Privacy

Last updated 13 October 2026.

QuickQReate is a free QR code generator run by David Allmon. This page explains what it stores and why, in plain language.

Without an account

Codes are generated in your browser. What you type is never sent to a server and is never stored. Only your light or dark theme choice is remembered, on your own device. There are no ads, analytics scripts or tracking cookies.

With an account

• Sign-in details: your email address and a securely hashed password, or your Google account’s email and name if you sign in with Google.
• Saved codes: the content and design of codes you choose to save, including the destination of dynamic codes. Saved Wi-Fi codes include the network password you entered.
• Hosted pages and files: the text, links, images, PDFs, audio and video you add to a hosted page. These are public: anyone with the code or link can see them.
• Design templates: designs you save to reuse later.
• Teams: people you invite can see your codes, analytics and feedback (viewers) or also change them (editors). An invite keeps the email address you entered until it’s used, revoked or expires after 14 days. Teams you join can see your name and email address.
• API keys: only a one-way hash of each key is stored, with the name you gave it and when it was last used.
• Code passwords: stored only as a secure one-way hash.
• Cookies: strictly necessary cookies that keep you signed in. When a visitor enters a code’s password, a cookie remembers that for 12 hours so they aren’t asked again.

Feedback pages

When someone answers a feedback page, QuickQReate stores their rating, any comment and any contact details they choose to give, plus the same daily-salted visitor hash used for scans (to stop repeat submissions). Only the page’s owner can see responses.

Scans of dynamic codes

When someone scans a dynamic code, QuickQReate records the time, the approximate location (country, region and city, as provided by Cloudflare), the device type, operating system and browser. To count unique visitors it stores a one-way hash of the IP address and browser, salted with a value that changes every day. The IP address itself is never stored, and the hash can’t be turned back into it. Only the owner of the code can see its scans.

Who processes data

• The database and sign-in service are self-hosted by the operator in a data center in Chicago, USA.
• Brevo sends account emails such as confirmations and password resets.
• Google handles sign-in if you choose “Continue with Google”.
• Cloudflare delivers the site and provides approximate scan locations.

Your data is never sold or shared for advertising.

Keeping and deleting data

Your account and codes are kept until you delete them. Deleting your account (Account → Delete account) permanently removes it, every saved code, uploaded file, feedback response and all scan history right away. Backups are rotated and expire within about three months.

Contact

Questions or requests: open an issue on GitHub. QuickQReate is free and open source; if it helps you, you can buy me a coffee.