Privacy Policy
Last updated 9 August 2026. Short, because we collect little.
What we store about you
- Your email and a password hash. The hash is bcrypt; we never see your password.
- Your codes — destination URLs, labels, slugs, colours.
- Billing state — your Stripe customer and subscription id, plan, status and renewal date. Card numbers go to Stripe directly and never reach our servers.
What we store about people who scan your codes
For each scan: the time, a two-letter country supplied by our CDN, a device class (mobile, tablet, desktop or bot), a truncated browser user-agent, and the referring URL if the scanner's browser sends one.
We do not store IP addresses. We don't set cookies on the redirect, don't fingerprint devices, and can't identify an individual scanner — by design, not by promise. Scan data exists so you can tell whether your code is working, not so anyone can be tracked.
Email we send you
Essential email — password resets, address confirmations, payment notices and account changes. These are part of running your account and can't be switched off without locking you out of it.
Product email — occasional updates and tips about QRelay itself. Every one carries a one-click unsubscribe, we honour it, and you can switch it off anytime from your account page. We don't email you about anyone else's products, and we never hand your address to another company to email you.
Cookies
One cookie: a signed session cookie set when you log in. No analytics cookies, no ad trackers, no third-party scripts on any page.
Who we share it with
- Stripe — payment processing. Their privacy policy governs what they collect.
- Our CDN/hosting — passes traffic through and supplies the country code.
We don't sell data, and we don't share it for advertising.
How long we keep it
Account and code data lasts until you delete it. Deleting a code deletes its scan history. Deleting your account deletes everything associated with it — codes, scans, and any pending reset or verification links — immediately and permanently, not on a delay.
Your rights
You don't have to ask us for any of this. From your account page you can export everything we hold as a JSON file — account details, every code, every scan — and delete your account outright, which removes all of it immediately.
Deleting your account also deactivates every code you've made, so anything already printed stops working. Export first if you want a copy.
If you'd rather we did it, or you want something corrected, email [email protected] and we'll act within 30 days.
Security
Traffic is served over HTTPS, passwords are bcrypt-hashed, sessions are signed cookies, and payment details never touch our infrastructure. No system is perfect; if we ever have a breach affecting your data, we'll tell you.
Contact
QRelay — [email protected].