Privacy Policy

Overview

QRGen ("we," "our," or "us") respects your privacy. This policy explains what data we collect, how we use it, and your rights. Our core principle is simple: we collect the minimum data necessary to provide the service, and we never sell your personal information.

Static QR Codes — Zero Data Collection

When you create a static QR code on QRGen, no data is collected, transmitted, or stored. All generation happens entirely in your browser using JavaScript. The content you type (URLs, WiFi passwords, contact information, text, etc.) never leaves your device. We have no access to it, and no record of it exists on our servers.

This applies to all static QR code features: content input, style customization, logo upload, frame selection, and file downloads. Everything is processed locally.

Dynamic QR Codes — What We Store

Dynamic QR codes require server-side storage to enable redirect URLs, editable destinations, and scan analytics. When you create a dynamic QR code, we store:

• The destination URL you provide
• Your style and frame configuration (so you can edit later)
• An optional label, custom short code, expiration date, and hashed password
• Scan analytics: timestamp, approximate location (derived from IP), device type, OS, and browser

IP addresses are never stored directly. We hash IP addresses with SHA-256 combined with the QR code identifier to create an anonymous, non-reversible fingerprint used solely for unique scan counting. The raw IP address is discarded immediately after hashing.

Account Information

If you create an account, we store your email address, a bcrypt-hashed password (we never store plaintext passwords), and an optional display name. This information is used solely for authentication and account management. We do not send marketing emails unless you explicitly opt in.

Cookies

We use a single httpOnly session cookie (qrgen_session) for authentication. This cookie is set only when you log in and is removed when you log out. We do not use tracking cookies, analytics cookies, or third-party cookies. No cookie is set for users who do not log in.

Third-Party Services

We use Stripe for payment processing. When you subscribe to a paid plan, Stripe handles your payment information directly. We never see, store, or have access to your credit card number. Stripe's privacy policy governs how they handle payment data.

We may display ads from third-party ad networks on the free tier. These networks may use their own cookies and tracking. Paid plans remove all ads.

API Keys

API keys are stored as SHA-256 hashes. The plaintext key is shown to you once at generation and is never stored on our servers. If you lose your key, you must generate a new one.

Data Retention

Account data is retained as long as your account is active. If you delete your account, all associated data (QR codes, scan analytics, API keys) is permanently deleted within 30 days. Static QR codes generated without an account leave no data on our servers at any point.

Your Rights

You have the right to:

• Access all data we store about you (available in your dashboard)
• Export your QR code data
• Delete your account and all associated data
• Opt out of scan analytics on your dynamic QR codes

To exercise any of these rights, contact us at support@qrgen.app.

Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email to registered users. The "Last updated" date at the top of this page indicates when the policy was last revised.

Contact

For privacy-related questions or concerns, contact us at support@qrgen.app.