This policy covers the QR Code Xpress website at qrcodexpress.org and the QR Code Xpress extension for Chrome. It describes what we collect, what we deliberately do not collect, and how long anything is kept.
The short version. Making a QR code requires no account and sends us nothing. The code is generated on your own device. We only hold data if you choose to create an account, and then only your email address, the codes you save, and coarse counts for codes you have explicitly asked to track.
Making a QR code
QR codes are generated entirely in your browser. The text, address, contact details or network credentials you type into the generator are never transmitted to us. This is true on the website and in the extension, whether or not you are signed in.
The website stores a single counter in your browser's local storage to track how many codes you have downloaded before signing in. It stays on your device and is not sent anywhere.
If you create an account
Accounts are optional. If you create one, we use Firebase Authentication and Cloud Firestore, both operated by Google, and the following is stored:
| What | Why | Kept for |
|---|---|---|
| Your email address | To identify your account and let you sign back in | Until you delete the account |
| Codes you save | So you can reopen and edit them later | Until you delete them or the account |
| Scan counts, for tracked codes only | To show you how often a code has been scanned | Until you delete the code or the account |
Your password is handled by Firebase Authentication and is never visible to us. Saved codes are readable only by the account that created them; this is enforced by database security rules, not by the application alone.
Scan tracking
Scan tracking applies only to codes you create with the Track scans option enabled. It is off by default. A code made without it is static: it carries its content directly, it never touches our servers when scanned, and there is nothing for us to record.
When a tracked code is scanned, the request passes through qrcodexpress.org on its way to your destination, and we record three things:
- A device class of mobile, tablet or desktop
-
The hostname of the referring site, if any, such as
instagram.com— never the full referring address - The date, in UTC
We do not store the IP address, we do not set a cookie, we do not create a device or browser fingerprint, and we do not build a profile of the person scanning. These records are aggregated into daily totals and are visible only to the owner of the code.
The Chrome extension
The extension requests two permissions. activeTab reads
the address of the tab you are viewing, and only at the moment you open
the extension or choose one of its right-click menu items. That address
is used to draw a QR code on your device and is not transmitted to us.
contextMenus adds the right-click entries and involves no
data at all.
The extension does not read the content of pages you visit, does not record your browsing history, and contains no advertising or analytics. It cannot save codes to your account. If you sign in, it reads your existing scan counts so it can display them, and nothing more.
Signing in sends your email address and password to Google's authentication service. If you never sign in, the extension makes no network requests whatsoever.
What we never do
- We do not sell or rent personal data.
- We do not transfer personal data to third parties except the infrastructure providers named below, who process it on our behalf.
- We do not use personal data to assess creditworthiness or for lending.
- We do not use personal data for advertising or profiling.
- We do not run third-party advertising or analytics on the site or in the extension.
Who processes data for us
We use Vercel to host the site and to run the redirect that counts scans and the relay behind the contact form. We use Google Firebase for authentication and database storage, and Google's mail service to deliver messages sent through the form below. Data is processed on those providers' infrastructure under their terms. We use no other third-party processor.
Your choices
You can use the entire generator without an account. If you have one, you can delete individual saved codes at any time, and you can request deletion of your account and everything attached to it by contacting us at the address below. Deleting a tracked code stops its counting and removes its history. You may also request a copy of the data held about you.
Children
This service is not directed at children under 13, and we do not knowingly collect personal data from them.
Changes
If this policy changes in a way that affects what we collect or how we use it, we will update the date at the top of this page. Material changes will be noted on the site.
Contact
Questions about this policy, or requests to access or delete your data, can be sent with the form below. It reaches the same people either way; we use a form rather than publishing an address so the mailbox does not fill with automated mail.
The form sends us your email address, your name if you give one, and your message. Your email address is used to reply to you and for nothing else. So that the form cannot be used to send bulk mail, we keep a count of recent submissions against a one-way hash of the sender's network address; the address itself is never stored and the hash cannot be turned back into one.