What we collect, and what we don't.

Who we are

KeptQR is operated by Data Boy Design, LLC, a Georgia (USA) company. For anything in this policy, contact [email protected].

The free generator collects nothing

Codes made with the on-site generator are created entirely in your browser. The content you encode — URLs, Wi-Fi passwords, contact details, text — is never sent to our servers. We could not read it if we wanted to, and we have designed things so we don't want to.

What we collect from visitors

We run self-hosted, cookieless, anonymous site analytics (Umami): pages viewed, referrer, and browser/device class. No advertising trackers, no fingerprinting for ad purposes, and no data sold or shared with data brokers — ever.

What we collect when you sign up

The beta form asks for your email and whatever you choose to tell us about your use case. We use it to contact you about KeptQR and nothing else. Marketing email requires your explicit opt-in, and you can unsubscribe anytime.

What we collect when codes are scanned

This applies when the dynamic-code service launches. When someone scans a dynamic code we process the request data needed to redirect them. For codes with active analytics we store: time, country/city and region (estimated from IP), approximate city-level coordinates (radius-bounded, never a precise location), device OS/type, and an anonymized identifier (a salted, rotating hash of IP + browser signature) used only to count unique scans. We do not store raw IP addresses of scanners.We momentarily evaluate each scan IP's network origin (datacenter vs human-browsing) to filter automated and security-scanner traffic from scan counts; the raw IP is never stored.

For all codes — including canceled accounts' — we keep aggregate scan counts for abuse prevention and service operation; counts contain no personal data.

Your data rights

Ask and we'll show you what we hold about you, correct it, or delete it. Account deletion removes your data within 30 days; aggregate, non-personal counters may be retained.

Processors we use

• Supabase — database hosting
• Resend — transactional email
• Stripe — payments (when paid plans launch)
• Cloudflare — network and DNS

Each receives only what its function requires.

Changes

Changes to this policy are posted here with the date above. If a change meaningfully reduces your privacy, we'll say so plainly rather than hoping you don't notice. See also: the Code Lifetime Promise.