CraftyQR

Privacy Policy

Last updated: July 22, 2026

This Privacy Policy explains how Crafty QR ("we", "us", "our") collects, uses, and protects your information when you use our website and QR code services. We act as the data controller for most of the personal data described below. One exception is information that visitors submit through a landing page form built by one of our users: for that data, our user is the controller and we act as a processor on their behalf, as explained under "Landing page form submissions" below. By using Crafty QR, you agree to the practices described here.

Information we collect

Account information

We use Firebase Authentication to manage sign-in. When you create an account with email and password we collect your email address. If you sign in with Google (OAuth), we also receive your name and profile photo from Google. We do not store your password; it is handled by Firebase Authentication.

Profile information

If you build a hosted link page or landing page, we store the profile details you add to it, such as a display name, bio, links, and any avatar or images you upload for that page.

Billing information

Subscription payments are processed by LemonSqueezy, which acts as the merchant of record for your purchase. Your payment and card details are handled entirely on LemonSqueezy's systems, and we do not collect or store your full card details. We retain only limited billing references, such as a customer ID and subscription ID, that we need to manage your plan.

QR code content and labels

We store the content you put into your QR codes, such as URLs, text, contact details, WiFi credentials, or payment strings, along with the labels you give them and the styling you choose.

Uploaded files

We store files you upload using Firebase Storage. This can include logo images for your QR codes, PDF documents, images and avatars for your link pages and landing pages, and image attachments you add to support tickets. You are responsible for having the right to use any file you upload.

Scan analytics

For dynamic QR codes, each scan passes through a short link we host, which lets us record limited analytics about the scan:

Scan analytics are collected only for dynamic QR codes. Static QR codes encode their content directly and are not tracked.

Landing page form submissions (data collected for our users)

Pro+ users can add a form to a hosted landing page to collect responses from visitors. The page owner chooses which fields to include, so a form may ask for details such as a name, email address, phone number, or a message. When a visitor submits such a form, we store the information they entered, together with a SHA-256 hash of their IP address (used only to prevent spam and abuse — we never store the raw IP) and a timestamp, so that the page owner can view and respond to the submission.

For these form submissions, the Crafty QR user who created the page decides what is collected and why, and is therefore the data controller for that data; we process it on their behalf. If you submitted a form on a page hosted by Crafty QR and want to access, correct, or delete your information, please contact the owner of that page. These submissions are protected by Cloudflare Turnstile, are never used by us for advertising, and are never sold. The page owner can view, delete individual responses, or delete all responses at any time, and the data is retained on the plan-based schedule described under "Data retention".

Support tickets

When you open a support ticket, we store the subject, the messages exchanged, any image attachments, and the ticket status, so that we can help you and keep a record of the conversation.

Contact form

When you message us through our contact form, your message and the email address you provide are delivered to us by email using Resend. We do not store contact form submissions in our database.

Bot protection

To reduce spam and abuse, our sign-up, contact, and landing page forms are protected by Cloudflare Turnstile, which may process limited technical data to verify that you are not a bot.

Cookies and authentication tokens

We use essential and functional cookies together with authentication tokens stored in your browser to keep you signed in and to operate the site securely. These are necessary for the service to function. If you reach Crafty QR by clicking one of our ads, we also store the anonymous click identifier Google adds to that link in a first-party cookie for up to 90 days, so we can measure which advertising leads to sign-ups and subscriptions. Aside from the Google Ads conversion tracking described under "Advertising and conversion tracking" below, we do not use non-essential tracking cookies, and we do not sell your data.

Advertising and conversion tracking

We advertise Crafty QR through Google Ads and use Google Ads conversion tracking, including a feature called Enhanced Conversions, to measure how effective our ads are. When you create a new account, a securely hashed (SHA-256) version of your email address is generated in your browser and sent to Google so it can match your sign-up to an ad you may have seen. The hashing happens in your browser before anything is sent; we do not send Google your plain email address for this purpose. This runs only when a new account is created — not when you sign in to an existing account — and Google may set cookies or use similar technologies to carry it out.

When you purchase a paid subscription, we also send a record of that purchase to Google Ads directly from our servers. That record contains the purchase amount and currency, the date and time, an order reference, a securely hashed (SHA-256) version of your email address, and — if you reached us by clicking one of our ads — the anonymous click identifier described above. We never send Google your plain email address, your name, or any payment card details, and we never receive or share your card details ourselves. This is sent only for a first subscription purchase; it is not sent for renewals.

We use this only to measure conversions from our advertising; we do not sell your personal information. You can control how Google uses data for advertising in your Google Ads Settings (adssettings.google.com), and Google's handling of this data is governed by its own privacy policy at policies.google.com/privacy.

How we use your information

Legal bases for processing

Where data protection law such as the Turkish Personal Data Protection Law (KVKK) or the GDPR applies, we rely on the following legal bases: performance of our contract with you to provide the service; our legitimate interests in securing, operating, and improving the service, including scan analytics for your own QR codes; your consent where we ask for it; and compliance with legal obligations.

Third-party services

We rely on trusted providers to operate Crafty QR. Each processes data on our behalf or as an independent controller under its own privacy terms:

Data retention

We keep your account data and saved QR codes for as long as your account is active. Scan analytics are retained based on your plan:

Responses submitted through a landing page form are retained on the same plan-based schedule as scan analytics, based on the page owner's plan, and are automatically deleted once they pass that window. The page owner can also delete individual responses or all responses at any time.

Older analytics data is automatically deleted once it passes your plan's retention window. Contact form messages are not stored in our database. You can delete your QR codes at any time — deleting a QR code also deletes any form responses collected on it — and you can delete your account as described below.

Your rights

You may request access to, correction of, or deletion of your personal information, and depending on where you live you may also have rights to portability, restriction, and objection. You can delete your account at any time from your account settings. Deleting your account permanently removes your account and all data tied to it — your QR codes (your dynamic QR codes stop redirecting), scan analytics, form responses collected on your landing pages, saved templates and batches, support messages, and uploaded files — and cancels any active paid subscription. This cannot be undone. You can also email us to make a request. If you are in the European Economic Area, the United Kingdom, or Turkey, you also have the right to lodge a complaint with your local data protection supervisory authority.

United States privacy rights

Crafty QR is available to users in the United States. If you are a resident of California or another US state with a consumer privacy law, you may have the right to know what personal information we collect, to access, correct, or delete it, and to opt out of the sale or sharing of personal information. We do not sell or share your personal information as those terms are defined under US state privacy laws, and we do not use it for cross context behavioral advertising. We will not discriminate against you for exercising these rights. To make a request, contact us at support@craftyqr.com.

International data transfers

Crafty QR is available internationally, including in the United States, and your information may be processed in countries other than your own. Several of our third-party providers listed above are based in the United States, so your information may be transferred to and processed there and in other countries. Where such transfers happen, we rely on appropriate safeguards required by applicable law.

Security

We take reasonable technical and organizational measures to protect your information, including hashing scanner IP addresses and restricting access to personal data. No method of transmission or storage is completely secure, however, so we cannot guarantee absolute security.

Children's privacy

Crafty QR is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above.

Contact

Questions about this policy, or requests about your data, can be sent to support@craftyqr.com.