Privacy Policy

1. Controller

The controller of the QRbit service is the operator of the qrbit.cc domain.

Privacy contact: [email protected].

The service is available at https://qrbit.cc.

2. Data we process

Account data: name, email address, password hash (if you use password login), Google account id (if you sign in with Google), role and profile settings.

Content you create or upload: QR codes, destination URLs, text, files (images, PDF, video, etc.), styles and campaign settings.

Scan analytics: scan time, salted SHA-256 hash of the IP address (raw IP is not stored), approximate geolocation from IP (country, region, city, coordinates), device type, OS, browser, language and referrer.

Technical data: session cookie, guest identifier, UI language and theme (localStorage), and server logs as needed for security.

3. Purposes and legal bases

We process data to: provide QR creation and analytics; authenticate users and protect accounts; send verification and password-reset codes; show scan statistics to QR owners; provide support; and prevent spam/abuse (including Google reCAPTCHA).

Legal bases (where GDPR or similar rules apply): contract performance, legitimate interests (security, product improvement, aggregated analytics), consent where required, and legal obligations.

4. Cookies and local storage

HttpOnly session cookie (qrt_session) for signed-in access.

Session/guest flags so guest QR codes and auth state can persist.

Language (qrt_lang) and theme (qrt_theme in localStorage) for UI preferences.

Google reCAPTCHA and Google Sign-In may set their own cookies under Google’s policies.

5. Recipients / processors

Google — Google Identity Services sign-in and reCAPTCHA.

IP geolocation providers (e.g. ip-api.co / ipwho) — approximate scan location only; we do not permanently store raw IP as a field.

Resend (or another mail provider) — delivery of verification and reset emails.

Hosting/VPS — application and database hosting.

We do not sell personal data.

6. Retention

Account and QR data are kept while the account is active, or until you delete them / request deletion.

Scan records are kept for analytics until the related QR or account is deleted, or as needed for security and service operation.

Verification and reset codes expire within minutes/hours.

Security logs may be kept for a limited period.

7. Your rights

Depending on applicable law, you may request: access; correction; deletion of your account and related data; restriction or objection; data export (where available in settings); and withdrawal of consent where processing is consent-based.

Contact [email protected] or use in-app Support. Account deletion is also available in Settings for password-based accounts.

8. Security

We use technical and organisational measures including HTTPS, HttpOnly session cookies, password hashing, IP hashing before storage, rate limiting and form protection.

No internet transmission is perfectly secure; use a strong password and do not share account access.

9. International transfers

Some processors (Google, email provider, geo APIs) may be located outside your country, including the US/EEA. Transfers rely on the providers’ contractual safeguards and applicable law.

10. Children

The service is not directed to children under 16 (or the digital-consent age in your jurisdiction) without a parent/guardian. If you believe we collected a child’s data, contact us and we will delete it.

11. Changes

We may update this Policy. The current version is always at https://qrbit.cc/privacy. Material changes may also be noted on the site or communicated to users.