Privacy policy

Who is responsible

qrcode.house is run by Designbooth, Hampshire, United Kingdom. We are registered with the Information Commissioner’s Office under number ZC267487. For privacy questions, use the contact form.

What we collect

• Account. Email address, a password you choose, or a Google sign-in. We send confirmation and reset messages through our auth provider.
• Contact form. Name, email, message, and any code or short link you include, so we can reply.
• QR content you save. For hosted URL codes: the destination, slug, name, and claim details. Wi‑Fi passwords and other baked-in types are encoded in the downloaded pattern and are not stored for later editing.
• Payments. Unlock checkout is handled by Stripe. We store the subscription status needed to keep a code unlocked. We do not see full card numbers.
• Scan logs. When someone opens a hosted short link we may store the time, user agent, and referrer. We do not currently offer owners a scan-stats dashboard.
• Abuse limits. Create requests are rate-limited by IP address so the public generator cannot be flooded.
• Site analytics. Google Analytics 4 (measurement ID G-DQDWPPDQ2B) runs on marketing and product pages so we can see which pages are used.

Why we use it

To run the generator, host short links, take payment for an unlock, keep the service stable, and understand which public pages are useful. We do not sell personal data. We do not use it to build advertising profiles for other companies.

Who else sees it

We use processors to run the product: Vercel (hosting), Supabase (database and sign-in), Stripe (payments), and Google (Analytics, and Google sign-in if you choose it). Each of those companies acts on our instructions for this service.

How long we keep it

Account and hosted QR data stays while the account or code is active. If you ask us to delete an account, we remove the account and the codes you own, unless we must keep a record of a payment or of abuse. Scan logs and rate-limit counters are operational data and are not kept longer than we need them for the service.

Your rights

Under UK GDPR you can ask for a copy of your data, a correction, a deletion, or a restriction. You can object to analytics. Use the contact form. You can also complain to the Information Commissioner’s Office.

Cookies

Sign-in uses cookies (or similar storage) so we know it is you. Google Analytics uses cookies to measure visits. You can block analytics cookies in your browser; the generator still works.