Privacy Policy

1. Information used to provide QrOnly

• Account details: your email address, account identifier, optional display name, and authentication/session information. Supabase manages password authentication; passwords are not stored in our QR or profile tables.
• QR content and designs: labels, destination URLs, short links, design settings, and any logo you choose to upload. Please avoid placing passwords, private access tokens, or other sensitive information in destination URLs or designs.
• Open counts: each successful destination redirect increments a lifetime QR total and an account-wide UTC calendar-month total. Paused links do not count as successful opens. The application does not keep individual scan records, scan timestamps, location, device, browser, referrer, or IP-based visitor profiles for QR analytics. Repeat and automated requests can increase the count.
• Subscription records: your plan, billing interval, customer and subscription identifiers, status, and billing/cancellation dates. Dodo Payments collects payment and billing details through its checkout. We do not receive or store full card numbers or CVVs.
• Support messages: signed-in requests include your account email, subject, message, and plan-derived support priority. The public contact form can collect your name, email address, phone number, and message.

2. Why information is processed

We use this information to authenticate you, save and manage your QR codes, redirect QR links, maintain open counts, verify subscription/trial access and plan limits, manage subscriptions, deliver trial, grace-period, and usage notifications, answer support requests, prevent misuse, and investigate service errors. Where applicable, processing is based on providing the service you request, our legitimate interests in operating and protecting it, consent where required, or legal obligations.

3. Cookies, requests, and logs

QrOnly uses essential authentication cookies to keep you signed in. The application does not include advertising cookies or third-party marketing analytics. Blocking essential cookies may prevent login and account features from working.

Serving a web request necessarily exposes connection information, including an IP address, to the server and infrastructure handling that request. Hosting, authentication, payment, and security providers may process request metadata and operational logs under their own policies. This is separate from QrOnly’s aggregate-only QR open counter.

4. Service providers and destinations

• Supabase provides the authentication and database software used for accounts and saved QR data. The current local development setup runs these services locally; hosted deployments may use hosted infrastructure.
• Dodo Payments handles checkout, recurring payments, invoices, and billing management. Its privacy policy applies to information provided to its payment services.
• Tally hosts the public contact form shown to visitors who are not signed in. Loading or submitting that form involves Tally. Signed-in support requests are stored in the application database.
• Resend delivers account and billing reminder emails when configured. We send the account email and relevant trial, billing, or usage information needed for those messages.
• Hosting and infrastructure providers process information needed to deliver and protect the deployed service.

A QR destination is a separate website chosen by the QR owner. Its own privacy practices apply after you follow the redirect. Information may be processed in other countries depending on the deployment and providers used.

5. Sharing and security

We use service providers to operate QrOnly and may disclose information when required by law, to protect the service and its users, or in connection with a business transfer subject to appropriate safeguards. We do not sell QR scan profiles or account data for advertising.

Accounts are separated through access controls and database ownership rules. Payment credentials remain with the payment provider. No online service can guarantee absolute security; protect your password and contact us if you suspect unauthorized access.

6. Retention and deletion

We retain saved QR content and account information while needed to provide your account and the service. Cancelling a subscription does not automatically delete your account or saved QR destinations, but destinations pause when access and the three-day grace period end. Monthly usage records and reminder delivery records are retained as needed for metering and account support. A deleted QR stops resolving and its saved design and count are removed from the live database.

You can request account deletion or a copy/correction of your information through Contact. We may need to verify ownership before acting. Backups, dispute records, security records, or information required for legal and billing obligations may have separate retention periods. Dodo Payments controls retention of its own payment records.

7. Your choices and requests

Depending on the law that applies to you, you may have rights to access, correct, delete, or receive a copy of your information, object to certain processing, withdraw consent where consent is used, or complain to an appropriate authority. Use Contact to make a request or ask a privacy question. Do not send passwords, full payment-card details, or sensitive documents through the form.

8. Updates

We may update this policy as the service or its processing changes. The effective date above identifies the current version. Where required, material changes will be communicated through the service or the contact details associated with your account.