Privacy Policy
Last updated: October 2026
What we collect
Your account email (from Google sign-in), the codes you create and their destinations or digital business card (vCard) fields, uploaded logos and Studio source artwork, editable Studio project layers and control settings, and the code images we generate for you. When someone scans your code we record a scan count plus a coarse record — the time, device type, browser and OS family, and a salted hash of the IP address — for your analytics and abuse prevention. That scan record never holds the raw IP, and we do not build profiles of the people who scan your codes. Like any website, our hosting provider's request logs record the IP address, browser and page requested for every request, including scans; those logs are kept for 30 days for security and debugging.
How we use it
To generate, save, reopen, and host your codes, run advisory software decode and safety checks on generated artwork, show you scan counts, enforce plan quotas, screen destinations for malicious sites, and process payments. We don't sell your data.
Processors we rely on
Google Cloud (hosting, Firestore database, and Cloud Storage), Stripe (payments — we never see your full card number), and Google (sign-in). Google Cloud's Vertex AI (Gemini models) automatically reviews the text prompts you submit for AI generation, finished code images (including your artwork), and uploaded logos together with the code's destination website, to catch prohibited content and brand impersonation; under Google Cloud's terms, Google does not use this content to train its models. Google Web Risk checks the destinations and business-card websites you enter against its list of suspected malicious sites. When you save in the Studio, your editable project document (including your uploaded source image, layers, and controls) and temporary generation checkpoints are stored in private Google Cloud Storage and Firestore so you can reopen and keep editing your code in your account. Finished code PNGs and separately uploaded logos are stored in Google Cloud Storage and served from public URLs; anyone with one of those URLs can access that file. Hosted digital business card (vCard) pages load the Inter font from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), so a visitor's browser makes a standard font request to Google when opening a vCard link.
Retention and deletion
We keep your codes, saved Studio projects, and account data while your account is active. You can request account deletion from the Billing page. The deletion process cancels any active subscription immediately — the remaining paid period is not refunded — before removing account data; if billing cancellation cannot be confirmed, deletion stops so you can retry. It disables your short codes so they stop resolving and removes saved Studio project files and metadata, generation checkpoints, generation history, usage and job records, and your account record. It also attempts to delete uploaded logos and generated code PNGs, but file cleanup can fail. Disabled short-code records remain stored, including their destinations, vCard fields, and associated scan and abuse-report records; those codes are not reassigned. We also keep a record of your email address and when the deletion started and finished, so a late payment or billing event can't recreate the account or charge you again. That record is deleted automatically about 90 days later. Copies of deleted data, including that record, can remain in our database backups and in our storage provider's deleted-file recovery for up to 7 more days before they are erased. Our service logs, which can include your email address and the prompts you submit, are kept for up to 30 days. Our payment processor, Stripe, keeps its own record of your payments and billing details under its own retention rules. For a copy of your data, or if a public file remains available after deletion, contact support@qrix.cc.
Messages you send us
When you write to us through the contact form, we keep your name, email address, the optional link you give us, and your message so we can reply, plus a hashed form of your network (IP) address that we use only to limit spam. The message never holds the raw IP address. Messages are deleted automatically about 12 months after you send them, and the spam counters within two days. The notice we receive when a message arrives contains no name, email address, link, or message text.
Contact
Privacy questions or requests: support@qrix.cc.
This describes our actual data practices in plain language and is not a substitute for legal advice.