Privacy Policy

QR code generation happens in your browser

The generator processes text, links, Wi-Fi credentials and contact details locally on your device. It does not upload your QR inputs to generate a code, and PNG and SVG downloads are also created in your browser. Our own tool-usage event records exclude those inputs. Website analytics and error diagnostics are separate, as described below.

A QR code is not encryption: anyone who can read the code can decode its contents, including a Wi-Fi password. Sharing a code or a readable photo of it shares the information it contains.

Our own tool-usage events

Only after you accept analytics, the site sends small event records when you select a QR type, generate or download a code, or encounter a generation failure. They help us understand which tools are used and whether they work. Activity before acceptance is not replayed. These first-party records are separate from Google Analytics and contain:

• The event name (generated, downloaded, type selected, failed)
• Which tool was used (e.g. “Wi-Fi QR code”, or the homepage)
• The QR content type (e.g. “wifi”, “url”)
• The download format or a short generation-error code, when applicable
• A server timestamp

These stored event records do not contain your QR content, entered URLs or passwords, IP addresses, cookies or browser identifiers. A necessary preference cookie authorizes these requests; it is not stored in the event records. The counter does not link visitors across sites or use fingerprinting. Requests still reach our server, where IP addresses are processed for abuse prevention as described under technical diagnostics and security.

Google Analytics

When configured and only after you accept analytics, Google Analytics sends visit and usage data to Google, such as pages viewed, referring pages, approximate location, and browser and device information. It uses cookies and browser identifiers to distinguish visits over time. These identifiers can be personal data even without a name or email address, so this is not the same as anonymous aggregate counts. Analytics is off until you explicitly accept; scrolling, typing or closing the preferences window is not acceptance. Use Analytics preferences in the footer to reject analytics later without losing your current QR inputs. This stops new collection and clears pending usage events, but cannot recall requests already sent or in flight, or delete previously collected records. Details are in the Cookie Policy.

Advertising (Google AdSense)

SmallQRCode does not currently display ads. When advertising is enabled, the site uses Google AdSense to show ads. Google is an independent, third-party advertising vendor. To serve ads and measure their performance, Google and its partners set and read cookies (and similar identifiers) in your browser. These are distinct from the analytics cookies described above and are used to deliver ads, limit how often you see the same ad, and detect invalid activity.

Google may use a cookie such as the DoubleClick / ad cookie to serve ads based on your visits to this and other sites. Before enabling advertising, we need to put any required consent controls in place. This policy describes that requirement; it is not itself a consent mechanism. You can review and control how Google personalizes the ads you see at Google Ad Settings, and opt out of personalized advertising from participating vendors at aboutads.info/choices. How Google uses data from sites that use its services is described in Google’s partner-sites policy. The full list of cookies used for advertising is in the Cookie Policy. QR generation remains browser-local; the generator does not include your QR inputs in the tool-usage events it sends.

Contact form

If you contact us through the form, we store your name, email address, chosen topic and message so that we can read and answer it. We use these details to handle your message, not for marketing. Submitting this form is separate from generating a QR code: the information you submit is sent to our server and stored. You can request deletion through the contact form.

Cookies and local storage

Generating and downloading QR codes works without cookies, and the generator does not save your inputs in browser local storage. A necessary cookie named smallqr_analytics remembers your analytics choice for 180 days; it contains a choice, format version and expiry, not a visitor identifier. If the preference cannot be saved or read, analytics stays off. Administrator sign-in uses a separate first-party session cookie that expires after 12 hours. Google Analytics uses cookies after acceptance; future advertising would require separate consent controls. See the Cookie Policy for the full list and how to control them.

Technical diagnostics and security

Minimal browser error reports remain enabled independently of optional analytics to help us investigate faults. Before transmission, reports are limited to a format version, fixed error category, reporting source and coarse page group. They exclude error messages, stack traces, full URLs and paths, query strings, fragments, error digests, QR inputs and visitor identifiers. These requests omit cookies and the page referrer. The server validates those fixed fields again before logging them with its receipt time; invalid or older raw reports are rejected without logging their contents. This change does not erase historical reports or alter independent server and hosting logs. Avoid putting sensitive information in page addresses.

Our server also processes request IP addresses in temporary, in-memory rate-limit records to prevent abuse. These IP addresses are separate from the stored tool-usage event records. Hosting and network services may process technical request data to deliver and protect the website.

Data retention

Tool-usage events and contact messages remain in the site database until deleted by the operator. Marking a contact message as handled does not automatically delete it. Diagnostic reports follow the server log retention settings, and Google Analytics data follows the Analytics property’s retention settings and Google’s policies. Temporary rate-limit records are cleared as inactive entries are removed or the server process restarts. Contact us with questions about retention or to request deletion of information you submitted.

Your rights

Depending on where you live, you may have rights to access, correct or delete personal data, or to object to or restrict its processing. You can make a request, including a request for a copy or deletion of a contact message, through the contact form. We may need enough information to locate the relevant record and verify your request. We will respond in accordance with applicable privacy law. Google’s data practices and external controls are linked in the Cookie Policy.

Children

The site is not directed at children. If you believe a child has provided personal information through the site, please contact us so we can review it and take appropriate action.

Changes to this policy

If the site’s data practices change, this policy will be updated and the effective date above revised. Material changes (such as enabling advertising) will be surfaced clearly on the site.

Contact

Questions about privacy? Reach us via the contact page.