Privacy Policy

Last updated: August 12, 2026

The short version: static QR codes are generated entirely in your browser — the content never reaches our servers, so there is nothing for us to store, sell, or leak. For dynamic codes we store the minimum needed to run the service: your destination URL, your email if you save the code, and anonymous per-scan counters. We don't run ad trackers, we don't sell data, and we don't store scanners' IP addresses.

Static QR codes: we never see them

The generator on our homepage (URL, text, Wi-Fi, email, SMS, phone, and vCard codes) runs completely in your browser. The content you type — including Wi-Fi passwords and contact details — is never transmitted to us. Downloads are produced locally on your device. We have no record that your code exists.

Dynamic QR codes: what we store

Dynamic codes work by redirecting through our servers, so for each dynamic code we store:

The destination URL you point the code at, and its edit history state (current destination only).
Your email address, if you save the code to an account — used to show you your codes, send your magic sign-in links, and send service emails about your codes (like trial-status notices). We do not send marketing email without your consent.
Scan counters: when someone scans your code we increment counters for the day, the device type (phone/desktop), and a coarse location (country and city) derived from the request. We do not store the scanner's IP address, and we set no cookies on scanners.

Accounts and sign-in

We use magic-link sign-in: you give us your email, we send a single-use link that expires in 15 minutes. There are no passwords for us to store or lose. Your session token is kept in your browser's local storage; sessions expire after 30 days. Login requests are rate-limited by IP address; those rate-limit counters expire automatically within about an hour.

Payments

Paid subscriptions are processed by Stripe. Your card details go directly to Stripe and never touch our servers. We receive from Stripe only what we need to run your subscription: whether it's active, and which plan you're on.

Cookies and analytics

We set no advertising or analytics cookies. We do not use third-party ad trackers, and we do not sell or share personal data with data brokers, ad networks, or anyone else.

Service providers

We rely on a small set of infrastructure providers, each processing only what's needed to deliver the service: Vercel (website hosting), Cloudflare (redirect and API infrastructure), Resend (transactional email delivery), Stripe (payments), and Google Fonts (font files served by Google when pages load).

Data retention and deletion

Dynamic-code data is kept while your code or account is active. To delete a code, your account, or any personal data we hold about you, use the contact page or reply to any email we've sent you — we'll confirm deletion within 7 days.

Children

QRMango is not directed at children under 13, and we do not knowingly collect personal information from them.

Changes to this policy

If we change this policy in a way that affects what we collect or how we use it, we'll update this page and note the new date above. Account holders get an email for material changes.

Contact

Questions about privacy or your data: contact us and a human will reply.