Privacy Policy

1. Information We Collect

When you use UQR, we collect the following types of information:

Personal Information:

• Name, email address, and, if applicable, profile photo from Google, which are provided by the login provider (Google or email magic link).

QR Code Analytics:

• When a QR code is scanned, we collect data such as the visitor's country, city, browser type, device type, and operating system.

Cookies:

• We use cookies to manage user sessions and maintain a seamless user experience.

2. How We Use Your Data

We collect and use your data for the following purposes:

• Managing Your Account: Your personal information (name, email, etc.) is used to create and manage your account with UQR.
• Service Improvement: We use QR code scan data (country, city, device, etc.) to improve the functionality and performance of our services.
• Security: We use security measures like Cloudflare and Supabase to protect your data and secure our systems.

3. Third-Party Services

We do not sell your personal data. We do use the following third-party service providers to run, secure and measure UQR; each receives only the data it needs for its function:

• Supabase (database and sign-in) and Vercel (hosting): store and serve your account and QR code data.
• Stripe: processes subscription payments. Card details go directly to Stripe and never touch our servers.
• Resend: sends transactional and (if you opted in) newsletter email.
• Cloudflare: content delivery, security and Turnstile, which protects our sign-in, sign-up and password-reset forms from automated abuse. It runs a check in your browser in the background — there is no puzzle to solve — and Cloudflare processes limited technical data to tell people from bots. See Cloudflare's Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/
• PostHog: product analytics and error monitoring — the pages you view, actions you take in the app, browser and device type, approximate location derived from your IP address, and a random visitor identifier stored in a cookie. Once you sign in, your PostHog profile is keyed to your account identifier and carries your email and name so we can debug and support your account.
• Google Tag Manager and Google Analytics: measure how visitors reach and use UQR. Google Tag Manager loads Google Analytics on marketing pages and may set cookies to distinguish sessions.

These providers process data on our behalf under their own privacy terms. Some of them (Google, PostHog) set cookies or use similar identifiers in your browser — see section 8 for how to limit that.

4. Data Retention

We retain your personal data for as long as your account is active. We do not have a specific policy for deleting inactive accounts.

5. User Rights

You can view and update your name and email from your account settings, and delete your account — together with the personal data tied to it — from Profile → Delete account. You can unsubscribe from marketing email with the link in any email we send. Analytics scripts (PostHog, Google) can be blocked with a tracking blocker or your browser's third-party settings without affecting the service; the first-party cookies described in section 8 can be cleared from your browser's cookie manager. For any other request about your data, email [email protected].

6. Security

We take the security of your data seriously and employ services such as Cloudflare and Supabase to protect your information from unauthorized access or breaches. However, no method of transmission over the Internet or electronic storage is 100% secure, so we cannot guarantee absolute security.

7. Children's Privacy

We do not restrict access to minors, and our service is available to users of all ages. However, if we become aware that a minor under the age of 13 has created an account without verifiable parental consent, we may take steps to deactivate the account.

8. Cookies and Tracking Technologies

We use cookies to keep you signed in, remember preferences such as your language, and measure how the site and app are used (PostHog, Google Analytics). Our first-party cookie uqr_attrib remembers the campaign parameters (utm_*) that brought you here for up to 90 days so a later subscription can be attributed to that campaign. Session cookies are required — blocking all cookies for UQR signs you out and also disables guest QR creation, which relies on a session cookie. Analytics cookies are not required: tracking blockers stop the third-party ones, and uqr_attrib (set by UQR itself) can be deleted from your browser's cookie manager, though it is written again if you later arrive with campaign parameters in the URL.

9. International Users

We process and store data in the United States (Supabase, Vercel, Stripe). If you use UQR from outside the US — including the European Union, EEA and United Kingdom — your data is transferred to and processed in the US by us and the providers listed in section 3, under their standard contractual protections. You can exercise the rights described in section 5 wherever you live.

10. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you via email of any significant updates to this policy.