Privacy policy

The short version

We never store the IP address of anyone who scans a code. Scan statistics are anonymous: a visitor is a hash that changes every day and differs per code, so nobody (including us) can follow a person across days or codes. We don't sell data and we don't show ads.

If you use the RelyQr app or web app

When you sign in with Apple or Google we receive your name and email address. We store the codes, designs, logos, files and pages you create, your plan and subscription status (from the App Store, Google Play or Paddle, through RevenueCat), and, if you allow notifications, a push token for your device. If the app hits an error, it sends us the error message, the app and system version, and your account ID, so we can fix it. When you buy on relyqr.com, Paddle collects your payment details and billing address as the seller of record; we never see your card.

If you visit this website

This website sets no tracking cookies and runs no analytics. If you sign in to the web app, your session is kept in your browser's storage until you sign out.

If you scan a RelyQr code

For the code's owner we record: the time, approximate location (country, region, city, from our network provider Cloudflare), device type, operating system, browser, language, the page that linked you (for shared links) and whether the visit looks automated. Your IP address is used only in memory to create the daily anonymous hash and to stop abuse; it is never written down. Hosted pages set no cookies, except one that remembers a password you entered for a protected code.

Where your data is stored

Your account, codes and scan statistics are stored by Supabase in India (Mumbai). Redirects and hosted pages are served from Cloudflare's network near whoever scans, and some of the providers below process data in the United States and other countries. When data leaves the EU or UK, we rely on the Standard Contractual Clauses in our providers' data processing agreements. Enterprise customers can have their data kept in the EU.

Who processes data for us

Supabase (database, sign-in, file storage), Cloudflare (redirects and hosted pages), Vercel (this website), RevenueCat, Apple and Google (sign-in, payments), Paddle (payments on relyqr.com), Firebase Cloud Messaging (notifications), Resend (emails such as scan reports) and Google Web Risk (checking links for phishing and malware).

How long we keep it

Scan statistics are kept for your plan's history window (Free 90 days, Business 2 years). App error reports are deleted after 30 days. When you delete your account you have 30 days to change your mind; after that your personal data is deleted and your codes show a neutral "no longer active" page.

Your rights

You can export all your data and delete your account from Account in the app at any time. Depending on where you live (for example under GDPR or CCPA) you may also ask us to access, correct or delete your data. RelyQr is not meant for children under 13.

Contact

Questions or requests: support@relyqr.com.