Last updated October 21, 2026
Privacy Policy
What we collect, why, and how to get rid of it.
QRMapper is operated by Gnomon LLC ("we", "us"). This policy explains what we collect when you use the QRMapper website, the QRMapper iOS app and the short links we serve at qrmap.cc.
What we collect
Your account. Your name, email address and a hash of your password. If you sign in with Apple or Google, we store the identifier that provider gives us instead of a password. We never see your Apple or Google password.
Your content. The QR codes you create, with their names, destinations, design settings and protection settings, plus the contents of your personal card if you publish one.
Your subscription. If you subscribe on the web, Stripe processes the payment and we store the customer and subscription identifiers Stripe returns. If you subscribe in the iOS app, Apple processes the payment and we store the transaction identifiers Apple returns. We never receive or store your card number.
Scan data. When someone scans one of your QR codes, we record the time, the country and city reported by our CDN, and the device type, operating system and browser derived from the request. We also record where the scan came from, if the scanning app tells us.
Account activity. We note the days on which your account is used, on the website, in the iOS app or through the API, and when each of your QR codes was last scanned. This tells us whether QRMapper is useful to the people who sign up. It is stored with your account and deleted with it.
How you found us. On your first visit to qrmapper.com we store a small cookie, qrm_src, with the campaign tags of the link you followed, the name of the site that sent you and the page you landed on. It holds no identifier. If you create an account, we save that information with the account and delete the cookie; otherwise the cookie expires after 90 days. When you sign up in the iOS app, we note only that you signed up in the app and which version of the app you used.
What we do not store
We do not store the IP addresses of people who scan your codes. To tell repeat scans from new ones without keeping personal data, we combine the visitor's IP address, their browser identification, a secret key and a salt that changes every day, then hash the result and keep only the hash. The hash cannot be reversed to an IP address, and because the salt rotates daily, the same visitor produces a different hash tomorrow.
We do not use advertising identifiers, we do not run advertising trackers, and we do not track you across other companies' apps or websites.
Visitor analytics on our website
To see how many people visit qrmapper.com, which pages they read and where they came from, we use two tools.
Cloudflare Web Analytics sets no cookies and stores no identifier in your browser. It counts the pages opened, the referring sites and coarse technical details such as country, browser and device type, always as aggregate numbers, never tied to a person.
Google Analytics 4 tells us which channels bring visitors and sign-ups. It receives the pages you open on qrmapper.com, the site that sent you, the campaign tags in the link you followed, an approximate location derived from your IP address (Google Analytics does not store IP addresses), your device and browser, and an event when you create an account, without your name or email. For that event, a cookie called qrm_evt holds the sign-up method for ten minutes. We turn off Google signals and ad personalization, we do not send Google any identifier of your account, and Google keeps this data for 14 months.
Google Analytics runs only on qrmapper.com. It never runs on the pages people see when they scan a QR code, on personal cards, on our customers' own domains or in the iOS app.
Outside the European Economic Area, the United Kingdom and Switzerland, Google Analytics stores its own cookies (_ga and ga followed by an ID) for up to 13 months to recognise repeat visits. Inside those regions it runs without cookies and does not recognise you from one visit to the next. You can block it with any content blocker, or with Google's opt-out add-on at tools.google.com/dlpage/gaoptout.
This applies to the website only. The iOS app contains no third-party analytics; our servers only note the days your account is used, as described above.
Affiliate links
Partners in our affiliate program share links to qrmapper.com that carry their referral code (a ?via= parameter). The program runs on Rewardful. Its script loads on qrmapper.com, but it contacts Rewardful and stores a cookie only when you arrive through such a link. That cookie, rewardful.referral, holds a random referral ID and the code of the partner who sent you, for up to 60 days. If you then subscribe on the website, we pass the referral ID to Stripe, and Rewardful receives your email address and the payments of that subscription so it can pay the partner their commission. For everyone else the script loads and does nothing.
Like Google Analytics, Rewardful never runs on scan pages, on personal cards, on our customers' own domains or in the iOS app. Subscriptions bought in the iOS app are not shared with Rewardful.
Why we collect it
To run your account and keep you signed in; to redirect scans to the destination you set; to show you your scan statistics; to bill you and apply your plan's limits; to understand how QRMapper is used and where our users come from; to credit the partners who refer new customers; and to send you transactional email: password resets, receipts and account notices. We do not send marketing email unless you ask us to.
Who we share it with
We share only what each service needs to do its job:
| Service | Purpose | What it receives |
|---|---|---|
| Railway | Hosting and database | All application data |
| Cloudflare | DNS, CDN, short links, website analytics | Requests to our domains |
| Website analytics (Google Analytics) | Visits to qrmapper.com, as described above | |
| Cloudflare R2 | File and image storage | Files you upload |
| Stripe | Payments on the web | Your email and billing details |
| Rewardful | Affiliate program | Visits from affiliate links, and the email and payments of web subscriptions they bring |
| Apple | Payments in the iOS app | Handled entirely by Apple |
| Resend | Transactional email | Your email address and message |
We do not sell your personal data, and we do not share it for advertising.
How long we keep it
Scan history is kept for as long as your plan's retention window: 7 days on Free, 30 days on Pro, 90 days on Business, 365 days on Enterprise. Older scan records are aggregated or removed. Everything else is kept while your account is open.
Deleting your data
You can delete your account at any time: in the app, open Manage → Delete account; on the web, Dashboard → Manage. Deleting your account removes your QR codes, their scan history and your personal card. Your QR codes stop resolving immediately. Anything already printed will no longer work. We keep billing records where tax law requires it.
To ask what we hold about you, or to have it corrected or exported, email support@qrmapper.com from your account address.
Children
QRMapper is not directed at children under 13, and we do not knowingly collect their personal data.
Changes
If we change this policy in a way that affects you, we will update the date at the top of this page and notify account holders by email before the change takes effect.
Contact
Gnomon LLC: support@qrmapper.com