Privacy Policy

1. Who we are

QR Studio: Scan & Create (the “App”) is provided by Profitcentral SLU (“we”, “us”, or “our”). This policy explains how the App and its optional cloud service handle information.

2. Information we collect

Scanning and creating static codes happen on your device. We do not receive their contents or selected photos just because you use these local tools. Advertising and optional analytics have separate data practices described below.

• When you enable and use cloud sync, saved QR and barcode contents, titles, colors, favorites, identifiers, and timestamps are sent to our backend. Contents can include contact details, Wi-Fi credentials, messages, calendar information, and other personal text. Sync is not an individual-record selection: review your saved history before enabling it.
• Creating a dynamic QR sends its destination to our backend and creates a public redirect link. Anyone with that link can open its current destination. The redirect service records the QR and owner identifiers and the event time for scan counts; it does not record country, region, referrer, browser family, or a full IP address in those scan-event records. Infrastructure providers may separately process network data in operational or security logs.
• A pseudonymous cloud account identifier is created when needed for cloud features, optional analytics, or Pro verification. Apple transaction identifiers, products, purchase and expiry times, purchase environment, and subscription status are processed to verify and restore Pro access and prevent fraud. We do not receive payment card details.
• Optional product analytics and advertising are described in sections 6 and 7. We do not send QR contents, selected photos, or your saved history as analytics or advertising parameters.

We do not sell your personal information.

3. Information stored on your device

• Scan and creation history is stored locally on your iPhone using Apple’s on-device storage.
• Favorites, QR colors, and related code details remain on your device.
• Settings such as haptic feedback are stored locally in device preferences.
• You can export your history or delete it from the App at any time.

Deleting the App normally removes its locally stored data, subject to Apple’s device and backup behavior.

4. Optional account and cloud service

Cloud features use a pseudonymous account; the current app does not offer Sign in with Apple. Access controls and row-level security restrict each account to its own content. Our cloud infrastructure provider is Supabase, with the QR Studio database hosted in Ireland. Do not assume that installing the app on another device signs you into the same cloud account.

You can disable future synchronization without affecting local tools; this does not erase existing cloud copies. In version 1.0.0 build 26 and later, deleting a saved static code queues its deletion for the next successful sync to its original account. The server retains only the code identifier, account identifier, and deletion time to prevent another device from uploading it again. These deletion markers contain no QR content and are removed when the cloud account is deleted.

Removing a dynamic QR from your local history does not delete its hosted link. Builds with hosted-link management offer separate controls in the code details: pausing blocks future redirects while retaining the link, destination, and plan slot; deleting the hosted link removes its scan-event records and frees that slot after server confirmation. Neither action closes pages already open. The server retains request identifiers and a deleted-link marker with the account to avoid recreating a link when an old request is retried; local history and pending edits are not erased by hosted-link deletion.

To delete your cloud account and associated cloud content, use the account-deletion control in Settings while connected. Once confirmed, hosted links belonging to that account stop working. Local records remain until you delete them separately. Deleting a cloud account does not cancel an Apple subscription; manage that separately in your Apple account.

In builds with deletion-result recovery, the App saves a private receipt on this device before requesting account deletion. It contains an operation identifier, the account identifier, a random recovery key, a date, and the request state—not QR contents or a login token. It is excluded from device backups. The backend stores the operation identifier, a hash of the key, creation and expiry times, and an account reference that is removed when the account is deleted. The key lets the App check the result even if the signed-in session no longer works; it cannot sign in, recover account content, or request a new deletion. It is sent securely in the request body, not a web link. Do not share this key.

A missing response, an expired receipt, or an unavailable result does not prove deletion. Where recovery controls are available, Settings can check the result without sending another deletion request. For older requests without a receipt or requests at least seven days old on the device, an explicit local-disconnection option may be offered. Disconnecting preserves local history but loses access to that cloud identity from this installation; the account and links may still exist on the server. It is not a substitute for confirmed deletion. Contact support if the result remains uncertain.

5. Camera and photo access

Camera access is used only when you choose to scan a code. When you choose an image from Photos, the selected image is analyzed on your device and is not uploaded to us or retained by the App. Apple’s system photo picker may allow you to share only the image you select.

6. Advertising and consent

The free version may display ads supplied by Google AdMob below QR Studio’s in-app destination browser and, occasionally, before opening a scanned destination. The banner remains outside the third-party website and is not injected into its content. Pro subscribers do not see these ads. Earlier builds did not request Apple’s App Tracking Transparency permission. Version 1.0.6 requests it as described below. Starting with build 50 of version 1.0.2, Google UMP determines the applicable advertising choices. Where UMP reports that consent is not required, the App allows Google’s publisher first-party identifier and no longer forces the non-personalized request option. Where consent is required, the App retains conservative ad-request settings and applies the available consent signals.

AdMob may process an IP address to estimate general location, device identifiers, ad impressions and interactions, product interactions, crash logs, and performance information to deliver, limit, report, secure, and improve ads. Non-personalized ads are not selected from your past activity, although Google may still use local storage or device identifiers for frequency capping and aggregated reporting. Google’s practices are described in the Google Privacy Policy.

Where required, Google’s User Messaging Platform asks for your privacy choices before ads are requested. You can review or change available advertising privacy choices from Settings in the App. Refusing consent does not disable the App’s core local features; depending on local rules and technical availability, limited ads may be shown.

7. Usage measurement and optional analytics

These controls differ by version. Through version 1.0.1, Google Analytics for Firebase requires an opt-in. In version 1.0.2 (builds 49–50), Basic is the default when no previous choice exists and sends limited consent-mode signals with analytics storage denied; a notice explains the choice. The rules below apply starting with version 1.0.3 (build 51). A previous explicit Off choice remains Off when you update.

In version 1.0.3, Settings → Usage measurement offers Basic, Detailed and Off. Basic permits Firebase Analytics collection and analytics storage, including an app-instance identifier, app and device information, event times, app opens, plan views and permitted purchase/trial events. It denies advertising storage, advertising user data and advertising personalization. Basic does not activate our account-linked backend analytics or create an account for analytics. Our manually logged Basic events exclude account and transaction identifiers, QR contents, photos, saved history and paywall experiment identifiers.

Detailed permits Analytics and requests advertising-related measurement only within the permissions actually available from Google UMP, Apple’s App Tracking Transparency status and applicable US privacy signals. Earlier builds did not request ATT authorization; version 1.0.6 requests it as described below. Without ATT authorization, our Firebase advertising consent types remain denied; Firebase IDFV collection is disabled. The full Firebase Analytics SDK includes identity-support and event-based on-device conversion components, but their presence does not grant tracking permission. We do not provide email addresses or telephone numbers for conversion measurement. Meta App Events is absent in build 50 and later.

UMP refreshes applicable privacy information on each launch. While it is unresolved, requires a response or encounters an error, Firebase measurement remains disabled. Where GDPR consent is required, a returned advertising form is not by itself treated as agreement to Analytics: an additional in-app Basic / Detailed / No measurement choice is requested when the Analytics decision cannot be established. Explicit rejection is respected. Settings offers Manage consent when UMP makes privacy options available and a retry if privacy information could not load. Local scanning, creation, saving and export remain available without analytics consent.

For a new installation where UMP successfully reports that GDPR consent is not required, Detailed is the default measurement preference, subject to the advertising restrictions above, and can be changed to Basic or Off in Settings. This regional default does not opt into account-linked analytics on our backend. We do not infer geography from your language. Existing manual choices are preserved; an old Basic choice does not authorize the new Analytics identifiers until you confirm the new meaning. Existing Detailed permission does not acquire new advertising permissions without confirmation. Changing privacy options may revoke or pause measurement until a new choice is confirmed. The former informational strip on the home screen is removed; the controls and explanations remain in Settings.

Starting with build 50, Basic and Detailed also measure first-party paywall experiments on our Supabase backend. Each installation uses a random identifier and a separate secret for each experiment and screen placement. We record the displayed variant and revision, view time, checkout, cancellation, pending and failure events. When you purchase, we associate the originating presentation with the Apple-verified initial subscription transaction and its later payment outcomes. This purchase association is linked to the pseudonymous purchase account and is not anonymous. Seeing a paywall does not create an account. These experiment identifiers are not sent to Firebase or Google Ads and are not used to follow you across other apps. Reports distinguish repeated views, installations, free trials, Sandbox tests and verified paid subscriptions.

Experiment records are eligible for deletion after 90 days; a daily maintenance job removes them. Pending events remain on your device for at most seven days. Choosing Off clears unsent events and queues a request to delete the corresponding experiment views and purchase associations; delivery requires connectivity while the App is open. Revocation tokens are retained until acknowledged locally and up to 90 days on our server to prevent delayed requests from recreating revoked records. Abuse protection briefly processes network addresses and retains only a daily rotating keyed hash for up to one day, subject to the maintenance schedule. Infrastructure security logs and backups follow the provider’s policies. No QR contents, photos, email addresses, telephone numbers or advertising identifiers are included in these experiment events.

If you manually choose Detailed, QR Studio also enables its optional account-linked product analytics on Supabase, as explained in the in-app choice. This may process a pseudonymous account identifier, app/device information, event times, code types or counts, product and paywall identifiers, transaction identifiers, and purchase amount and currency. Automatically selected regional defaults and advertising-form responses do not enable this backend opt-in. QR contents, photos and saved history are not sent as analytics parameters. Server-to-Google purchase reporting remains disabled in builds through 52.

Starting with version 1.0.4 (build 53), when account-linked analytics is explicitly enabled and the effective Firebase Analytics permission permits it, QR Studio can associate this installation’s Firebase app-instance identifier with a verified subscription checkout. Earlier builds offered an optional checkout choice if Detailed was selected automatically by region. Version 1.0.6 removes that extra checkout modal outside GDPR regions. Automatic regional Detailed and Apple tracking authorization do not enable this account-linked server channel; explicit Detailed selection in Settings is still needed. Existing Basic or Off choices are not changed automatically. The backend sends eligible Apple-verified trial starts, first paid subscription events and subsequent subscription payments to Google Analytics for Firebase, including after the App is closed. These events contain the installation identifier, product, transaction identifier, event date, amount and currency; not QR contents, email addresses or telephone numbers. Advertising user data and personalization remain denied for this server channel. An account or an old payment without an authorized installation association is not retroactively linked.

The backend stores the authorized installation association while the permission and account remain active, and removes it when a revised consent or account deletion is received. Operational checkout, payment-routing and delivery-attempt records are eligible for removal after seven days by maintenance jobs. Apple subscription records needed to provide the service are separate. On this device, a private, backup-excluded delivery journal prevents duplicate reporting and supports privacy cleanup. Choosing Basic or Off stops future optional server reporting and queues revocation; connectivity is required to deliver that change. Google may already have received events before revocation. A successful HTTP delivery does not prove Google has processed an event or attributed it to a campaign.

We use these metrics to understand product usage and purchase conversion. The Analytics property is linked to our Google Ads account for campaign measurement, with personalized advertising disabled. Limited signals may support modeled reporting if Google's requirements are met; they do not guarantee that every installation or payment appears in reports or can be attributed to an ad. TestFlight purchases are logged by our integration as test events, not real purchase conversions.

Choosing Off stops future product analytics collection on this device, including Basic signals. It queues deletion of the build-50 experiment data described above but does not automatically erase legacy analytics or data already received by Google. Updating cloud consent requires a connection; pending changes are retained on the device and retried while the App is open and connected. Purchase verification, subscription status and Apple subscription notifications remain separate from analytics, so Pro access and subscription management continue to work. See Google's consent-mode documentation, Firebase privacy information and the Google Privacy Policy.

7a. AppsFlyer campaign measurement — version 1.0.6

The following flow applies starting with version 1.0.6 (build 56); earlier installed versions do not include AppsFlyer. After Google UMP resolves this launch’s applicable regional privacy information, non-GDPR users with Detailed measurement can receive Apple’s native tracking permission at startup. No European consent banner is forced on US users. The optional non-GDPR post-purchase question from build 55 is removed in version 1.0.6; account-linked Firebase subscription measurement remains a separate explicit Settings choice and is not authorized by ATT. Regional privacy requirements and available opt-out controls still apply. Prior Basic, Off, and unconfirmed legacy choices are respected.

AppsFlyer starts only with valid tracking authorization, versioned permission for this provider and compatible regional advertising choices. Apple authorization is not reused as GDPR consent when travelling: GDPR users must explicitly enable AppsFlyer in Settings. An old Firebase permission is not copied to AppsFlyer. The service can receive the advertising identifier, installation identifiers, app/device and network information, event times and confirmed trial starts to measure Google Ads campaigns. QR content, saved history, account identifiers, email and phone are not supplied by our integration. AppsFlyer IDFV and automatic SKAdNetwork conversion-value updates are disabled; the App retains one SKAdNetwork writer.

Our trial event is sent only after a locally verified, eligible Production StoreKit free-trial transaction, without revenue. Transactions predating provider permission, paid purchases and renewals are not sent through this initial AppsFlyer channel. Duplicate callbacks are reserved locally before SDK delivery. TestFlight/development builds do not start the live AppsFlyer SDK or send live install/trial events. Choosing Basic, Off, revoking AppsFlyer or Apple permission, or incompatible regional privacy choices stops future reporting. Already received data is not automatically erased. The SDK may retry eligible requests; receiving a trial does not guarantee Google Ads campaign attribution.

Manage AppsFlyer, usage measurement and available regional advertising choices in App Settings, and Apple tracking permission in iOS Settings. Refusing does not restrict local tools or purchasing. See the AppsFlyer Privacy Policy. Authorized cross-company advertising measurement is disclosed in the App Store privacy information.

7b. Optional first-payment measurement — version 1.0.7

Starting with version 1.0.7, optional first-payment measurement can link a newly confirmed free trial to this AppsFlyer installation on our server. With specific permission, compatible regional privacy choices and Apple tracking authorization, the server can send the first Apple-confirmed charge after that trial to AppsFlyer and Google Ads, even while the app is closed. Later renewals and direct purchases are not sent through this channel. The initial implementation is available only outside the GDPR region. A trial-only permission from version 1.0.6 is not expanded; existing users can review the separate first-payment option in App Settings.

The backend link includes the pseudonymous purchase account, verified trial and subscription identifiers, installation identifier, OS version, permission revision and receipt time. AppsFlyer receives its installation identifier, OS, consent/ATT status, charged amount and currency, product and event time, not our account or transaction identifiers, QR contents or contact details. Active links expire one day after the trial ends. Successful scheduled maintenance redacts the AppsFlyer identifier and OS of expired or withdrawn links. Redacted revision and dispatch markers prevent stale opt-ins or duplicate reporting and remain until account deletion.

Withdrawing in App Settings queues revocation; an offline or unavailable original session can delay delivery until a later attempt or expiry. Turning it off does not cancel your Apple subscription or delete information already received by AppsFlyer or Google. Measurement receipt does not guarantee campaign attribution. A policy update does not install the new app version.

8. Sharing, exports, and this website

If you export a QR image or CSV history, you choose the destination through Apple’s share sheet. That destination’s privacy practices then apply. Cloud sync and public dynamic links work as described above. The support pages at studioqrapp.com are hosted by Cloudflare. Cloudflare may process network and request information to deliver and secure the website; see the Cloudflare Privacy Policy. The previous address remains available on GitHub Pages; GitHub may process request information when you visit that address. See the GitHub General Privacy Statement.

9. External links

The App can identify and open links encoded in a QR code. QR Studio displays the destination and performs local checks, but it cannot certify that a website is safe. Opening a link sends a request to that website, whose operator may receive your IP address and browser information and set cookies under its own policy. A destination may itself contain ads or tracking. QR Studio does not inject advertising into external websites.

10. Retention and children’s privacy

Local history remains until you delete it. Cloud content remains until removed through the service or account deletion. Deletion markers remain with the cloud account as explained above. Disabling sync does not erase previously stored information. Turning usage measurement Off queues deletion of the build-50 experiment records as described in section 7; legacy records are handled separately. Our backend retains subscription and paywall event records after account deletion with their account reference removed; purchase transaction identifiers and event metadata may remain, so these records should not be assumed to be anonymous. Contact us for a request concerning those records.

Account-deletion receipts can be queried for seven days after their server registration; retrying the same unexpired request does not extend that window. Expired receipts cannot be queried. An hourly maintenance task removes expired records from the live database; a busy record or an operational failure can delay physical removal until a later successful run. The local receipt is removed after confirmed deletion and successful local cleanup, or after you explicitly complete local disconnection. A pending receipt may remain on the device while the result is unresolved. These receipts do not contain QR content or restore a deleted account.

Providers may retain backups, security logs, transaction, analytics, or advertising records under their applicable policies and retention settings; deleting your QR Studio account does not erase Apple’s purchase records or automatically delete Google-held analytics or advertising data. QR Studio is not directed to children under 13, and we do not knowingly collect personal information from children.

11. Security and international processing

We use access controls, encrypted transport, restricted backend secrets, and data minimization. No online service can guarantee absolute security. The QR Studio database is in the European Union; Google, Apple, Cloudflare, GitHub, and infrastructure providers may process information in other countries under their applicable safeguards. Cloud sync is not end-to-end encrypted: the backend processes the content necessary to provide the service.

12. Your choices and contact

You can use the local tools without enabling cloud sync or product analytics, change analytics and available advertising privacy choices in Settings, export local history, and request cloud-account deletion in the App. Depending on the law applicable to you, you may have rights to access, correct, delete, or receive your personal data, restrict or object to processing, withdraw consent, or complain to a data-protection authority.

For privacy questions or data requests, contact Profitcentral SLU at contact@profitcentral.net. Do not email passwords, Wi-Fi credentials, payment details, or private QR contents. We may need limited information to verify a request and locate a pseudonymous account.

13. Changes to this policy

We may update this policy if the App’s features or data practices change. The current version and effective date are published here. Features may differ between builds. Build 32 introduced hosted-link deletion and build 33 added deletion-result recovery. Version 1.0.6 adds the optional AppsFlyer measurement flow described above. A policy update does not install an app update; check the version installed on your device. See Support for instructions that apply to the controls available in your installed version.

14. Resilient trial measurement in updated builds

Updated builds may retain a verified, already-authorized trial locally while the measurement SDK is starting. This pending record contains a hash of the transaction reference, product identifier, purchase time and permission time, not a receipt, account identifier, AppsFlyer identifier, advertising identifier, price or QR contents. Pending records expire after seven days and are removed during the next successful local startup or measurement maintenance. Withdrawing permission clears pending records. Local hash reservations prevent the App from submitting the same trial again; after submission, the SDK manages its own network retries. Delivery confirmation in Settings does not prove Google campaign attribution.

Applicable US privacy choices are interpreted rather than treating the presence of a privacy signal as a refusal. Actual sale, sharing or targeted-advertising opt-outs, Global Privacy Control, unknown applicable choices and Apple tracking refusals still restrict advertising measurement. An update does not override an existing Basic or Off choice. These changes require an updated app build; updating this page alone does not update your installed app.