Privacy and data processing

When someone scans a dynamic QR code

A dynamic code opens a short link like qrth.is/r/abc1234, which redirects to the destination its owner set. For each scan we record exactly three things:

• which code was scanned
• the date and time
• the country, which our hosting provider derives from the IP address at the network edge

We don't store the IP address, browser or device details (user agent), the referring page, or any identifier. The redirect sets no cookies, runs no scripts, and uses no fingerprinting, so individual visitors can't be recognized or followed across scans. Code owners see totals per day and per country, nothing per person.

Like any web service, our hosting provider (Vercel) processes the IP address in transit to deliver the request and may keep it briefly in its infrastructure logs under its own retention terms. We don't use those logs for analytics.

Codes created by an AI assistant without an account show a short notice naming QRThis and the destination before redirecting, until someone claims the code. That notice also sets no cookies and runs no tracking.

Using qrth.is itself

Static QR generator and public API. We count how many codes are generated and which website domains they point to (the domain only, never the full link). Nothing about the person generating the code is stored.

Site analytics. We use Vercel Web Analytics on our own pages (not on the scan redirect). It sets no cookies and reports aggregate page views; Vercel discards its visitor session data after 24 hours. To see which kind of site sent a visitor (for example a search engine or an AI assistant), we keep a short label in your browser's session storage for the visit only.

AI assistants (MCP). To limit abuse, creating codes without an API key is capped per network per day. We keep a daily counter keyed by a one-way, secret-keyed hash of the IP address; the IP itself is not stored.

Account holders

• Account: your email address and, if you sign in with Google, your name. A single sign-in cookie keeps you logged in; it is strictly necessary and not used for tracking.
• Your codes: their names, destinations and scan counts as described above.
• Payments: handled by Stripe. We never see or store card numbers. Stripe gives us your name, billing address, email and, if you add one, your business tax ID, which we use to issue invoices.
• Email: sign-in codes and occasional account emails are sent through Twilio SendGrid.

Where data is stored

QRThis runs in the United States. The providers that process data for us:

Scan records contain no personal data about visitors: just a code, a time and a country. The personal data stored in the U.S. is account and billing data, under the safeguards above.

How long we keep it

• Scan counts: for as long as the code exists, so its statistics stay available. Deleting your account deletes your codes and their scan records.
• Account data: while your account is active. Email us to delete it and we'll do so within 30 days.
• Billing records: kept by Stripe and us for as long as tax and accounting law requires.

For business customers

If you use QRThis for client campaigns, the scan statistics you get are aggregate counts that don't identify visitors, and the redirect stores nothing on the visitor's device. Your destination page is separate and follows its own rules. If your organization needs a data processing agreement, email us.

Contact and your rights

You can ask us what data we hold about you, and have it corrected, exported or deleted. Write to hello@qrth.is.

QRThis, operated by LE 589X LLC, 1401 21st St Ste R, Sacramento, CA 95811, USA