Privacy Policy

01Who we are and how to reach us

This policy describes how we process personal data on thugqr.com, on api.thugqr.com (the service behind accounts) and on go.thugqr.com (the address behind every dynamic QR code), in all their language versions. Together we call them “ThugQR”, “the service”, “we”.

The controller, within the meaning of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Greek law 4624/2019, is the private individual who runs ThugQR, a personal, non-commercial project, not a company. More in the “Who we are” section of the Terms of Use.

For any question or request about your data, write to us at hello@thugqr.com. We are not required to appoint a data protection officer (DPO) and have not appointed one; privacy correspondence is read and handled directly by the operator of the service.

02Who this policy is about

This policy concerns three different groups of people, and we process something different for each:

• Visitors who make static QR codes without an account. For you we keep almost nothing, and visitor statistics and ad measurement only if you allow them (sections 3, 4, 11, 12 and 13).
• Account holders who use dynamic QR codes. For you we keep your account details and your QR codes (sections 5 to 7).
• People who scan someone else’s dynamic QR code. For you we process the technical details of the scan for a few milliseconds, and keep only anonymous statistics and, in a giveaway, only what you yourself type into the winner form (sections 8 to 10).

If a section does not apply to you, you can simply skip it.

03The generator: everything happens on your device

The static QR code generator runs entirely inside your browser. The content you enter (links, text, Wi‑Fi details, vCard contact cards, email or SMS content, phone numbers), the logos you upload, the colours and shapes you choose, and the PNG, JPEG, WEBP or SVG files you download are all created and processed locally, by code running on your device.

None of it is sent to our servers or to any third party. We cannot see, store, retrieve or disable the static codes you make. A static code contains its own content, so it keeps working even if ThugQR ceased to exist.

The only communication between your browser and our servers while you use the generator is loading the page itself and its files (code, fonts, images), which is described in section 13.

The exception: Save. If you are signed in and press Save, we send and keep in your account the name you give, the content of the code, all its design settings (including the logo you uploaded, if any) and a small preview image, so that you can open, change and download it again. Only you see them, under “My QR codes”, and they stay until you delete them or your account. Legal basis: performance of the contract (Article 6(1)(b) GDPR).

04What is stored on your device

So that you find your work when you come back, the site saves your current design in your browser’s local storage: the content you typed, your design choices and, if it fits, the logo you uploaded. It also saves your language, your theme (light or dark) and the tab you last opened. If you are signed in, it also saves the basic details of your account (name, email, plan), so that the account button appears at once without another request to the server.

All of this stays on your device and is not sent to us. You can erase it with the Reset button in the generator, by signing out (for the account details), or by clearing the site’s data in your browser settings. The full list, together with the cookies used by accounts, locked QR codes and, only if you accept them, Google Analytics and the TikTok Pixel, is in the Cookie Policy.

05Your account

An account is only needed for dynamic QR codes. When you sign up, we process:

• First and last name, as you enter them, to address you in the service and in emails.
• Email address, as your sign-in identifier and to send you verification codes. We verify it with a 6-digit code before the account is created, so nobody can sign up with an address they do not own.
• Password, stored only as an Argon2id hash. We do not know your password and cannot recover it, only replace it through the reset process.
• Timestamps: when the account was created, when the email was verified, when you accepted the Terms of Use (so that we can prove it, Article 7(1) GDPR) and when you last signed in.
• Plan (free or Pro) and account status.

For every sign-in from a device or browser we create a session, in which we record the browser identifier (user agent), the IP address the sign-in came from, the sign-in time and the time of last use. This lets you see your active devices and sign out all the others, and lets us detect abuse (for example a stolen sign-in token). Session tokens are stored only as SHA‑256 hashes.

To protect against password guessing, we count failed sign-in attempts per IP address and per account. The keys of these counters are stored as hashes, not as plain IPs or emails, and are deleted as soon as the time window ends (at most one hour).

Legal basis: performance of our contract with you, i.e. providing the account you asked for (Article 6(1)(b) GDPR). For sessions, the security counters and the proof of acceptance of the terms, our legitimate interest in running a secure service and in being able to demonstrate compliance (Article 6(1)(f) GDPR).

06The emails we send you

We send only functional emails, from noreply@thugqr.com, and only when you trigger them with an action of yours:

• the 6-digit verification code when you sign up
• the reset code when you ask for a new password
• two codes when you change your email: one to the old and one to the new address, so that both are required
• the confirmation code when you ask to delete your account

We do not send newsletters, offers or marketing messages, and we will not do so without first asking for your explicit consent, which you could withdraw at any time. If the terms or this policy change materially, or if we need to tell you about a security matter concerning your account, we may send you an informational email; that is part of the service, not commercial communication.

The codes we send are stored in our database only as HMAC‑SHA256, are valid for 10 minutes and are cancelled after 5 wrong attempts. Emails leave through the mail servers of our hosting provider (section 14). The recipient’s email provider (for example Google, if you use Gmail) processes the message under its own policy; that is outside our control.

07Your dynamic QR codes

A dynamic QR code does not contain the final destination but a short link of the form go.thugqr.com/name. When someone scans it, our server redirects them to the destination you have set at that moment. That is why you can change the destination after printing the code. To make this work, we store in your account:

• the name you give each QR code and its short link (slug)
• its destination or destinations, with the rules you set (by device, time, date, number of scans, language, country, or random/sequential rotation) and the time zone for the rules
• the lock password, if you have locked the QR code, stored only as an Argon2id hash
• QR code groups (e.g. “Tables”), their name and parameter
• the status of each code (active, paused, blocked), its total number of scans and the time of the last scan

Legal basis: performance of the contract (Article 6(1)(b) GDPR). The destinations you set are your content; we use them for nothing other than redirecting, checking for abuse (section 8 of the Terms of Use) and solving technical problems.

When you delete a QR code, its statistics are deleted immediately. The short link itself stays reserved forever (with no name, destination or statistics) so that nobody else can take it and send the people who scan an already printed code somewhere else. The same happens to all your QR codes when you delete your account.

08Scan statistics: how we count without tracking

This section is about the people who scan a dynamic QR code, not its owner. Every scan is a plain visit to a go.thugqr.com address. At the moment of the visit our server automatically receives, like every server on the internet, your IP address, your browser identifier (user agent) and your browser’s preferred language. We use them immediately, within the same request, for two things: to send you to the right destination (the owner’s rules may depend on your device, language or country) and to count the scan.

From the scan we store only:

• the date and time
• the country, derived from your IP address with its last part zeroed, using a database that lives on our own server (DB‑IP Lite). No external geolocation service is called and no city or precise location is determined.
• the device type (mobile, tablet, desktop), the operating system family (e.g. iOS, Android) and the browser family (e.g. Safari, Chrome), without version numbers
• which of the code’s destinations you were sent to, if the code has more than one
• an anonymous visitor identifier: the SHA‑256 hash of a random daily “salt”, the specific QR code, your IP and your user agent. It serves only to count the unique visitors of a day and to avoid counting twice a scan repeated within 10 seconds.

The daily “salt” is deleted at the end of each day. From that moment the identifier cannot be reproduced, not even by us: we cannot link your visits on different days, nor your visits to different QR codes, nor get back to your IP address. We store no IP address, no user agent, and no cookie or other identifier on your device. It is the same method used by privacy-respecting audience measurement tools, and it was designed to fall within the audience-measurement exemption described by the French authority CNIL.

Automated visits from crawlers, link previews in messaging apps (WhatsApp, Slack, iMessage and others) and prefetches are redirected normally but not counted. The owner of the QR code sees only aggregated figures: scans and unique visitors per day, per country, per device type and per destination. They never see individual visits, IP addresses or anything that could lead to a specific person.

When redirecting, we instruct your browser not to reveal to the destination that you came through go.thugqr.com (no‑referrer policy) and not to cache the redirect. The destination is a website of the code’s owner or of a third party, with its own privacy policy, which we do not control.

Legal basis: our legitimate interest and that of the code’s owner (Article 6(1)(f) GDPR) in providing the redirect you requested by scanning, protecting the service from abuse, and letting the owner know, at an aggregate level, how much their code is used. We weighed this interest against your rights, and that is why we chose a method that does not track you and keeps nothing that identifies you. Because nothing is stored on or read from your device, no consent is required under the ePrivacy rules (Article 5(3) of Directive 2002/58/EC). You always have the right to object (section 18).

09Locked QR codes

The owner of a dynamic QR code can protect it with a password. Then, instead of a redirect, you see a page asking for the password. What you type there is compared with the hash of the password and is not stored. After a correct password, our server places a cookie in your browser, for go.thugqr.com only, so that you do not have to type the password again for 12 hours. The cookie contains an expiry date and a digital signature; it contains neither the password nor any detail about you, and it is used for no other purpose. It is strictly necessary for the function you requested, so it does not require consent.

Wrong attempts are counted per IP address and code (as a hash, for 10 minutes), so that nobody can try thousands of passwords. Scanning a locked code is counted in the statistics in the way described in section 8, whether or not the right password was entered.

For each wrong password we keep only its time, nothing about who typed it, so that the owner can see how many wrong tries there were. If the owner has chosen so, after a number of wrong passwords in a row the QR code pauses until they turn it back on. These records are deleted after 90 days.

10QR code giveaways

The owner of a group of dynamic QR codes can turn it into a giveaway. When you scan such a code, instead of a redirect you see a result page (you won, no prize, already opened, the giveaway has ended). Whether a code wins is decided by a random draw on our server, either when the organizer creates the giveaway or at the moment of the first scan. Nothing about you plays a part in the draw and nothing about you is stored for it. The scan is counted in the statistics in the way described in section 8. The claim code winners see is computed from the QR code’s identifier and is not stored.

If the organizer chose to reveal the result only once, the first scan of each code “opens” it and later scans see “already opened”. So that you can see your own result again on the same device, our server places a cookie named qrs_<number>, for go.thugqr.com only, for 30 days. It contains only a signed mark of the moment the code was opened, nothing about you, and it is strictly necessary for the function you requested, so it does not require consent.

The organizer may ask winners to leave details in order to deliver the prize (first name, last name, phone, email, whichever of these they selected), and may let you have the prize sent to your email. We store only what you type, with the time you sent it, linked to that particular code. The details are emailed to the organizer, shown in their dashboard and, if they chose so, you receive a copy too. We use them for nothing else: no marketing messages, no profile, no sharing with anyone but the organizer. The organizer is responsible for the giveaway and for what they do with your details afterwards; we process them on their behalf, only to hand them over. Legal basis: your request to receive the prize (Article 6(1)(b) GDPR). Form submissions are limited to 20 per 10 minutes per IP address (as a hash), so that nobody can flood it.

Winner details stay for as long as the giveaway exists in the organizer’s account and are deleted together with the code, the giveaway or the account. The “collected” mark the organizer sets keeps only a time. You can ask the organizer or us, at hello@thugqr.com, to delete them, quoting the code’s link.

11Visitor statistics (Google Analytics), only with your consent

To understand which pages people read and where the site needs improving, thugqr.com can use Google Analytics 4. It runs only if you press “Accept” in the cookie banner. Until then, and if you press “Reject”, the Google Analytics code is not loaded at all and nothing is sent to Google. Analytics runs only on thugqr.com: the accounts service (api.thugqr.com) and QR scans (go.thugqr.com) never use it.

If you accept, Google Analytics records, under a random identifier kept in a cookie: the pages you visit and the page you came from, the time, your approximate location (country and city, derived from your IP address, which Google Analytics 4 does not store), your device, browser, operating system, screen size and language, and simple interactions such as scrolling, file downloads and clicks on links to other sites. It does not record what you type in the generator, your QR codes, your logo or the details of your account.

We have switched off Google signals and ad personalisation: the data is not linked to your Google account and is not used for advertising. Google Ireland Ltd processes the data as our processor, under Google’s data processing terms. Google may also process data in the United States; Google LLC is certified under the EU‑US Data Privacy Framework.

Legal basis: your consent (Article 6(1)(a) GDPR and Article 4(5) of law 3471/2006). You can withdraw it at any time, as easily as you gave it, from the “Cookie settings” link at the bottom of every page; the cookies are then deleted and measurement stops. Statistics are kept in Google Analytics for up to 14 months and then deleted automatically. Your choice itself is stored only in your browser (see the Cookie Policy) and we ask again after 12 months.

12Advertising measurement (TikTok Pixel), only with your consent

We promote ThugQR with ads on TikTok. To know which of those ads actually bring people to the site, thugqr.com can use the TikTok Pixel. It runs only if you allow “Advertising” in the cookie settings, or press “Accept” in the banner. Until then, and if you refuse it, the TikTok code is not loaded at all and nothing is sent to TikTok. The pixel runs only on thugqr.com, never on api.thugqr.com or go.thugqr.com. ThugQR itself shows you no ads.

If you allow it, the TikTok Pixel sends TikTok: the pages you visit and the page you came from, the time, technical details of your browser and device, your IP address, an identifier kept in a cookie and, if you arrived from a TikTok ad, the click identifier of that ad. TikTok can link this to your TikTok account if you have one, and uses it to measure our campaigns and, according to its own privacy policy, to show ads, including ads of other businesses. We do not send TikTok what you type in the generator, your QR codes or the details of your account. With your consent it also records a few actions on the site: opening a service page, downloading a QR code and creating an account, without your name, email or the content of the code.

Recipient: TikTok Technology Limited (Ireland). For the collection and transmission of this data through the pixel, TikTok and we act as joint controllers under TikTok’s terms for its business products; after that, TikTok processes the data as an independent controller. TikTok may transfer data outside the EEA, using the EU standard contractual clauses. You can exercise your rights over that data directly with TikTok, or through us at hello@thugqr.com.

Legal basis: your consent (Article 6(1)(a) GDPR and Article 4(5) of law 3471/2006). You can withdraw it at any time from the “Cookie settings” link at the bottom of every page; the TikTok cookies on thugqr.com are then deleted and the pixel no longer loads. The cookies last up to 13 months; how long TikTok keeps the data it has received is set by TikTok’s privacy policy.

13Hosting, server logs and backups

The website, the accounts service, the database and the redirects are hosted on Hostinger servers, in a data centre in Frankfurt, Germany, within the European Union. Hostinger acts as a processor on our behalf, under a data processing agreement pursuant to Article 28 GDPR.

As on every website, when your browser requests a page or a file, the server temporarily records in its log files:

• your IP address
• the date and time of the request
• the address requested and the server’s answer (e.g. status code, size)
• your browser and operating system (user agent)
• the page you came from (referrer), if your browser sends it

Log files are used only for the operation and security of the site (troubleshooting, attacks and abuse) and are deleted automatically after a short rolling period set by the hosting provider. We do not use them to identify you or to build profiles. Legal basis: our legitimate interest in running a secure and reliable website (Article 6(1)(f) GDPR).

The hosting provider automatically keeps backups of the database and files so that we can restore the service after a failure. Backups are replaced on a rolling basis and older ones are deleted within 30 days at the latest. This means that data you deleted may remain in a backup for up to 30 days, without being used for any other purpose.

14Who we share data with

We do not sell, rent or hand over personal data to anyone for their own purposes. The only third parties that come into contact with data are:

• Hostinger (Hostinger International Ltd. and its group companies, based in the EU): hosting of the website, the database and the log files, and delivery of our emails through its mail servers. A processor, servers in Frankfurt.
• Cloudflare (cdnjs): only when, from the dynamic QR dashboard, you download many QR codes together as a ZIP file, your browser loads the JSZip compression library from cdnjs.cloudflare.com. In that request Cloudflare receives your IP address and user agent, like any server you download a file from. It does not receive the content of your QR codes, which is compressed locally. The file’s integrity is verified with a cryptographic signature (Subresource Integrity). No other page or feature of ThugQR communicates with Cloudflare.
• Google (Google Ireland Ltd): only if you accept analytics cookies, the visitor statistics described in section 11. A processor; data may also be processed in the United States under the EU‑US Data Privacy Framework.
• TikTok (TikTok Technology Limited, Ireland): only if you allow advertising cookies, the ad measurement described in section 12. A joint controller for the collection through the pixel, then an independent controller; data may be transferred outside the EEA under the EU standard contractual clauses.
• Public authorities, only where the law or a binding court or administrative order requires it, and only to the extent required. We will inform the person concerned where the law allows.

Apart from Google Analytics and the TikTok Pixel, both only with your consent, we use no other analytics or advertising tools, and no social media widgets, chat widgets or external fonts. The site’s fonts, icons and code libraries (apart from the JSZip mentioned above) are hosted on our own server. The DB‑IP country database also lives on our server, so no IP address is sent to a third party to look up the country.

15How we protect data

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR), including:

• encryption of every connection with TLS (HTTPS) and HSTS on all subdomains
• passwords and lock passwords stored only as Argon2id hashes; session tokens, email codes and counter keys only as SHA‑256 or HMAC hashes
• sign-in cookies with the HttpOnly, Secure and SameSite=Strict attributes, so that they cannot be read by code or by other websites, and CSRF protection
• short-lived access tokens (15 minutes) with automatic rotation, and revocation of the whole session if reuse of an old token is detected
• rate limits on sign-in, sign-up, email codes and locked QR codes
• minimisation by design: we do not store what is not needed (IP and user agent of scans, content of static codes)
• security headers (Content Security Policy, X‑Frame‑Options and others), prepared SQL statements, automated tests and regular software updates
• access to the database and servers only by the operator of the service, with strong authentication

No service is completely secure. If a data breach occurs that is likely to put your rights at risk, we will notify the competent supervisory authority within 72 hours and you without undue delay, as Articles 33 and 34 GDPR require.

16Where the data is

All the data we store is on servers within the European Union (Frankfurt). We do not transfer data outside the European Economic Area, with these exceptions: the emails we send you are delivered to your own email provider, wherever it is; the JSZip library is loaded from Cloudflare’s content delivery network, which answers from the node closest to you, possibly outside the EU; only if you accept statistics cookies, Google may process the visitor statistics in the United States; and only if you allow advertising cookies, TikTok may process the ad measurement data outside the EEA. Cloudflare and Google are covered by the EU standard contractual clauses and the EU‑US Data Privacy Framework; TikTok uses the EU standard contractual clauses.

17How long we keep data

In short, by category:

• Account details (name, email, password hash, plan, timestamps): as long as the account exists. Permanently deleted as soon as you delete it.
• Sessions (user agent, IP, times): a session ends after 14 days of inactivity or 90 days at most, or when you sign out. Its record is deleted 7 days after it ends.
• Email codes (hashed): valid 10 minutes, deleted the next day. The details of a sign-up that was never verified are deleted with them.
• Security counters (hashed): up to one hour.
• Dynamic QR codes (name, destinations, rules, groups): as long as they exist in your account. After deletion only the reserved short link remains, with no personal or other data.
• Detailed scans (time, country, device, anonymous identifier): 90 days, then deleted automatically. The total number of scans of each code, a single number, remains as long as the code exists.
• Daily “salts” for the visitor identifiers: deleted after the end of the day.
• Server logs: a short rolling period set by the hosting provider.
• Backups: up to 30 days.
• Correspondence with you: as long as needed to answer and handle your request, and afterwards up to 3 years, so that we can prove what we answered to a request or an abuse report.
• Saved static QR codes (name, content, design, logo, preview): until you delete them or your account; then they are permanently deleted.
• Abuse reports from the report form (link, reason, description, name if you give it, email): up to 3 years, so that we can show how we handled each report. We send a receipt and our answer to the email you gave.
• Winner details from a giveaway form (first name, last name, phone, email, whichever the organizer asked for, the time, and whether the prize was emailed): as long as the giveaway exists in the organizer’s account. Deleted together with the code, the giveaway or the account.
• Google Analytics statistics (only with your consent): up to 14 months in Google Analytics, then deleted automatically. The cookies themselves expire after 13 months, or as soon as you withdraw your consent.
• TikTok Pixel (only with your consent): the cookies on thugqr.com last up to 13 months, or until you withdraw your consent. TikTok keeps the data it has received according to its own privacy policy.

If the law obliges us to keep something for longer (for example, to comply with a court order), we keep it only for as long as that obligation lasts.

18Your rights

As a data subject you have, under Articles 15 to 22 GDPR, the following rights. Most of them you can exercise yourself, immediately, from your account page:

• Access and portability: the “Export data” button in your account downloads, in machine-readable JSON, everything we hold about you: account details, sessions, pending codes and all your dynamic QR codes with their destinations and aggregate statistics.
• Rectification: you change your first name, last name, email and password yourself, at any time.
• Erasure: the “Delete account” button (with your password and a confirmation code sent to your email) permanently deletes the account, sessions, QR codes and their statistics. There is no waiting period or “deactivation”. Only the reserved short links remain, without data, and backups for up to 30 days.
• Restriction of processing and objection (Article 21 GDPR): you can object to any processing based on our legitimate interest, on grounds relating to your particular situation. This includes scan counting; because we keep nothing that identifies you, we cannot find and delete “your” scans afterwards, but we can explain the method and consider your request.
• Withdrawal of consent: where processing is based on consent (currently Google Analytics and the TikTok Pixel), you can withdraw it at any time from the “Cookie settings” link at the bottom of every page, without affecting the lawfulness of the processing before the withdrawal.
• Not to be subject to automated decisions: we take no decision with legal or similarly significant effects on you by automated means, and we do not build profiles.

For anything you cannot do yourself, or if you have no account, write to us at hello@thugqr.com. We answer within one month at the latest, free of charge. To protect your data from third parties, we may ask you to confirm that you control the account’s email address.

If you believe we are breaking the law, you have the right to lodge a complaint with the supervisory authority of your country of residence, of your workplace or of the place of the alleged infringement. The authority competent for us is the Greek Hellenic Data Protection Authority (Kifissias 1‑3, 115 23 Athens, dpa.gr). We would be glad to resolve the matter with you first.

19Children

The generator is a general-purpose tool and is not aimed at children. You can create an account only if you are at least 16 years old; Greek law allows a minor to consent to information society services from 15, but we chose 16 so that the same limit applies across the EU. We do not knowingly collect children’s data. If you believe a child has created an account, write to us and we will delete it.

20Changes to this policy

When we add features that change how data is processed, we first update this page and the date at the top. For material changes affecting account holders, we additionally send an informational email at least 14 days before they take effect. Previous versions are available on request at hello@thugqr.com.