Privacy Policy

• Account data: email address, and (if you sign in with Google) your Google display name and avatar.
• Bundle content: files, notes, links, contact cards, and cover images that you upload.
• Usage analytics: anonymised scan counts, download counts, coarse device type (mobile/desktop/tablet), and timestamps.
• Technical logs: IP address, user-agent, and error diagnostics kept for a short period for security and debugging.

• We do not sell or rent personal data to third parties.
• We do not run advertising trackers on the app.
• We do not read the contents of your private bundles for training. AI features run on your bundle only when you invoke them.

Files are stored in encrypted object storage. Access is enforced by row-level security policies and, where you enable it, per-bundle password protection (hashed server-side with bcrypt). Signed URLs are short-lived and, for password-protected bundles, only issued after server-side password verification.

We use trusted infrastructure providers (managed database, storage, and AI inference) strictly to run the service. They act as processors on our behalf and never receive your content for their own purposes.

You can access, export, or permanently delete your data at any time from your vault, or by writing to the address on our contact page. Deletion is honoured within 30 days.

QRVault is not directed to children under 13, and we do not knowingly collect data from them.

We update this page when the service changes materially. The date above always reflects the most recent revision.