Privacy Policy
Last updated: February 4, 2026
1. Introduction
Welcome to Honest QR ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our QR code generation and management platform.
2. Information We Collect
We collect information that you provide directly to us when you:
- Create an account (email address, password)
- Complete your profile (full name, company name, phone number)
- Sign in with Google OAuth (email, name, profile picture)
- Provide your email on the landing page to receive a QR code via email
- Create and manage QR codes (destination URLs, custom slugs, titles)
- Submit our contact form (name, email, message)
- Upgrade to Pro or Business (payment information via Stripe)
Note on free static QR codes: When you use our free static QR code generator on the landing page without providing your email, we do not collect any personal data. Static QR codes are generated entirely in your browser — no data is sent to our servers.
We automatically collect certain information when you use our services, including:
- QR code scan counts (anonymous analytics)
- Browser type and operating system
- IP address and general location
- Session cookies for authentication
3. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain our QR code platform
- Authenticate your account and manage your session
- Process your Lifetime Pro upgrade payments via Stripe
- Track QR code scan analytics for your dashboard
- Respond to your contact form submissions and support requests
- Send important service notifications (account changes, payment confirmations)
- Improve our services and develop new features
- Detect, prevent, and address technical issues or fraudulent activity
4. Third-Party Services
We use the following third-party service providers:
Supabase (Database & Authentication)
Stores your account information, QR code data, and manages authentication. Supabase is SOC 2 Type II certified and GDPR compliant. Data is encrypted at rest and in transit.
Stripe (Payment Processing)
Handles Lifetime Pro payments. We do not store your full credit card information. Stripe is PCI DSS Level 1 certified.
Google OAuth (Authentication)
Provides single sign-on functionality. We only receive your name, email, and profile picture when you choose to sign in with Google.
Resend (Email Notifications)
Sends email notifications for contact form submissions and QR code delivery emails from the landing page. We only share the information necessary to deliver these emails.
5. Data Security
We implement industry-standard security measures to protect your personal information, including:
- HTTPS encryption for all data transmission
- HTTP-only secure cookies for session management
- Row Level Security (RLS) policies in our database to isolate user data
- Password hashing using bcrypt
- Regular security audits and updates
However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
6. Cookies and Tracking
We use HTTP-only session cookies to authenticate your account and maintain your logged-in state. These cookies are essential for the platform to function and are automatically deleted when you log out or after the session expires (typically 7 days). We do not use third-party tracking cookies or analytics tools that collect personally identifiable information.
7. Your Privacy Rights
Depending on your location, you may have the following rights under GDPR, CCPA, and similar privacy laws:
- Access: Request a copy of the personal data we hold about you
- Correction: Update or correct inaccurate information in your profile
- Deletion: Request deletion of your account and associated data
- Data Portability: Receive your data in a structured, machine-readable format
- Opt-out: Unsubscribe from non-essential communications
To exercise these rights, please contact us using the information in Section 10 below.
8. Data Retention
We retain your personal information for as long as your account is active or as needed to provide you services. If you request account deletion, we will permanently delete your personal data within 30 days, except where we are required to retain it for legal, tax, or regulatory purposes. QR code scan statistics are anonymized and may be retained for analytics purposes.
9. Children's Privacy
Our services are not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately, and we will delete it.
10. Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please contact us:
- Email: privacy@honestqr.com
- Contact Form: honestqr.com/contact
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on this page with a new "Last updated" date. Your continued use of our services after such changes constitutes acceptance of the updated policy.