how we use it, or ask us to limit it. You can also complain to your local data protection authority.

To use any of these rights, email [email protected]. We answer within 30 days. Since we don’t keep accounts or the content of your codes, there’s usually very little for us to find — often only an email you sent us.

Children

SnapQR is a general tool and isn’t aimed at children under 13 (under 16 in the EU). We don’t knowingly collect personal data from children. If you think a child has sent us personal information, email us and we’ll delete it.

Security

The site is served over HTTPS only. Because your codes, scans and images are handled on your device, there’s no database of them to leak. No system is perfectly secure, but we keep what we hold to a minimum.

Changes to this policy

When we change this policy, we update the date on this page. If a change affects how we use your data — for example, adding analytics — we’ll update this page before it goes live and ask for consent where the law requires it.