Privacy Policy

Overview

Qordway is a QR code generator with a free anonymous tool and optional paid plans (Advanced and Business) that add saved codes, dynamic QR codes, and other features. The Basic plan is free and ad-supported; paid plans are not. This policy explains what information is used across all of that, and how it's handled.

Using the QR generator without an account

The link you enter and the style choices you make (colors, dot shape, corner shape, size) are used only inside your own browser to draw the QR code image. None of it is sent to, processed by, or stored on our servers unless you're logged in and choose to save it (see below) — there is no backend involved in anonymous code generation, and nothing is logged.

The downloaded PNG/JPG/GIF/SVG/PDF/EPS is created entirely on your device. If you don't create an account, we have no record of what codes you generated, what links they pointed to, or who generated them.

Accounts

Creating an account requires an email address and password, handled by Amazon Cognito (AWS's identity service) — we never see or store your password ourselves. You can optionally add a display name. We also store your membership tier, subscription status, and account status (active/banned/deleted) in our database.

Your login session (access, ID, and refresh tokens) is stored in your browser's localStorage so you stay logged in between visits. This is required for the accounts feature to work at all — it isn't used for tracking or shared with any third party.

Saved QR code library (all accounts, including the free Basic plan)

If you save a QR code to your library, the destination link, a name you give it, and your style choices (colors, shapes) are stored in our database so you can come back and re-download or re-edit it later. Every account tier can use this (with a per-tier limit on how many codes you can save at once). This is only visible to you and to site administrators (for support purposes).

Dynamic QR codes and scan analytics (all signed-in plans)

A dynamic QR code's destination link can be changed after it's printed, and each scan is logged so you can see how it's performing. We deliberately collect the minimum needed for that: for each scan, we record the timestamp, an approximate location (country/region/city, derived from network-level geolocation — not GPS, not precise), a general device/OS/browser classification (parsed from the browser's user-agent string), and a truncated copy of the raw user-agent string. We do not store the visitor's IP address — instead, we store a one-way salted hash of it that rotates daily, just enough to count "unique scans" per day without retaining anything that identifies a real visitor long-term.

Raw scan records are automatically deleted after about 13 months. A history of destination-link changes (old link, new link, when, by whom) is kept for as long as the code exists, so you have an audit trail of your own edits. None of this scan data is shared with, or visible to, anyone other than the code's owner.

Deleting your account

You can permanently delete your account at any time from My Profile (or an admin can do this on your behalf, if requested). Doing so deletes your profile, saved QR code library, dynamic QR codes, and their scan history — all of it is gone for good and cannot be recovered.

The one exception: we retain your email address in a minimal internal record after deletion, for fraud prevention and so we can honor future opt-outs or re-contact you about the service if appropriate. No other profile information, content, or activity history is kept. If you'd like this record removed entirely as well, contact us and we'll handle it directly.

Contact form

If you use the contact form, the name, email address, and message you provide are sent directly to us as an email (via Amazon SES) so we can reply. This isn't stored in a database — it only exists as that email.

Analytics and cookies

This site uses Google Analytics (GA4) to understand how visitors use the site — for example, which pages are viewed and how visitors arrived here. Google Analytics is only active if you click "Accept" on the cookie banner shown on your first visit; if you click "Reject," or take no action, analytics cookies are not set and no analytics data is collected about you.

You can change your choice at any time using the Cookie Preferences link in the footer of any page, which re-opens the banner. Data collected by Google Analytics (when consented to) is processed in accordance with Google's Privacy Policy.

Advertising

Not enabled yet. No advertising runs on this site today. This section describes how it will work when we switch it on, so you can see the arrangement before it affects you rather than after. We'll update the date at the top of this page when that changes.

The free Basic plan is supported by advertising. Paid plans show no ads at all — that's a meaningful part of what you're paying for, and we'd rather say so plainly than bury it.

Ads will be served by Google AdSense. Google and other third-party vendors use cookies and similar technologies to serve ads based on your prior visits to this and other websites, and to measure whether those ads worked. We don't receive or store the browsing history those cookies are based on.

What advertisers never get from us: your email address, your account details, your saved QR codes, or the contents of any code you generate. The QR generator runs entirely in your browser and that data never reaches our servers in the first place (see the top of this policy), so there is nothing there for us to pass on even if we wanted to.

Personalised advertising is gated on your consent the same way analytics already is. If you decline, you may still see ads, but they won't be personalised using advertising cookies. You can change your choice at any time using the Cookie Preferences link in the footer of any page.

You can also opt out of personalised advertising independently of this site:

• Google Ads Settings — controls personalisation across Google's own advertising
• aboutads.info (US) and Your Online Choices (EU/UK) — industry-wide opt-outs covering many vendors at once

Cookies, localStorage, and session storage

Qordway uses browser localStorage in two ways: (1) to remember your Google Analytics consent choice, and (2) if you have an account, to keep you logged in. Neither is a third-party tracking cookie, and neither is shared outside this site. Aside from Google Analytics (consent-gated, described above), we don't currently run any other tracking or advertising scripts — see Advertising above for what changes when the ad-supported Basic plan goes live, and what it will and won't involve.

Third-party services

We use a small set of infrastructure providers to run this site and the accounts/QR features. None of them use your data for their own purposes beyond providing the service to us:

Amazon Web Services (AWS) — our infrastructure provider for everything: Cognito (accounts/login), DynamoDB (saved codes, dynamic QR codes, scan analytics), CloudFront (content delivery, which may retain standard access logs like IP address, timestamp, and requested resource), Lambda and API Gateway (the backend APIs), and SES (sending account-verification emails, password-reset emails, and contact-form messages). See Amazon's Privacy Policy.

Google AdSense — will serve the advertising on the free Basic plan once enabled, and sets advertising cookies subject to your consent. Not active yet; see Advertising above. See how Google uses information from sites that use its services.

Google Fonts — this site loads the Sora and Inter typefaces from Google Fonts. Google may log the request in accordance with their privacy policy.

Google Analytics — see "Analytics and cookies" above.

Where your data is stored

Account, saved-code, and dynamic-QR data is stored on AWS infrastructure in the US East (Ohio) region.

Your rights and choices

You can view and update your name and password from My Profile, view and delete individual saved or dynamic QR codes from your library, opt in or out of analytics at any time via the Cookie Preferences link, and permanently delete your entire account (see "Deleting your account" above). If you have any other request about your data — including removing the email record kept after account deletion — contact us and we'll handle it directly.

Children's privacy

This site does not knowingly collect personal information from children under 13, and account creation is not directed at children.

Changes to this policy

If how we handle data changes meaningfully, we'll update this page and the "Last updated" date above.

Contact

If you have questions about this privacy policy, please send us a message.