Skip to content

Privacy Policy

Plain-English answers about what we collect and why.

Last updated November 10, 2026

The short version

If you have an account

We store your email address, your name and profile picture if you sign in with Google, the codes you create, their designs and link history, and your API keys (stored only as one-way hashes). To keep you signed in safely, your sessions are recorded along with the IP address and browser they started from. If you invite someone to your workspace, we store their email address with the invite; an invite nobody accepts is erased, along with the email in your activity log, 90 days after it runs out.

When someone scans a code

To give code owners useful statistics we record the time of the scan, an approximate location (country, region and city, worked out from the network by our hosting provider), the device type, operating system and browser, and the referring site if any. To count unique scanners we keep a one-way fingerprint that changes every day and can’t be turned back into an IP address. Scans are kept for as long as the owner’s plan allows (90 days on the Free plan) and are deleted by a daily clean-up after that. Very fast repeat scans (the same kind of device and browser on the same network scanning the same code more than 3 times a minute, or one network scanning the same code more than 300 times an hour) aren’t stored at all; we only keep an hourly count of how many there were.

Basic (static) codes

Basic codes are made entirely in your browser. What you type, including Wi‑Fi passwords, never reaches our servers.

Unfinished designs in your browser

While you make a code, the maker keeps your unfinished design in your own browser’s storage, so you can come back to it (for example after signing in). It keeps the web address, the text of a note, the code’s name and its design: colors, shapes, logo, label and file choices. It never keeps Wi‑Fi names or passwords, contact cards, or email, text message or phone details. It stays on your device: nothing from it reaches us unless you go on to create an editable code with it. It’s dropped a day after your last change, and “Start fresh” in the maker clears it straight away.

Who helps us (subprocessors)

These companies process data only to provide their service to us. All of them process it in the United States.

We’ll update this list before adding a new subprocessor.

Where data lives and how it’s protected

Data is stored in the United States (US East). Every connection uses HTTPS, our database provider encrypts stored data, API keys are kept only as one-way hashes, and changes to your codes (who made them and when) are recorded in your workspace’s activity log, which owners and admins can download from Settings.

Cookies

We use a sign-in cookie to keep you logged in. We don’t use advertising or tracking cookies. The maker’s unfinished design is kept in your browser’s storage, not in a cookie (see above).

Security problems

Found a security issue? Please write to safety@qrtoast.com. We read every report and won’t take action against good-faith research.

When you delete something

A deleted code stops working within a few seconds and leaves your dashboard at once. Its scans are erased by the daily clean-up once 30 days have passed. A record of where it pointed is kept for one year so we can look into abuse reports. After that, its name, link, design, link history and the activity-log details that name its links are erased; the log keeps only that a change happened, when, and who made it. If someone reported the code to our safety team, that report, including the link they reported, is kept as a safety record. The short code itself is never given to anyone else, so an old printed code can’t start sending people somewhere new. Codes we’ve disabled for abuse are kept as evidence for up to two years after they’re deleted, and then erased the same way. If we lift a block because it was a mistake, the codes it stopped are treated like any other deleted code.

If you report a code

We keep what you tell us, the code’s destination at that moment, your email if you give one, and a one-way key made from your network address so one person can’t flood us with reports. The email and that key are erased after one year.

Your rights

You can export your codes and scans, or delete codes, from Settings. To delete your account entirely, get a copy of everything we hold about you, or ask a question, write to hello@qrtoast.com and we’ll respond within 30 days. Deleted data can stay in our database provider’s short-term backups for up to 30 days before it’s overwritten.