Privacy policy

Last updated: 5 August 2026

The link you encode is not logged, and the code does not point at us

Two separate promises live in that sentence, and the second one is the unusual one. The first: whatever you type into the generator is encoded by your own browser and never sent anywhere. There is no request, no queue and no record — you can watch the Network panel of your developer tools stay empty while a code appears.

The second concerns what ends up inside the printed square. A code made here contains exactly the characters you typed. It does not contain a short URL on this domain that forwards to yours. Many free QR services work the other way round: they hand you a code pointing at their own tracking host, which redirects onward, which lets them count every scan and quietly makes your code a subscription. When such an account lapses, or the company is sold or shut down, the redirect stops answering and every code already printed becomes a dead square. This matters most for print, because print is the one medium where you cannot fix it afterwards — the poster is in the window, the sticker is on the box, the label is on ten thousand cartons. Codes from this page carry no dependency on this site continuing to exist. That is also why the generator cannot offer editable codes: the two properties are mutually exclusive.

Images you decode stay in the tab

The reader is the side of this that handles genuinely sensitive material. People decode screenshots of event tickets, boarding passes with a name and a booking reference on them, Wi-Fi joining codes containing a network password, payment requests. None of it is uploaded. The file you drop, paste or pick is drawn onto a canvas in your browser, the pixels are handed straight to the decoder, and the result is put on screen. Nothing is written to storage, so there is no history of what you scanned, and closing the tab discards the lot.

The decoder itself is worth a line. jsQR is served from this site rather than pulled off a public CDN. A CDN copy would work identically, but it would mean your browser announcing to a third party that you had opened this page, complete with your IP address and the referring URL. Serving the file ourselves means no one outside your own connection learns you used it. It is also loaded lazily — the script is only fetched once you actually supply an image.

What the server sees

Delivering the page at all requires a web server, and ours keeps the ordinary access log that every web server keeps: the requesting IP address, the path asked for, the timestamp, the user-agent string and the referring page. Our hosting provider retains those entries briefly, for security and for a rough sense of traffic. They are not tied to identities and nothing about your codes appears in them, because nothing about your codes reaches the server.

Cookies and analytics

No cookies are set by this site. One value is written to your browser's local storage: whether you accepted or declined the consent banner, so that it stops asking on every visit. You can clear it with the rest of your site data at any time. No analytics or tag-management script runs on these pages today.

Advertising (planned)

Hosting costs money, and the intention is to cover it with advertising, most likely Google AdSense. Once that starts, the ad network will load its own content from its own servers and may set cookies or comparable identifiers in your browser to count impressions and, subject to your region and your consent, tailor what you are shown. Third-party vendors, Google included, use cookies to serve ads informed by your earlier visits to this and other sites. Personalised advertising from Google can be switched off at Google Ads Settings, and other participating vendors are managed at aboutads.info/choices. Where the law requires it — GDPR and the ePrivacy rules in the EEA and the UK, for instance — the consent banner asks you first, and no non-essential cookie is set until you agree. This section will be rewritten with concrete detail on the day ads actually appear.

Advertising will not touch either promise above. Ads sit in the page; the text you encode and the images you decode still never leave your machine, so there is nothing about them for an advertiser to receive.

Children

These pages are not aimed at children under 13, and we do not knowingly gather personal information from them.

Your rights

We hold no personal data apart from the short-lived server logs described above, so in the normal course there is nothing for us to export, correct or erase. If you think we hold something about you, or you have a question about the logs, write to us and you will get an answer within 30 days.

Changes

Any material change — advertising going live being the obvious one — will be published here with a new date at the top of the page. Carrying on using the site afterwards means you accept the revised version.