Privacy policy

Effective October 16, 2026

Teknoffice Technologies Inc. runs QRfinity. This policy explains what we collect, why, and what we never collect. The short version: we collect as little as we can, we never store IP addresses, and we don't sell or rent data to anyone.

Making static codes

The generator runs in your browser. Apart from address suggestions (below), what you type, and any logo you add, never leaves your device unless you sign in and save it. We don't log your content.

If you type an address for a location code, the text is sent to Google Maps to suggest places. Google receives what you type, along with the technical details any web request carries (such as your IP address), but not your QRfinity account details. Suggestions start after the third character. To avoid them, enter coordinates instead.

Designs you save without an account stay in your browser's storage. So does your choice of light or dark theme, if you pick one in the header.

QR code scanner and checker

The scanner and the checker read QR codes in your browser. The image, or the camera picture, never leaves your device.

If you press "Check if the link still works", we receive the link from the code, open it from our servers, and send back what happened (for example, that it works, is missing, or says the code was switched off). The website sees a visit from QRfinity, not from you. We don't store or log the link, and we only use it for that check. To limit abuse, we count checks per visitor for an hour, using a keyed hash in place of your IP address; the address itself is never stored.

Your account

When you create an account we store:

• your email address, and your name and profile picture if you sign in with Google;
• a session record so you stay signed in: a random token, when it expires, and your browser's user-agent string. We don't store your IP address.

We use your email only to sign you in and to tell you about your codes, for example if we turn one off. No newsletters or marketing unless you ask for them.

Your codes

For each dynamic code we store its name, short link, destination, design, folder and tags, and a history of destination changes. For a dynamic contact card we store the details you enter; they're shown on the card's page to anyone who scans the code, which is the point of it, so only add what you're happy to share. If you add a logo to a saved design, we store the logo image.

If you protect a code with a password, we store only a one-way, salted hash of it, never the password itself, so nobody (including us) can read it back. When someone types a password to open a protected code, we check it and throw it away: attempts aren't stored. To slow down guessing, Cloudflare counts attempts for a minute per code using a hash of the visitor's IP address, never the address itself.

Scans of dynamic codes

When someone scans a dynamic code, we record:

• the time;
• the approximate location (country, region and city) that our network provider, Cloudflare, works out from the connection;
• the kind of device, operating system and browser, worked out from the browser's user-agent;
• the website that referred the visit, if any (the site's name only, not the full address);
• a visitor hash, used only to count unique scans. It's made from the visitor's IP address, user-agent and the code, mixed with a random value that changes every day and is deleted after 36 hours. Once that value is gone, the hash can't be traced back to anyone or linked across days.

We never store IP addresses, in scan data, sign-in records or logs. Individual scan records are kept for 90 days. After that, all that remains is daily totals per code (for example "12 scans from Canada on mobile on 3 March"), which describe a code, not a person.

We set no cookies on the short domain (qrfinity.link), and people who scan your codes see no tracking or ads from us.

Reports

If you report a QR code, we store what you send. Your email is optional; if you give it, we use it only to follow up, and we never share it with the code's owner.

Paid plans

If you buy a plan, Stripe handles the payment. You give your card details and billing address to Stripe on its own checkout page; we never see or store your card number. We store which plan you're on, its status, when it renews and your Stripe customer number. Your billing address, and a tax ID if you add one, are kept by Stripe to work out tax and issue invoices; we can see them there. We use all this only to bill you and to keep the records tax law requires.

Waitlist for paid plans

If you join the waitlist on the pricing page, we store your email address and when you joined. We use it once, to tell you when paid plans launch.

Links to other sites

Some pages link to other websites, such as a print shop for stickers. Those links carry a tag saying the visit came from QRfinity, but we don't share anything about you with them. Their own privacy policies apply once you're there.

Cookies and site analytics

When you're signed in we set one cookie to keep your session. We never use advertising cookies.

To learn which pages help people, qrfinity.com uses Google Analytics and PostHog. They see the pages you visit, the buttons and links you click, the site that sent you (such as a search engine or an AI assistant), which features you use (such as the type of code, the design options and the download format), whether you're signed in and on which plan, your browser and device type, and roughly where you are (country or city). They never see what you type into the generator, the links or content of your codes, or your email address. We turn off session recordings, advertising features and Google signals, and we've set PostHog to discard IP addresses.

You choose. In the European Union, the European Economic Area, the United Kingdom and Switzerland, we ask first: until you allow analytics cookies, both tools run without cookies or local storage and can't recognise you from one visit to the next. Elsewhere, analytics cookies are on by default so we can count returning visitors. Wherever you are, you can turn them off any time with "Cookie settings" at the bottom of every page, and we treat your browser's Global Privacy Control signal as a no.

To know whether to ask, we check which country your connection comes from. We use only the answer (ask or don't ask); we don't store your country for this.

None of this runs on qrfinity.link: people who scan your dynamic codes are never tracked by these tools.

Service providers

We use these companies to run QRfinity. They process data only on our instructions:

• Vercel: hosts qrfinity.com.
• Cloudflare: runs the short links, scan analytics, and the bot check (Turnstile) on sign-in and report forms.
• Neon: our database.
• Resend: sends sign-in and notification emails.
• Google: if you choose Google sign-in; Google Web Risk, which checks code destinations for phishing and malware (it receives the destination address, nothing about you); address suggestions from Google Maps when you type an address for a location code, described above; and Google Analytics, described above.
• PostHog: site analytics, described above.
• Stripe: takes payments for paid plans, calculates tax and sends receipts. Stripe also acts on its own account for some purposes, such as preventing fraud and meeting its legal duties; see Stripe's privacy policy.

Our database and web servers are in the United States, and Cloudflare runs its network in data centres around the world, so your data may be processed outside Canada. Each provider is bound by a data processing agreement and protects data to standards comparable to Canadian law. Laws in those countries may allow their authorities to access data in some circumstances.

How long we keep data

• Account data: until you delete your account.
• Individual scan records: 90 days.
• Daily scan totals per code: until the code is deleted.
• Abuse reports and our audit log of moderation actions: 2 years.
• Billing records (plans, invoices, payments, billing address and tax ID): 6 years after the end of the tax year they relate to, as Canadian tax law requires, even if you delete your account.
• Waitlist for paid plans: until they launch and we've sent the one email we promised, or until you ask us to remove you.

When you delete your account we end any paid plan, remove your email and sign-in records and delete your codes. We keep a record that each short link existed, without your details, so it's never given to someone else.

Your rights

You can see and download all your codes and their history at any time (Account → Export your data), correct them in your dashboard, and delete your account. You can also ask us for a copy of what we hold about you, or to correct or delete it, by writing to legal@qrfinity.com. We reply within 30 days. We follow Canada's privacy law (PIPEDA) and, for people in the EU and UK, the GDPR. If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in the EU and UK, to your local data protection authority.

Our privacy officer is responsible for this policy and can be reached at legal@qrfinity.com.

Children

QRfinity isn't for children under 13, and we don't knowingly collect their data.

Changes

If we change this policy we'll update the date above, and email account holders about important changes before they take effect.

Contact

legal@qrfinity.com · Teknoffice Technologies Inc., Ontario, Canada

Questions? Email legal@qrfinity.com. Teknoffice Technologies Inc., Ontario, Canada.