Privacy Policy

Last updated October 20, 2026

This policy explains what personal information Quiet Zone QR collects, why, and what happens to it. It covers the studio at quietzoneqr.com/app/, the short links and pages behind dynamic codes, and our emails.

1. What we collect and why
2. Legal bases
3. Cookies and storage on your device
4. Who we share it with
5. International transfers
6. How long we keep it
7. Your rights and choices
8. Security
9. Children
10. Changes to this policy
11. Contact

1. What we collect and why

If you use the studio without an account

Your designs and saved codes stay in your browser’s storage on your device; they are not sent to us. Like any website, our server receives your IP address and a description of your browser when it sends you the page. We use these only to deliver the page and protect the service from abuse (for example by limiting how fast one address can send requests), and we don’t store them.

If you create an account

• Email address and password, to sign you in and to write to you about your account. Your password is stored only as a one-way scrypt hash, never as you typed it.
• Your codes: their names, content (the links, text and details you enter, including any contact details you choose to publish on a page), designs, short links and dates.
• Uploads: the images and PDFs you add to pages, with their file names.
• Account records: when you signed up and confirmed your email address, which version of the terms you accepted, and your sign-in sessions (a random token we store only as a hash, with its expiry date).
• Messages you send us, such as questions and appeals.

If you scan a dynamic code

When a phone opens a short link, its browser sends our server an IP address, a description of the browser and device (the “user agent”) and the time, as with any website visit. At that moment we use them to:

• send you to the code’s destination, or show its page;
• work out the country, with a database kept on our own server (no outside service is asked);
• read the type of device and its operating system; and
• count unique visitors per day, using a hash of the IP address and browser made with a random key. A new key is made every day and the old one is deleted, so once the day is over nobody, including us, can connect the hash to an address or a person.

We then store only the time, country, device type, operating system and that daily hash. We don’t store the IP address or the user agent, set cookies, or run tracking scripts on these pages. Link previews made by messaging apps and other bots are not counted. The code’s owner sees totals (scans per day, countries, devices and unique visitors), never individual visits.

The website a code sends you to has its own privacy policy. Landing pages show what the code’s owner chose to publish; for questions about that information, contact them.

If you report a code

We keep what you tell us (the reason, any details, and your email address if you give one) and a daily hash of your IP address, made the same way as above, to stop the same person reporting a code twice. Reports are emailed to the people who review them. We use your email address only if we need to ask you something about the report.

Emails

We send only the emails the service needs: address confirmation, password resets, security notices, notices about your codes, and important changes to the service, the terms or this policy. We don’t send newsletters or marketing without asking first, and we don’t track whether you open our emails or click their links.

2. Legal bases

Where the GDPR or UK GDPR applies, we rely on:

• Contract: running your account, your codes.
• Legitimate interests: scan statistics for code owners (kept to the minimum described above), keeping the service secure, and preventing abuse such as phishing. You can object at any time by writing to us.
• Legal obligation: answering valid legal requests.
• Consent: for anything optional, if we ever ask for it. You can withdraw consent at any time.

3. Cookies and storage on your device

• One cookie, qz_session, set when you sign in to keep you signed in. Only our server can read it, and it expires after 30 days without use. It is strictly necessary, so we don’t ask for consent.
• Browser storage in the studio keeps your unsaved work and, when you are signed out, your saved codes, on your device only. Clearing this site’s data in your browser removes it.
• No analytics, advertising or third-party cookies, and our pages load no fonts, scripts or images from other companies.

4. Who we share it with

We don’t sell personal information, and we don’t share it for advertising. These companies process it for us, only on our instructions:

We may also disclose information when the law requires it, to protect people from harm (for example by reporting a phishing page to the company it imitates, its host or the authorities), or to whoever takes over Quiet Zone QR, who will be bound by this policy.

5. International transfers

Our servers are in San Francisco, United States, and our providers may process information in the United States and other countries. When information from the European Economic Area, the UK or Switzerland goes to a country without an adequacy decision, it is protected by the providers’ Standard Contractual Clauses or their certification under the EU–US Data Privacy Framework.

6. How long we keep it

7. Your rights and choices

• In the studio, signed in, select your email address at the top: Download my data gives you a copy of everything stored about your account, and Delete account deletes it.
• Depending on where you live (for example under the GDPR, the UK GDPR, or the laws of California and other US states), you can ask us to give you access to your information, correct it, delete it, send it to you in a portable format, restrict or object to how we use it, or withdraw consent. Write to hello@quietzoneqr.com; we will answer within 30 days and may confirm the request from your account’s email address first. You may use an authorized agent. We will not treat you differently for using these rights.
• We don’t sell or share personal information as California law defines those terms, and we don’t use sensitive personal information to infer anything about you. In the last 12 months we collected the categories described above: identifiers (email address), internet activity (scans of dynamic codes, without identifying who scanned) and approximate location (country).
• If you are in the EEA or the UK, you can also complain to your data protection authority.
• If you scanned a code: we store nothing that identifies you, so we cannot find or single out your scans.

8. Security

Every page is served over HTTPS. Passwords are stored as scrypt hashes, and sign-in and email-link tokens only as hashes, so a copy of our database would not let anyone sign in. Uploaded files are checked by their content, not their name. Only the people who run Quiet Zone QR can access the servers. No system is perfectly secure; if a breach affects your information, we will tell you and the authorities as the law requires.

9. Children

Quiet Zone QR is not meant for anyone under 16, and we don’t knowingly collect their information. If you think a child has given us personal information, write to hello@quietzoneqr.com and we will delete it.

10. Changes to this policy

When we change this policy we update the date at the top. If a change matters, for example new information collected or a new company receiving it, we email account holders before it takes effect.

11. Contact

Quiet Zone QR is run by Quiet Zone QR LLC, Bakersfield, CA, which is responsible for your information (the “controller”). For anything about your privacy, write to hello@quietzoneqr.com.