Your data, in plain words.

This page explains what QTcode (qtcode.io) collects, why, who helps us process it, how long we keep it, and how you can see, fix or delete it. We collect as little as we can, we never sell data, and we show no ads.

People who scan
Account holders
Service providers
How long
Your rights
Contact

If you scan a QTcode

You don't need an account, and we don't learn who you are. When you open a short link (qtcode.io/…), we send you to the owner's page and count the scan with four things only:

the time of the scan;
the country, as two letters (for example CA);
the kind of device (phone, tablet or computer);
the share channel, when the link carries one (for example ?via=whatsapp).

We don't store your IP address, your city or exact location, your browser details, or any cookie or ID that follows you. Our host (Netlify) handles the connection to deliver the link and passes on only the country and device type. A scan can't be traced back to a person, even by us. The scan counts are shown only to the code's owner.

Once you reach the owner's page, their own privacy policy applies, not ours.

If you report a code, we keep the code, the reason you chose and the details you typed (up to 500 characters). We don't ask for your name or email.

If you have a QTcode account

What	Why
Your email address, and your name and photo if you sign in with Google	To create your account, sign you in and contact you about it. Sign-in is handled by Clerk; we never see your Google password.
Your codes: name, short link, destination, style, logo (if you add one), the QR image, and the history of past destinations	To run your codes and show you what changed.
Scan counts for your codes (as described above)	To show you your stats. Only you can see them.
Share clicks from the QTcode browser extension: which code, which channel, when	To show you which channels bring scans.
Your plan, and your Stripe customer and subscription IDs	To know what you paid for. Card details go to Stripe and never reach QTcode.
The motion packs you own (bought, or Pro's pack of the month) and which code is your free animated code	To know which designs you can use.
Designs you save in the design studio (Pro), including any background photo you upload	To show, edit and export your designs. Deleted with the design, its code or your account.
When you transfer a code: the email address you send it to, if you enter one	So only that account can accept it. Deleted 30 days after the transfer is accepted, cancelled or expires.
Daily usage counts (codes created, link checks)	To apply fair-use limits and stop abuse.
Apps you connect, such as Claude (an app ID and hashed access tokens)	To let those apps act on your codes after you approve them. You can disconnect them any time from your profile.

We don't use your data for advertising, we don't sell or rent it, and we don't build profiles of you.

Link safety checks

To protect the people who scan, every destination link is checked against Google Web Risk (known phishing and malware sites) when it's saved, and again regularly. Only the link itself is sent to Google; nothing about you or the people who scan.

Cookies and browser storage

Scanning a code sets no cookie.
Our public pages run no analytics, no tracking pixels and no ads.
When you sign in, Clerk sets the cookies it needs to keep you signed in, and the dashboard keeps your session in your browser's storage. They are needed for the service to work and aren't used for tracking.
Pages load fonts from Google Fonts, which receives your browser's request for the font files.
When you choose English or French, your browser remembers it in a cookie (nf_lang) and in its storage (qtcode_lang). They hold only "en" or "fr", are kept for up to a year, and aren't used for tracking.

Who helps us run QTcode

We use a few service providers, each only for its own part of the job:

Netlify: hosts the website and serves the short links.
Clerk: sign-in and account emails.
Stripe: payments and invoices.
Resend: sends the invitation emails QTcode sends to people we invite. We don't keep the invited address.
Google: Web Risk link checks and Google Fonts.

Your account, codes and stats are stored in QTcode's own database, on a server we run ourselves. Its admin tools can't be reached from the internet, and every connection uses HTTPS.

Some of these providers are based in the United States, so your information may be processed outside Quebec and Canada. We only use providers that protect personal information to a standard comparable to ours.

We may disclose information if the law requires it. If QTcode is ever sold or merged, your information would move with the service, under this same policy or one that protects it at least as well.

How long we keep it

Codes never expire. We keep your account, codes and stats for as long as your account exists.
Delete a code and its scans, history and reports are deleted with it.
Delete your account and all of its codes and stats are deleted with it.
Daily usage counts are deleted after 7 days. Expired connection tokens are cleaned up every hour.
Stripe keeps payment records as long as tax and accounting rules require.

Your rights

You can ask us to:

tell you what information we hold about you, and give you a copy;
correct it;
delete your account and everything in it;
stop using your information for a purpose you no longer agree with.

You can change or delete your codes yourself in the dashboard, and disconnect apps from your profile. For anything else, including deleting your account, write to us (below). We answer within 30 days. If you're not satisfied with our answer, you can complain to the Commission d'accès à l'information du Québec.

QTcode isn't meant for children under 14, and we don't knowingly collect their information.

Security

Every connection uses HTTPS, accounts only see their own data, and connection tokens are stored as hashes. Read more on our security and privacy page. If we ever have a privacy incident that could cause you serious harm, we'll tell you and the authorities as the law requires.

Contact and changes

The person responsible for protecting personal information at QTcode can be reached at hlarosesurprenant@gmail.com.

If we change this policy, we'll update the date below, and we'll let account holders know by email before any important change takes effect.