Privacy Policy

qrhue.com is operated by Avlas Digital (CRO Business Name No. 793798, Ireland), Park House, The Square, Claremorris, Co. Mayo, F12 HE97, Ireland. Contact: [email protected]. This page explains what we process and why, in plain words.

1. The QR code generator: nothing leaves your device

The generator, the scan check and the QR code test run entirely in your browser. The links, Wi-Fi passwords, contact details, images and designs you enter are never sent to our servers, stored or logged. You can confirm this by loading the page, disconnecting from the internet and continuing to work. The “copy design link” feature puts your design and content into the address of the link you copy; share that link only with people you want to see it.

2. Usage analytics

We want to know which pages are used and whether anything breaks. For that we use Cloudflare Web Analytics, which is cookie-free and does not identify individuals, and PostHog (EU hosting, Frankfurt) for aggregate usage statistics, error reports and anonymised session replays of how the interface is used. PostHog masks all text you type: form fields, link fields and uploaded images are never recorded. PostHog stores a cookie only after you accept it in the banner; until then it keeps nothing between page loads. You can decline and the site works identically.

3. Editable codes (when available)

To buy a slot you give us an email address, which we use to send one-time sign-in codes, receipts, a warning when the page behind one of your codes stops answering (at most one such email a week per code) and, for yearly slots, reminders before the year ends and once when the code freezes (at most four a year per slot). These are service emails about your purchase, not marketing, and there is no mailing list. Payments are processed by Stripe; we never see your card number. For each code we store its destination and every destination it has had, its name and note, its saved look, its creation date, and scan statistics: scans per day, how many different phones scanned each day, the country of the scan (from the network, at country level only) and whether the phone was iPhone, Android or something else.

When someone scans an editable code, our server receives the request for the short link and redirects it. To count “different phones today” without identifying anyone, we compute a one-way hash of the scanner’s IP address and browser string together with a secret key and the current date, keep that hash for at most two days, and then delete it. The IP address itself is never stored, the hash cannot be reversed, and because the date is part of it the same phone cannot be recognised from one day to the next. Known crawlers and link-preview bots are not counted. Edge logs of the redirect are kept by Cloudflare for up to 7 days for security and then deleted.

Once a day we fetch each code’s destination to check it still answers; the request carries only our own identifier, nothing about you. If you hand a code to someone else, we store their email address for up to 7 days, until they accept or the offer lapses. You can delete your account on the account page at any time, either everything (codes stop working at once) or only your personal data (lifetime codes keep redirecting to their last destination and can never be changed again; codes in yearly slots keep redirecting until their year ends). When a yearly slot ends and is not renewed, the code, its look and its scan statistics are kept for 365 days from the end date so a renewal can restore them, then deleted. Purchase records are kept for six years as Irish tax law requires.

4. Email

If you email us, we keep the correspondence for as long as needed to deal with it. We do not add you to any list.

5. Legal basis and your rights

Analytics are processed on the basis of our legitimate interest in running a working website, with consent for cookies. Account and payment data are processed to perform the contract with you and to meet tax record-keeping duties (kept for 6 years as Irish law requires). Under the GDPR you may ask for access to, correction of or deletion of your data, and object to processing, by emailing [email protected]. You may also complain to the Data Protection Commission (dataprotection.ie).

6. Processors

Cloudflare (hosting, analytics; EU and US with standard contractual clauses), PostHog (analytics, EU), Stripe (payments), Amazon Web Services (email delivery, EU). No data is sold to anyone.

7. Changes

If this policy changes in a way that matters, the date above changes and the change is described here.