Privacy: what we count, and what we don't

Effective 2 November 2026

Short version: we count scans so you can see them, we don't follow the people who scan, and we keep as little as we can.

Who is responsible

The data controller is SIA HN GROUP, registration number 40203268885, Latvia. Contact: [email protected].

People who scan a code

• We add one to an hourly counter for the code, and note the country when our network provides it.
• To estimate unique visitors per day we compute a one-way hash of the IP address and browser string with a random value that changes every day. Hashes and their daily values are deleted after 3 days. We never store the IP address itself with scan data.
• The scan page sets no cookies, runs no third-party scripts and shows no ads. Known bots are not counted.
• Legal basis: our legitimate interest in running the service and showing code owners how their codes are used (GDPR Art. 6(1)(f)).

People who make a code

• Pictures you upload are stored so we can redraw your code for downloads. If you don't save a design, the picture is deleted within 48 hours.
• Codes are stored with their destination link, settings and a hashed edit key. We can't recover a lost edit key.
• This browser remembers the codes you made, in local storage on your device. It is not sent to us and is not a cookie.
• Payments are processed by Stripe. We receive the billing email, country and payment status, never full card numbers. Stripe acts as an independent controller for payment data under its own privacy policy.
• Email, only if you join a waitlist, used only for that announcement.
• Reports of harmful codes, with what you write.
• Legal bases: performing our contract with you (Art. 6(1)(b)), legal obligations such as accounting and tax records (Art. 6(1)(c)), consent for waitlists (Art. 6(1)(a)), and legitimate interests in security and abuse prevention (Art. 6(1)(f)).

How long we keep data

• Saved codes and their pictures: while the code exists, and up to 30 days after deletion in backups.
• Payment and invoice records: as long as Latvian accounting law requires.
• Visitor hashes: 3 days. Unsaved uploads: 48 hours.
• Server security logs: short-term, for protecting the service.

Where data lives and who helps us

Our servers are in Helsinki, Finland (EU), provided by Hetzner Online GmbH as a processor. Payments are handled by Stripe. We don't sell data or share it for advertising. Fonts and scripts on this site are served from our own server, so visiting it doesn't contact Google or other third parties.

Your rights

Under the GDPR you can ask to access, correct, delete or export your data, to restrict or object to processing, and to withdraw consent at any time. Write to [email protected]. Deleting a code stops it working, so we'll confirm before we do. You can also complain to the Latvian Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv) or the authority in your own country.