Privacy Policy

Last updated: September 2026

This Privacy Policy describes how Qrauthix ("Qrauthix", "we", "us") collects, uses, and protects information when you use qrauthix.com, our verification pages, our mobile application, and our API (collectively, the "Service").

1. Information We Collect

Account information

When you register, we collect your name, email address, optional phone number, a hashed (never plaintext) password, and — if you provide one — an organization name.

Verification data

When a QR code is scanned — through a browser or the mobile app — we record the identifier scanned, the outcome (verified, inactive, expired, already used, etc.), a timestamp, and technical context such as IP address, user agent, and, for mobile app verifications, approximate location if you've granted that permission. This data is what powers batch-level analytics and the risk engine described in our Security page.

Free QR code generator

Our free QR code generator runs entirely in your browser; the content you enter is never sent to us. When you download, print, copy, or share a generated code, we record which QR type was used, your IP address, and your browser's user agent, for usage analytics.

Cookies

We use a first-party, HTTP-only session cookie to keep you signed in to qrauthix.com. We do not use third-party advertising cookies.

2. How We Use Information

  • To operate and secure the Service, including authenticating accounts and detecting suspicious verification activity.
  • To provide manufacturers with analytics about their own products' verification activity.
  • To communicate with you about your account, including email verification and security notices.
  • To comply with legal obligations and enforce our Terms of Service.

3. How We Share Information

We do not sell personal information. A manufacturer can see verification activity for their own products only — organizations are strictly isolated from one another in our data model. We may share information with service providers who process it on our behalf (e.g. hosting, email delivery) under confidentiality obligations, or when required by law.

4. Data Retention

By default, this deployment retains:

  • Verification traces for 365 days;
  • Audit logs for 730 days;
  • API request logs for 90 days.

Data older than its retention window is automatically and permanently deleted by a scheduled cleanup process.

5. Security

Passwords are hashed, sensitive secrets are encrypted at rest, and traffic is served over HTTPS. See our Security page for details, including why our Secure QR landing page is deliberately designed to reveal nothing about a code's validity.

6. Your Rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to certain processing. To exercise any of these rights, contact us using the details below.

7. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from them.

8. International Data Transfers

Your information may be processed in a country other than the one in which you reside. Where required, we rely on appropriate safeguards for such transfers.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

10. Contact Us

Questions about this policy? Contact us.