Privacy Policy

QRFLOW.codes is operated by Native Code LLC, a limited liability company registered in the State of Nevada, United States, working out of Las Vegas, Nevada. In this policy, "we", "us" and "our" mean Native Code LLC.

This policy covers the website at qrflow.codes and everything served from it, the redirect service behind dynamic codes (qrflow.codes/q/ and customer link domains), the generator embedded on other sites, and email you exchange with us.

We are the controller of account holders' information. When you create an account, subscribe, or write to us, we decide what is collected and why, and you exercise your rights directly with us.

We are a processor of scan records. When someone scans a dynamic code, the record we create belongs to the code's owner. They decide what the code points at and what to do with the analytics; we act on their instructions. If you scanned a code and want to know what was recorded, the business that printed it is the controller. Contact them first; if you contact us we will tell you who the owner is where we can, and forward your request.

Information you give us

• Generating without an account: nothing. The QR image is rendered in your browser and downloaded from it. We do not receive the content you encode.
• Creating an account: an email address and a password (stored hashed), or a sign-in through Google, which gives us an identifier and, depending on your Google settings, your email address and name.
• Saving codes: the destination, type, label, colors, frame text and any logo you upload, plus the link name and domain if you set them.
• Paying us: Stripe collects and holds your card details. We never see or store a full card number. We receive the last four digits, card type, expiry, billing country and whether the payment succeeded.
• Writing to us: your name if you give it, your email address, and the message, including any screenshots you attach.

Information collected automatically

• Scan records. When a dynamic code is scanned, we record the time, the device type, browser and operating system from the user agent, the country and city derived from the IP address by our hosting provider, the referring page if there was one, and the browser language. We keep a one-way hash built from the code, the day, the IP address and the user agent so the owner can count unique visitors; the hash cannot be turned back into an IP address, and the IP address itself is not stored in the record. Known bots and link-preview crawlers are skipped.
• Server logs. Our hosting provider records the request path, time, response status, user agent and IP address for every request, to keep the service running and to spot abuse. Logs are kept for a short, fixed period by the provider and are not joined to your account.
• Password-protected codes. Unlocking one sets a cookie on that code's address only, valid for one hour, so the scanner is not asked again straight away.
• Embedded generator. The loader on a third-party page tells us the page address it runs on so the widget can work and so we can see where the credit link is. It collects nothing about that page's visitors, and codes made in the embed are rendered in the visitor's browser like on our own site.

Information we receive from someone else

• Stripe tells us that a payment, renewal, refund or cancellation happened.
• Google, if you sign in with it, as described above.
• Connected apps such as our app for Canva: the details you type into the app to make a code (the destination, colors and label), which we store exactly as if you had saved the code on this site. See section 7.
• Your domain provider, indirectly: when you connect a link domain we look up its public DNS records to confirm the setup.

If you are in the United Kingdom, the European Economic Area or another place with similar rules, we need a legal basis for each use. Here is each use and its basis.

• Running the service you signed up for (accounts, saving codes, redirecting dynamic codes, showing analytics, billing): performance of our contract with you.
• Creating scan records for a code's owner: we act as processor on the owner's instructions; the owner's own legal basis applies.
• Keeping the service secure and stopping abuse (rate limits, bot filtering, server logs): our legitimate interest in running a safe service, which does not override your rights.
• Connected apps (creating and fetching your codes for an app you connected, such as Canva): performance of our contract with you, and the consent you give on the connection screen, which you can withdraw by disconnecting.
• Answering your messages: our legitimate interest in supporting you, or performance of the contract if you are a customer.
• Sending receipts, security notices and changes to these documents: performance of the contract and legal obligation.
• Marketing email: only with your consent, and every message has an unsubscribe link. We do not send any today.
• Tax and accounting records: legal obligation.

We do not use your information for automated decisions with legal effects, we do not build profiles of you across sites, and we do not sell or share personal information for advertising.

If you choose Continue with Google, Google gives us your email address, your name and your profile picture, plus a unique account identifier. We use them only to create and sign you in to your QRFLOW.codes account and to show your name and picture in the header. Signing in does not give us access to your Gmail, Drive, Contacts, Calendar or any other Google data, and we never post to your Google account.

If you install QRFLOW for Google Sheets, the add-on reads the columns you choose in the spreadsheet it is opened in and writes its own columns (the QR code, short link, scan count, code ID and status) back to that sheet. It sends the web addresses and names from those columns to QRFLOW.codes to create and update your codes, and nothing else. It cannot open your other spreadsheets or files. You can remove it at any time from the Extensions menu in Google Sheets or at myaccount.google.com/permissions.

Our use of information received from Google APIs, including Google Sheets data, follows the Google API Services User Data Policy, including its Limited Use requirements. Data we receive from Google is never sold, never used for advertising, and never shared with anyone except the providers in section 8 that run the service. You can disconnect QRFLOW.codes from your Google account at any time at myaccount.google.com/permissions; your account here keeps working with an email password.

When you write to support, we may use an AI model (OpenAI, via its API) to draft a first reply for the person answering you. Your message is sent to that provider for that purpose only; under its API terms it is not used to train models. A person reads, edits and sends every reply. Scan records and your codes are never sent to an AI provider.

You can let another app use your QRFLOW.codes account: our app inside Canva, an AI assistant such as Claude, ChatGPT, Cursor or Claude Code through our MCP server, or a third-party app that registers with our OAuth server. The connection uses OAuth 2.0: the app never sees your password, and you approve it on a screen at qrflow.codes that lists exactly what the app may do. An app can ask for up to six permissions, and we ask for no more than the app needs: see your plan and account email; see your codes and their scan counts; create, change and delete codes in your account; see scan analytics; see your link domains; and manage webhooks. Deleting a code is marked as a destructive action so assistants confirm it with you first.

An AI assistant acts only on what you ask it in your own conversation; we do not receive that conversation, only the request the assistant sends to our server (for example, the address, label and caption of a code to create). The assistant provider processes your conversation under its own privacy policy. Codes made this way are ordinary codes in your account, tagged with the assistant's name on your dashboard, and follow section 9.

• What the app sends us: only what you type into it, meaning the destination, colors and label of a code you create. For the Canva app, we do not receive your Canva account details, your designs, or anything else from your Canva account, and we do not receive anything at all until you press the button that creates a code.
• What we send the app: your plan and account email (so the app can show who is connected and whether a code will be dynamic), the list of your codes with their scan counts, and the image of a code you place in a design.
• What we use it for: providing that app's features and nothing else. Information from a connected app is never used for marketing, never sold, and never shared with anyone except the providers in section 8 that run the service.
• What the platform sees: the platform hosting the app (Canva) sees what the app shows on screen and the code images you place in your designs, under that platform's own privacy policy. It does not see your QRFLOW.codes password.
• How long the connection lasts: an access token expires after one hour and is renewed silently for up to 90 days of use, after which you are asked to connect again. Codes created through an app are ordinary codes in your account and follow section 9.
• Disconnecting: the Account page on qrflow.codes lists every connected app and assistant with a Disconnect button that revokes all of its tokens at once; removing the connector inside the assistant or the app inside the platform has the same effect. Your codes stay in your account.
• New permissions: if an app ever needs a kind of information this section does not describe, we update this policy first and the app asks you to approve the new permission before it can use it.

People you invite. If the account owner uses Business team seats, the people they invite can see the account's codes, their destinations, scan analytics and downloads, and, as editors, change them. They see the email addresses of other members on the Team card and the address of whoever made a code. The owner controls who is invited and can remove anyone at once; a member sees nothing about the owner's billing.

We do not sell personal information. The companies below process it on our behalf, under contracts that limit what they may do with it.

• Supabase (United States): database, authentication and file storage.
• Vercel (United States): hosting, the redirect service, server logs and the country and city lookup used in scan records.
• Stripe (United States): subscription billing and card processing.
• Resend (United States): sending and receiving email such as receipts, password resets and support replies.
• Microsoft 365 (United States): our support@nativecodeapps.com and hello@qrflow.codes mailboxes.
• OpenAI (United States): drafting support replies, as described in section 6.
• Google (United States): sign-in and the Google Sheets add-on, if you choose them.

We may also disclose information when the law requires it, to protect the rights, property or safety of QRFLOW.codes, the people who use it, people who scan codes, or the public, and as part of a sale of the business, in which case we tell you first. Where a dynamic code points at another company's site, that company receives whatever the scanner's browser sends it; that is outside this policy.

• Account and codes: for as long as your account is open.
• Scan records: for as long as the code exists. Delete a code and its scan records go with it.
• Support messages: three years, so we can see history when you write again.
• Billing records: seven years, as tax law requires.
• Server logs: a short, fixed period set by the hosting provider, then gone.

Delete your account from the Account page. Your codes, scan records, saved styles and profile are removed at once, and copies in our backups rotate out within 30 days. Any paid plan is canceled as part of the deletion. Billing records stay for the period in section 9. Dynamic codes stop redirecting the moment the account is deleted, so replace any printed codes first; static codes keep working because the content is in the image.

Depending on where you live you may have the right to access the information we hold about you, correct it, have it deleted, receive a copy in a portable format, object to or restrict how we use it, and withdraw consent where consent is the basis. You can do most of this yourself: the Account page shows and edits your details and deletes the account; each code's Analytics tab exports its scan history as CSV.

For anything else, email support@nativecodeapps.com from the address on your account. We answer within one business day and complete requests within 30 days; we will ask you to confirm it is you before releasing anything. We never charge for this and never treat you differently for asking.

• United Kingdom and EEA: you may also complain to your supervisory authority at any time, without asking us first.
• California: you have the rights to know, delete, correct and to opt out of sale or sharing. We do not sell or share personal information, and we honor the Global Privacy Control browser signal.
• Nevada: you may tell us not to sell your covered information. We do not sell it.

This site sets no advertising cookies, no tracking cookies and no third-party cookies, and loads no third-party analytics, which is why there is no consent banner. Our own usage counters are anonymous totals per day (page views, generator use, downloads, the site a visit came from) and use a session flag in your browser's storage that vanishes when the tab closes; nothing in them identifies you. The only items are strictly necessary: your sign-in session, kept in your browser's storage, and the one-hour unlock cookie on a password-protected code. Do Not Track and Global Privacy Control change nothing in practice because there is nothing to opt out of; both are respected.

QRFLOW.codes is built for adults doing work. It is not directed to children, and we do not knowingly collect personal information from anyone under 13, or under 16 where local law sets that age. If you believe a child has given us personal information, tell us and we will delete it and any account attached to it.

We are based in the United States and our providers run on infrastructure in the United States. If you use the service from elsewhere, your information is transferred to and processed there. For information covered by United Kingdom or European law we rely on the European Commission's Standard Contractual Clauses and the UK Addendum with every provider that receives such information, with encryption in transit and at rest as an additional safeguard. Copies are available on request.

Article 27 of the GDPR requires some companies outside Europe to appoint a representative there. We rely on the exemption for occasional processing that involves no special category data and is unlikely to put people at risk. If that stops being true we will appoint one and name them here.

Information is encrypted in transit and at rest. Access is restricted to the smallest number of people who need it, one customer's data is isolated from another's at the database level, passwords are hashed, code passwords are hashed, and credentials are kept out of source code. No system is perfectly secure. If a breach affects your information we will notify you and the relevant regulator within the time the law requires, which is 72 hours of becoming aware for information covered by European law, and without unreasonable delay everywhere else. If a breach could affect people who use a connected app, we also notify that app's platform (for Canva, within 48 hours of discovery, as its developer terms require). Report a vulnerability to support@nativecodeapps.com with "security" in the subject and we will answer within one business day.

When we change this policy we publish the new version here with a new version number and effective date. If a change materially reduces your privacy, we give notice by email before it takes effect and do not apply it retroactively to information already collected.

Email support@nativecodeapps.com or use the contact page. It comes straight to us in Las Vegas, a person reads every message, and we answer within one business day. We have not appointed a Data Protection Officer because our processing does not meet the threshold that requires one; privacy questions are handled by the company's management directly.