Privacy Policy

Last updated: October 5, 2026

1. Who we are

qrrr.io is operated by Individual Entrepreneur Vladimir Konovalenko, an individual entrepreneur registered in Georgia by the LEPL National Agency of Public Registry under identification number 345700565, with its legal address at Juli Shartava Ave. N 32, 6th floor, Batumi, Georgia ("qrrr.io", "we", "us").

We are the controller of the personal data described in this policy. You can reach us about anything in it at [email protected].

This policy covers the website at qrrr.io, the workspace where QR codes are created and managed, and the redirect service that answers when someone scans a dynamic code (together, the "Service"). It is written to meet the Law of Georgia on Personal Data Protection and, where they apply to you, the EU General Data Protection Regulation (GDPR) and the UK GDPR.

2. The short version

• We collect what it takes to run your account and your codes: your email address, your name if you give one, and the content of your codes.
• For people who scan a code, we record the time, the country, the type of device and browser, and the referring page. We do not store the IP address of anyone who scans a code.
• The website uses Google Analytics only if you allow it in the cookie banner. The workspace and the redirect service use no analytics cookies. There is no advertising on qrrr.io, and we do not sell personal data.

3. Data we collect from account holders

3.1 Account and workspace

• Email address, which identifies your account and is where sign-in links and service notices go.
• Name, if you enter one or your sign-in provider shares it.
• Workspace data: the names of your workspaces, who belongs to them and in which role, and invitations — including the email address of each person invited.

3.2 Signing in

• Email sign-in. We email you a single-use link that expires after 15 minutes. We keep only a cryptographic hash of the link, never the link itself.
• Google and GitHub. If you choose to sign in with one of them, the provider tells us your account identifier there, your name and the email addresses it has verified for you. We use the addresses to find or create your account and keep the identifier so we recognise you next time. We do not keep the access token the provider issues, and we receive no password.
• Sessions. Once you are signed in, we keep a record of the session for up to 30 days: when it started and was last active, your browser's user-agent string so you can tell your sessions apart, and a hashed form of the IP address it started from. You can see and end your sessions in your profile.

3.3 What you put into codes

We store the content of every code you create: destination addresses, text, and any contact details, event details or Wi-Fi credentials you enter, together with your design choices and any logo you upload. It is visible to the members of your workspace.

To protect the people who scan codes, the destination address of every dynamic code is checked against Google Web Risk when you save it and periodically afterwards, and a code pointing to a site flagged as unsafe is blocked. Only the address is sent to Google, not who created the code.

3.4 Error reports

When something breaks in the workspace, the error is reported to Sentry together with technical context: the page, your browser and operating system, and your internal account identifier. Your email address and name are not included.

3.5 Server logs

Like any web service, our servers log the requests they receive, including the IP address they came from. We use these logs to keep the Service running and to investigate abuse, and keep them only for a limited time.

4. Data we collect when someone scans a code

People who scan a qrrr.io code are usually not our users, and they have not agreed to anything. We therefore keep the minimum that lets a code's owner see how it performs. For each scan of a dynamic code we record:

• the time of the scan;
• the country, as determined by our network provider from the IP address — we receive the country, not a location;
• the browser's user-agent string, which tells us the type of device, operating system and browser;
• the referring page, if the browser sends one;
• a daily visitor identifier: a one-way hash of the IP address and user-agent string, computed with a random value that is generated each day and deleted when the day ends. It lets us count unique visitors within a day. Once the daily value is deleted, nobody — including us — can work back from the identifier to an IP address or link it to the same visitor on another day.

The IP address itself is used to complete the redirect and is not stored with the scan. We do not use cookies or fingerprinting on scans, and we do not build profiles of people who scan codes.

Static codes contain their content directly in the image. Scanning one does not contact our servers, so we learn nothing about it.

5. Why we use data, and on what basis

We do not send marketing email, and we make no decisions about you by automated means that have legal or similarly significant effects.

6. Who else handles data

We use a small number of service providers, each bound by a data processing agreement and allowed to use the data only to provide their service to us:

Beyond these providers, we disclose personal data only when the law requires it, to protect people from harm or the Service from abuse, or as part of a transfer of the business, in which case this policy continues to apply to the data transferred. Within a workspace, members see the codes, statistics and member list of that workspace.

7. International transfers

We operate from Georgia, and our servers are in the European Union. Some of the providers above process data in the United States. Where data leaves the European Economic Area, the UK or Georgia for a country without an adequacy decision, the transfer relies on the safeguards the law provides, such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

8. How long we keep data

• Account data — for as long as your account exists.
• Codes and their scan statistics — for as long as the code exists. Deleting a code, or the workspace it belongs to, deletes its statistics with it.
• Sign-in links — expire after 15 minutes and cannot be used twice.
• Sessions — up to 30 days, or until you sign out or end the session.
• Invitations — expire after 7 days unless accepted.
• Daily visitor values — deleted at the end of each day (UTC).
• Website analytics — kept in Google Analytics for 2 months; its cookies expire after 13 months at most.

When you ask us to delete your account, we delete your personal data, except what we must keep to meet a legal obligation or to establish or defend a legal claim.

9. Cookies and browser storage

9.1 Strictly necessary

These are what the Service needs to work:

• qrrr_session — keeps you signed in to the workspace; up to 30 days.
• qrrr_oauth — exists for at most 10 minutes while you sign in with Google or GitHub, to protect the sign-in against forgery.
• Browser storage — remembers your colour theme, which workspace you last had open, and your answer to the cookie banner. It never leaves your browser.

Cloudflare may set its own strictly necessary cookies to tell people from automated attacks. None of these are used for analytics or advertising, so they don't need your consent.

9.2 Analytics, only with your consent

On the website at qrrr.io — not in the workspace and not when a code is scanned — we ask whether you allow analytics cookies. Until you click "Allow", Google Analytics is not loaded at all and your browser sends nothing to Google.

If you allow it, Google Analytics sets the _ga and_ga_<ID> cookies, which tell visits apart for up to 13 months, and reports to us which pages were viewed, how you arrived, your approximate location and the type of device and browser. Google Analytics does not store your IP address. Google signals and advertising features are switched off, so the data is not used for ads.

You can change your mind at any time with "Cookie settings" at the bottom of every page. Declining after you have allowed analytics removes the cookies.

10. Security

All traffic is encrypted in transit. Sign-in links, sessions and invitations are stored only as cryptographic hashes, so a copy of the database would not let anyone sign in. Our servers accept connections only through our network provider, and the database is not reachable from the internet. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the competent authority as the law requires.

11. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we use it, including use based on legitimate interests;
• receive the data you gave us in a portable format;
• withdraw any consent you have given, without affecting earlier use.

Email [email protected] from the address on your account, and we will respond within the time the law allows — one month under the GDPR. You can change your name and end sessions yourself in your profile.

If you scanned a code, we cannot connect a scan to you, because we don't store anything that identifies you. If you have a concern about a particular code, contact its owner or write to us.

You can also complain to a data protection authority: in Georgia, the Personal Data Protection Service; in the EU or the UK, the authority where you live or work. We'd appreciate the chance to resolve your concern first.

12. Children

The Service is not intended for anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.

13. Changes to this policy

When we change this policy, we update the date at the top. If a change materially affects how we handle your data, we will tell account holders by email or in the workspace before it takes effect.

14. Contact

Individual Entrepreneur Vladimir Konovalenko
Juli Shartava Ave. N 32, 6th floor, Batumi, Georgia
[email protected]