QR Code Scan Privacy Policy

Last updated and effective: 16 October 2026

You scanned a QR code and it opened through quickqrc.com. This page explains what happens to your data when that happens. QuickQRC is run by Quick Espirt, a business based in Pakistan. If you have a QuickQRC account, our main Privacy Policy covers your account as well.

QuickQRC
One Scan, Itemised · No. 0001
IP address Not stored
Used for a moment to look up your country and city on our own server, then dropped.
Device Type and OS only
For example "mobile, iOS". Not your browser string, model or any device ID.
GPS location Never
We never ask for your precise location.
Tracking cookies from us None
Scans are counted without cookies. Exceptions on Free-plan ad screens and owner-added tags are explained below.

This policy applies to anyone who scans a dynamic QuickQRC code, opens a short link on quickqrc.com (such as quickqrc.com/r/…), or views a page hosted by QuickQRC on behalf of a code owner, such as a menu, business card, event or feedback page. You do not need an account, and you have no agreement with us; this page is here so you know what happens.

If the code you scanned is a static code made with our free generator, the information is printed in the pattern itself and your phone reads it directly. The scan never reaches QuickQRC, so we receive nothing at all. Whatever you open next, such as a website, is covered by that site's own privacy policy.

  • The code owner is the person or business that created the code. They choose where it leads and what the page asks for, and they see the scan statistics. For anything they collect from you, such as answers on a feedback form or data from their own analytics tags, they are the controller and their privacy policy applies.
  • QuickQRC (Quick Espirt) runs the service. We are the controller for the small scan record described below, which we keep to run the service, prevent abuse and give owners their statistics. For data an owner collects through their page, we act only on their instructions as their service provider.

When a dynamic code is scanned, or a hosted page is opened, we store one record with:

  • Time of the scan or visit.
  • Device type (mobile, tablet or desktop) and operating system family (such as iOS, Android or Windows), worked out from your browser's user-agent string. The string itself is not saved.
  • Country and city, looked up from your IP address in an offline DB-IP database on our own server. The lookup does not contact any other company, and the IP address is not saved.
  • A visitor hash: a one-way code made from your IP address, browser string, the date and a secret value. It lets owners see how many different people scanned on a given day. Because the date is part of it, the same phone gets a different hash every day, so it cannot follow you over time, and it cannot be turned back into your IP address.

Your operating system is also used, at that moment, to send you to the right app store when a code points to an app. Automated scanners and bots are recognised by their browser string and not recorded.

  • Your IP address, full browser string, phone model or advertising ID.
  • Precise or GPS location.
  • The page you came from, your language settings or your contacts.
  • Anything that identifies you by name, unless you type it into a form yourself.

As with any website, our servers also keep standard technical logs of requests, including IP addresses, for a short time to keep the service secure and fix errors. Those logs are not linked to scan statistics or shown to code owners.

  • Feedback pages. If you answer a feedback page, your answers, any comment, and any name, email address or phone number you choose to give are saved and shown to the code owner. Contact fields are optional unless the owner made them required. A visitor hash is kept with each answer to limit repeated submissions from the same device on the same day.
  • Password-protected codes. The password you type is checked and not stored. A scan is recorded only after the right password is entered.
  • Ratings on menu pages. Dish ratings you give are stored in your own browser so you can see them again; they are not sent to us.
  • Files. Contact cards (.vcf), calendar files (.ics) and other downloads are created from what the owner entered. Saving them to your phone does not send us anything.
  • To send you where the code points, including the right app store for your phone.
  • To give the code owner statistics: scans over time, device and OS mix, countries and cities, and unique visitors per day.
  • To keep the service safe: spotting abuse, enforcing plan limits and scan limits, and investigating harmful codes.
  • To understand overall use of QuickQRC in aggregate.

Where the GDPR or similar laws apply, our legal basis is legitimate interest, ours and the code owner's, in delivering and measuring the code and keeping it safe. We have kept the record minimal so it does not override your interests. We do not build profiles of people who scan, sell scan data, or make automated decisions about you.

  • The code owner and members of their team see the statistics in their dashboard and can export them. They see the fields listed in section 4, not your IP address.
  • Our hosting provider stores the data on our behalf.
  • Authorities, only when the law requires it or to protect people from harm or fraud.
  • Scan and visit records are kept for as long as the code or page exists. They are deleted when the owner deletes the code or page, or closes their account. The owner's plan sets how far back their dashboard shows.
  • Feedback answers stay until the owner deletes the feedback page or closes their account.
  • Server logs are kept only as long as needed for security and troubleshooting, then overwritten.
  • QuickQRC does not set tracking cookies when you scan a code. Scans are counted without cookies.
  • Free-plan ad screen. A code made on QuickQRC's free plan may show a short countdown with an advertisement before you continue. The ad network that serves it may set or read its own cookies under its own policy. Codes on paid plans skip this screen.
  • Owner-added tags. A code owner can add their own tracking tag, such as Google Analytics or a Meta Pixel, to their code or page. Those tags send data to the owner's accounts with those companies, under the owner's privacy policy. The owner is responsible for any notice or consent they need.

Full details are in our Cookie Policy.

Depending on where you live, you can ask to access, correct or delete personal data, restrict or object to its use, or receive a copy. A few practical points:

  • Scan records do not contain your name, IP address or anything else that identifies you, so in most cases we cannot tell which record is yours. We will still look into any request and explain what we found.
  • For answers you gave on a feedback page, or data collected by an owner's own tags, contact the code owner first: they control that data. If you cannot reach them, contact us and we will help.
  • Send requests to contact@quickqrc.com. We reply within one month. In the EU, EEA or UK you can also complain to your local data protection authority.

If a QuickQRC code sent you to a scam, phishing page, malware or anything illegal, please tell us through the contact page with the short link (the address that starts with quickqrc.com/r/ or /p/) and what you saw. We can disable a code so that everyone who scans it sees a warning notice instead of the destination. If you are unsure about a code before opening it, our QR security scanner shows where it leads without visiting it.

Anyone can scan a code, but QuickQRC is not aimed at children under 16 and we do not knowingly collect their personal data. If you think a child has given personal data through a page hosted on QuickQRC, contact us and we will work with the code owner to delete it.

We update this page when what we record on a scan changes. The date at the top shows the current version.

Questions: email contact@quickqrc.com or use the contact page.

Contact Us