Privacy Policy

The code is made in your browser and holds your website address directly. Nothing about it is sent to us or stored by us, and it keeps working without us.

We store:

• Your email and password. The password is stored only as a one-way hash, so nobody, including us, can read it.
• Your display name, taken from your email unless you change it.
• Your codes: each one’s name, the website it points to and its design, including any logo you upload.
• Your plan, and if you upgrade, your subscription’s status and renewal date.
• Your sign-in sessions: for each device you’re signed in on, its IP address and browser, to keep your account secure and to slow down password-guessing. A session ends when you sign out, after 30 days without use, or when you reset your password.

We use your email to sign you in and to send account emails: a welcome note when you sign up, and password resets. We don’t send marketing email.

A code made with an account sends each scan through QR Cody on its way to your website, and we record:

• the time of the scan
• the kind of device (iPhone, Android, computer or other), read from the browser
• the country, as reported by our hosting provider
• an anonymous device identifier, so the same phone scanning twice counts once. It’s a one-way, keyed scramble of the IP address and browser; we don’t store the IP address, and the identifier can’t be turned back into one.

We don’t set cookies on people who scan, and we don’t know who they are. Only the account that owns the code can see its scans.

Pro is sold through Polar (polar.sh), which acts as the merchant of record: it takes the payment, handles tax and sends receipts. Your card details go to Polar and never reach us. Polar tells us whether your subscription is active and when it renews.

• Sign-in cookies, only when you’re signed in, to keep you signed in. They’re required for your account to work.
• Your light or dark theme, remembered in your browser if you choose one.

We don’t use advertising or analytics cookies.

We use a small number of providers to run QR Cody:

• Cloudflare: hosts the website, handles each scan, holds our database (accounts, codes and scans) and sends account emails like password resets. Its servers keep short-lived technical logs, which can include IP addresses.
• Polar: payments, as above.

They process data only to provide their service to us.

We keep your account, codes and their scans while your account is open. On the Free plan you see the last 30 days of scans, but older scans are kept, so they reappear if you upgrade. When your account is deleted, its codes and scans are deleted with it, and its codes stop working.

You can see, edit and delete your codes at any time in the app. Deleting a code deletes its scans too. To get a copy of your data, correct it, or delete your whole account and everything in it, email us at the address below and we’ll do it.

QR Cody isn’t meant for children under 16, and we don’t knowingly collect their data.

If this policy changes, we’ll update the date at the top, and for important changes we’ll tell account holders by email before they take effect.

Questions, or a request about your data or account? Email averygsi@gmail.com.