Summary
- We store the email address and password you sign up with, and the QR codes you save.
- Signed-out visitors are counted with a salted hash of their IP address, not the address itself.
- We set one essential cookie, to keep you signed in.
- Advertising cookies are set by Google AdSense, and only after you agree to them.
- Analytics cookies are set by Google Analytics, and only after you agree to them.
- Scans of a dynamic QR code are counted using a salted IP hash, the referring hostname, a coarse device and operating system family, and a two-letter country supplied by our network — never an IP address, a full referring URL or a precise location. Static codes are not counted at all.
- We do not sell your personal data.
Who we are
QR Studio ("we", "us") operates this website, a free QR code generator. For the purposes of the UK GDPR and the EU GDPR, we are the data controller for the personal data described below. You can reach us using any of the methods on our contact page.
What we collect
Account data
When you create an account we collect your email address, an optional
display name, and a password. Passwords are never stored in readable form:
we derive a scrypt hash with a per-account random salt and
store only that.
Content you create
We store the QR codes you choose to save — the type, the values you typed into the form (a URL, a Wi-Fi password, contact details, and so on), the design options, and when it was created. This is what makes your history work. You can delete any entry at any time, and deleting it removes the stored payload.
If you use folders to organise your codes or save a design as a template, those names and the design settings are stored with your account in the same way, and are deleted along with it. Nothing is shared between accounts.
Bulk generation is different: the spreadsheet you upload is parsed to produce the codes and is not retained afterwards. What you get back is an archive containing the generated images, and it is yours to keep.
The live preview on the generator page is deliberately not stored. Codes only persist when you press Generate.
Messages you send us
The contact form and the abuse-reporting form both collect what you type — your name if you give one, your email address, a subject, and your message — together with a salted, one-way hash of your IP address, which we use to rate-limit submissions and to spot spam. The raw IP address is not stored.
We use this only to read and answer you, and to act on reports of abusive codes. Messages are emailed to us as well as stored, so the stored copy is a backup rather than the only record. Messages are deleted 180 days after they are resolved — see how long we keep it for the reasoning. An unresolved message is never aged out, because an unanswered request is exactly the thing that must not be quietly deleted.
If you report a code, tell us the short link or the code's address. We cannot investigate a code we cannot identify, and a report without one cannot be acted on.
Anonymous usage
Signed-out visitors receive three free QR codes. To enforce that limit we keep a counter keyed to a salted, one-way hash of your IP address. The raw address is not written to the database, and the hash cannot be reversed to recover it. The counter only ever increases; it is not used for tracking you across other websites.
Scan data for dynamic QR codes
A static QR code contains its content, so a scan is decoded by the phone and never reaches us — there is nothing for us to record, and we record nothing. A dynamic QR code is different: it holds a short link on our domain, so every scan is a request to our server and can be counted.
When someone scans a dynamic code, we store:
- A salted, one-way hash of the scanner's IP address — the same mechanism described under "Anonymous usage" above. The address itself is never stored and cannot be recovered from the hash.
-
The referring hostname only — for example
example.com, never the full URL. A referring URL's query string is where search terms appear, so keeping only the host is what prevents a scan report from becoming a record of what your visitors searched for. - A coarse device family and operating system — mobile, tablet or desktop, and ios, android, windows, macos or other. Both are derived from the user-agent string, which is then discarded.
- A country, where the deployment can supply one. This is an ISO two-letter country code, and it comes from a header set by our content-delivery network from the network address of the connection — not from us. We never store that address, so we cannot re-derive or refine the country afterwards. The header is read only when the request genuinely arrived through the proxy we configured, because any caller can send it and a visitor must not be able to choose their own country. Where a deployment has no such proxy, or the network cannot place the address, the country is recorded as unknown and no country breakdown is shown.
- Whether the request appeared to be a bot, resolved at the time of the scan so that crawler traffic can be excluded from the figures without retaining anything about the crawler.
The country is the only location data we hold, and it is a country rather than a city, a postcode or a set of coordinates — never precise enough to identify anyone, and shown to a code's owner only as a count per country.
This data is used only to show the owner of that code how many times it was scanned. It is not used to build a profile of anyone, is not combined with data from other sites, and is not sold or shared. The figure we report as "unique visitors" is a count of visitor-days rather than distinct people, precisely because distinguishing people would require holding a per-person identifier across all history.
Raw scan records are deleted after 90 days. Daily totals are calculated as scans arrive and kept without a time limit, so a scan chart still works after the individual records behind it are gone.
Server logs
Our hosting provider records standard request logs (IP address, timestamp, requested URL, user agent) for security and abuse prevention. These are retained on the provider's normal schedule.
Cookies
We use a small number of cookies and similar technologies:
| Name | Type | Purpose |
|---|---|---|
| Session cookie | Essential | Keeps you signed in. Set only after you log in or sign up. It is httpOnly, SameSite=Lax, and expires after 30 days or when you sign out. |
| Consent choice | Essential |
A localStorage entry recording whether you accepted or
rejected advertising cookies, so we do not ask on every page.
|
| Google advertising cookies | Advertising | Set by Google AdSense to serve and measure ads. These are only set after you accept advertising cookies. |
| Google Analytics cookies | Analytics | Set by Google Analytics to count visits and see which pages are useful. These are only set after you accept. Until then Analytics runs in cookieless mode, which still sends a page-view signal but stores no identifier on your device. |
Essential cookies cannot be switched off without breaking sign-in, so they are set on the basis of our legitimate interest in operating the service. Advertising and analytics cookies are set only with your consent, which you can give or refuse in the banner shown on your first visit. To change your mind later, clear this site's data in your browser settings; the banner will appear again on your next visit.
Analytics
We use Google Analytics to understand which pages people find useful and where the site is slow, so we can improve it. It reports aggregate figures — visits, pages, rough country and device type — and is not used to build a profile of you or to show you ads.
Analytics is loaded under Google's Consent Mode, and starts denied. In that state no analytics cookie is written to your device. If you accept, it switches to using cookies so repeat visits can be counted. Refusing does not restrict any part of the service.
Advertising and Google AdSense
QR Studio is free, and advertising pays for the servers. We use Google AdSense to display ads, and we want to be specific about what that involves, because it is a common source of confusion.
- Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website and other websites.
- Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to our site and/or other sites on the internet.
- You can opt out of personalized advertising by visiting Google Ads Settings.
- You can opt out of some third-party vendors' use of cookies for personalized advertising by visiting www.aboutads.info, or in the EU at Your Online Choices.
- We do not serve ads on the account, sign-in, verification or error screens. Ads appear only alongside editorial content, and every ad unit is labelled as an advertisement.
If you decline advertising cookies, we do not request an ad at all, and no advertising cookie is set. You can still use every feature of the site.
For visitors in the European Economic Area, the United Kingdom and Switzerland, we rely on Google's certified consent management platform to collect and record your advertising consent, because Google requires a certified CMP for those regions.
Who else processes your data
We share personal data only with the providers needed to run the service:
- Hosting provider — serves the site and stores the database and request logs.
- Email delivery provider — sends account verification and password reset messages, and therefore processes your email address.
- Google — serves advertising and, where applicable, consent messages, as described above.
We do not sell, rent or trade your personal data. We may disclose data where we are legally required to, or where it is necessary to investigate abuse of the service.
How long we keep it
- Account data and saved QR codes: until you delete them or close your account.
- Anonymous usage counters: retained while the trial limit is enforced.
- Raw dynamic-scan records: 90 days, after which only the aggregated daily totals remain.
- Verification and reset tokens: 24 hours and 1 hour respectively, then discarded.
- Contact messages and abuse reports: 180 days after they are resolved. Unresolved ones are kept until they are answered.
- Server logs: per our hosting provider's retention schedule.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal data, to receive it in a portable format, and to withdraw consent you previously gave. To exercise any of these, contact us using the details on the contact page. We will respond within the period required by applicable law, normally 30 days.
If you are in the EU or UK and believe we have handled your data unlawfully, you have the right to complain to your national data protection authority.
California residents: we do not sell or share your personal information as those terms are defined by the CCPA/CPRA. You may still request access to, or deletion of, the information we hold about you.
Security
Passwords are hashed with scrypt and compared in constant time.
Sessions use random 32-byte tokens stored in httpOnly cookies. Verification
and reset tokens are stored only as SHA-256 hashes, are single-use, and
expire. The site is served over HTTPS. No system is perfect, so we cannot
guarantee absolute security — but we do not store anything we do not need.
Children
QR Studio is not directed at children, and we do not knowingly collect personal data from anyone under 13 (or under 16 in the EEA). If you believe a child has created an account, contact us and we will remove it.
International transfers
Our providers may process data outside your country, including in the United States. Where that happens, we rely on the transfer safeguards those providers have put in place, such as the European Commission's Standard Contractual Clauses.
Changes to this policy
If we change this policy we will update the date at the top of the page. If the change is material, we will make that clear on the site.
Contact
Questions about this policy, or a request to exercise your rights, can be sent to the addresses listed on our contact page. See also our Terms of Service.