Privacy Policy

Version 1.0. Effective date: 20 October 2026.

1. Who we are

QR Code Maker is run by MaxPower Studio (ABN 31 362 180 362), based in Australia. We are responsible for your personal data (the "controller" under the GDPR). The site is qrcodemaker.maxpower.studio and editable codes use short links on qrmaker.link. For any privacy question, request or complaint, email [email protected]. We aim to follow the Australian Privacy Principles, the EU and UK GDPR and other privacy laws that apply.

2. What stays on your device

What you type or upload in the code maker is saved by your browser in its local storage on your device, so you can come back to it: your codes and their names, styles, logos and display settings. QR codes, images, PDF and EPS files, ZIP files and the scan test are all made on your device.

• We can't see, access or recover this data. It isn't sent to us or synced anywhere. Logos always stay on your device, even for editable codes. Editable codes themselves are kept on our servers (section 3).
• It stays until you delete codes yourself, click Clear my data, or clear this site's data in your browser settings.
• Anyone who uses the same browser profile on your device can see it. On a shared computer, click Clear my data when you're done.

We also keep one small technical note in your browser's session storage to avoid reloading the page twice after an update. It contains no personal data and disappears when you close the tab. If you sign in, we also keep a "signed in" note in local storage (just the number 1, no email or other personal data) so the profile icon shows straight away. It's removed when you sign out.

3. If you sign in (editable codes and Pro)

We store:

• Your email address, to sign you in and to email you about your account (sign-in links, a code you deleted that was still being scanned, Pro ending, a code we blocked, an unused account about to be deleted, important changes to our terms). We don't send marketing emails.
• If you sign in with Google (when it's offered): Google tells us your email address, that it is verified, and an account id. We store the email and that id to sign you in. We ask only for your email and basic profile. We don't store your name. If your Google account has a profile photo, we store the link to it and show it as your profile icon in the app. Your browser loads the photo through our server, so Google doesn't see when you use the app. You can remove the photo in your Google account and it's cleared the next time you sign in with Google. Google's use of your data is covered by the Google Privacy Policy.
• Your editable codes: each code's name, links, schedule, pause message and style (colours and shapes, not your logo).
• Daily scan totals for each code: the number of scans per day, split by device type (iPhone, Android, computer, other) and by country. See section 4.
• Pro purchases: the Stripe payment and customer ids, the amount, the date, and a card fingerprint from Stripe (a code that tells whether two payments used the same card, without the card number). We use this to run refunds and to apply the one-refund-per-person rule.
• Security records: sign-in links and codes are stored only as one-way hashes and expire after 15 minutes. To limit abuse, we count sign-in attempts and new accounts per email address and per network, using a keyed one-way hash of the IP address that we can't turn back into the address. A log of account actions (such as "code edited") helps us fix problems and handle disputes.

Cookie. When you sign in, we set one cookie, __Host-qcm_s, to keep you signed in for up to 90 days. It's needed for the account to work, so we don't ask for consent. It isn't used for tracking or ads. Signing out deletes it.

4. People who scan a code

Static codes: the phone reads the content directly. We aren't involved and can't count scans.

Editable codes: the scan goes through our short link (qrmaker.link), which sends the person on to the code's link. To do this, Cloudflare processes the request (see section 6). We add 1 to that day's total for the code, by device type and country, worked out from the request at that moment. We don't store the IP address, the full user agent, a cookie or any identifier, so the totals can't be linked to a person. Link previews from chat apps are counted apart.

Reports: anyone can report a code from its preview page. We store the reason, the details you give, an optional contact email, and a keyed one-way hash of your IP address and the day (to stop the same person reporting many times). The contact email and the hash are deleted after 90 days. The report itself (code, reason, details) and our decision are kept for 2 years, so we can handle appeals and repeat abuse.

5. Safety checks on links

When you save an editable code, and regularly after that, we check each of its links (the main link, schedule links and iPhone and Android links) so codes can't be used for phishing or malware:

• Our own rules and block list, on our servers.
• PhishTank (run by Cisco Talos): we download its public list of phishing sites a few times a day at most and check links against our own copy. Nothing about you or your links is sent to PhishTank.
• Google Web Risk, when that check is turned on: we send the link (the destination URL) to Google to look it up. Google receives the URL from our server, not your email or account. A link can contain personal data if you put it there (for example a name in the address), so avoid that.
• abuse.ch URLhaus (Switzerland), when that check is turned on: we download its list of malware sites, and may send a link to abuse.ch to look it up.

These checks run automatically. If one flags a link, the code may show a warning page or pause, and we email you. You can reply to that email to have a person review it. Warnings based on Google data say so ("Advisory provided by Google").

6. Services we use

These providers process personal data for us, or alongside us, to run the tool:

• Cloudflare hosts the site, the short links, our database (D1) and storage (KV), and runs Turnstile, a check that tells people from bots on the sign-in and report forms. Turnstile processes data such as your IP address and browser signals and doesn't use cookies for tracking. See the Cloudflare Privacy Policy and Turnstile privacy addendum.
• Resend sends our emails (sign-in links and account notices), so it receives your email address and the message. See the Resend Privacy Policy.
• Stripe takes Pro payments through its Managed Payments service (shown as Link), which acts as the seller of record and handles tax and receipts. You enter your card and billing address on Stripe's page, and we never see the card number. Stripe shares the payment result with us. See the Stripe Privacy Policy.
• Google: sign-in with Google (section 3), if you choose it, and Google Web Risk link checks when that check is turned on (section 5). See the Google Privacy Policy.
• abuse.ch: URLhaus link checks, only when that check is turned on (section 5).
• PhishTank (Cisco Talos): we only download its public list; no data is sent.

7. What our hosting provider processes

When you load a page or someone scans an editable code, Cloudflare processes standard technical data: the IP address, browser and device type (user agent), the page requested, the referring page, the date and time, and an approximate location derived from the IP address. This is needed to deliver the site and protect it from attacks and abuse. Cloudflare keeps logs under its own retention rules.

8. Cookies, analytics and tracking

Apart from the sign-in cookie in section 3, we don't set cookies, show ads, or use tracking or fingerprinting. If we turn on Cloudflare Web Analytics to count visits, it uses no cookies and doesn't store your IP address.

9. How long we keep it

• Your account, codes and scan totals: while your account is open. Scan totals older than 2 years are deleted.
• Unused accounts: if a free account has no codes and hasn't been signed in to for 2 years, we email you, and delete it 30 days later unless you sign in.
• Codes in the Trash: 30 days, then the links and style are deleted. We keep the short link's id, marked as removed, so it's never given to anyone else.
• Sign-in links and codes: deleted a day after they expire. Sessions: deleted when they expire or you sign out. Abuse counters: deleted within a day. "Use your own domain" waitlist (the date you joined and your optional note): until you leave the waitlist or delete your account. Link change counts for the fair use limit (the time of each change with a one-way keyed hash of your email, so deleting and re-making an account doesn't reset it): deleted after 2 days. If you delete or close your account, we keep only that hash and the number of editable codes you had, so a new account with the same email can't get fresh free codes straight away: deleted after 30 days.
• Reports about a code: the contact email and network hash after 90 days; the rest of the report and our decision after 2 years.
• Account action log: 2 years.
• Pro purchase and refund records: 7 years, because tax law requires it. When you delete your account, we keep these with your email stored only as a one-way hash, together with the card fingerprint, so we can still apply the one-refund-per-person rule.
• Support emails: up to 2 years.

10. If you email us

If you contact support, we receive your email address and whatever you include in your message, and use them only to reply and help you.

11. Legal bases (EU and UK)

• Contract: your account, editable codes, sign-in emails and Pro, to provide the service you signed up for.
• Legal obligation: payment and refund records we must keep for tax.
• Legitimate interests in running a secure, working service and preventing abuse: security records, abuse counters, link safety checks, reports, scan totals, Cloudflare's technical data, and keeping the hashed email and card fingerprint after an account is deleted to apply the one-refund-per-person rule. Also answering support emails.

You can object to processing based on legitimate interests (section 13).

12. Sending data overseas

We're in Australia, and our providers process data in other countries: Cloudflare (worldwide, including the United States), Resend (United States), Stripe (United States and Ireland, among others), Google (worldwide, including the United States) and, when that check is turned on, abuse.ch (Switzerland). Where the EU or UK GDPR applies, these transfers rely on an adequacy decision (for example for Switzerland, or the EU-US Data Privacy Framework where the provider is certified) or on the EU Standard Contractual Clauses and the UK addendum. We choose providers that protect data to a standard comparable to the Australian Privacy Principles.

13. Your rights and complaints

Depending on where you live, you may have the right to access, correct or delete personal data, to object to or restrict processing, and to data portability. On the account page you can export your account data as a file, and delete your account (or close it and freeze your codes). For data on your device, use Export backup and Clear my data. For anything else, email us. We reply within 30 days, and may ask you to confirm the request from the email address on your account.

Complaints. If you're unhappy with how we handle your data, email us first and we'll look into it and reply in writing within 30 days. If you're not satisfied, you can complain to a regulator, such as the Office of the Australian Information Commissioner (oaic.gov.au), the UK ICO or your local EU data protection authority.

14. Children

The tool is for people aged 16 and over.

15. Security and data breaches

The site is served only over HTTPS with strict security headers. Sign-in tokens are stored as hashes, the sign-in cookie can't be read by scripts, and staff access to admin tools needs a separate sign-in. The site loads no third-party code apart from Cloudflare Turnstile on the sign-in and report pages, and Cloudflare's cookieless analytics script (if enabled). If a data breach is likely to cause you serious harm, we'll tell you and the regulator as the law requires (for example under Australia's Notifiable Data Breaches scheme, or within 72 hours under the GDPR).

16. Changes

If we change this policy, we'll update the version and effective date at the top and add a line to the change log below. If you have an account, we'll email you about important changes before they apply.

17. Change log

• Version 1.0 (effective 20 October 2026): first published version.