Privacy policy
The short version: what you type into a QR code never reaches us, because there is no server here to receive it.
Last updated 14 August 2026
What you put into a QR code
Nothing you enter into any generator on this site is sent to us. Links, Wi-Fi network names and passwords, contact details, phone numbers, message text, calendar events, coordinates, uploaded logos and uploaded CSV files are all processed by JavaScript running in your browser, on your device.
This is not a policy commitment we could quietly change — it is how the site is built. These pages are static files served from a CDN. There is no application server, no database, and no endpoint that accepts data. You can confirm it by opening your browser’s developer tools, switching to the Network tab, and generating a code: no request is made, because there is nowhere for one to go.
The same applies to the scanner: images you decode are read from your disk and processed locally. Camera frames, if you use that option, are analyzed in memory and never recorded or transmitted.
What is stored on your device
The generator saves a few display preferences in your browser’s local storage so the tool looks the way you left it: your last chosen colors, output size, error correction level, quiet zone and module shapes.
QR content is never saved — no links, passwords, messages, contact details or uploaded files. A shared or borrowed computer should not hand the next person the last Wi-Fi password somebody generated a code for. You can clear these preferences at any time by clearing site data in your browser.
Analytics
We use Google Analytics 4 to understand which pages people find useful and where the site is confusing. It records ordinary web analytics — pages viewed, approximate location derived from IP address, device and browser type, and referring site — along with a small number of events recording that something happened: a code was generated, a download was taken, a tab was switched.
Those events carry the type of code and the export format. They never carry the content. The site’s analytics code uses an explicit allow-list of permitted fields, enforced both when the code is compiled and again before any event is sent, and there is an automated test whose only job is to prove that payload-shaped data cannot get through.
Google acts as a data processor for this analytics data. Their handling is governed by Google’s privacy policy. You can opt out across all sites with the Google Analytics opt-out add-on.
Advertising
This site is free and is supported by advertising. We intend to use Google AdSense; at the time of writing it is not yet running, and this section describes what happens once it is.
Google and its partners may use cookies or similar technologies to serve ads and measure their performance, and may personalize ads based on prior visits to this and other sites. Ad content, targeting and measurement are handled by Google — we choose where ad slots appear and nothing else. We never pass Google anything you typed into a QR code, for the same reason we pass it to nobody: we do not have it.
You can control ad personalization in Google’s My Ad Center.
Cookies and consent
The site itself sets no cookies. Google Analytics and, once enabled, Google AdSense may set cookies on your device.
Consent is handled with Google Consent Mode. In the European Economic Area, the United Kingdom and Switzerland, analytics and advertising storage both start in a denied state, so no such cookies are set until consent is given through a Google-certified consent banner. Outside those regions the default is permissive, in line with local practice.
Third-party services
| Service | Purpose | What it can see |
|---|---|---|
| Cloudflare | Hosting and content delivery | Standard server request data, including IP address, for delivering pages and blocking abuse |
| Google Analytics 4 | Usage statistics | Page views and anonymous interaction events |
| Google AdSense (planned) | Advertising | Ad serving and measurement data |
No other third-party scripts run on this site. There are no social media widgets, embedded videos, chat tools, session recorders or heatmaps.
Data retention
We hold no personal data ourselves, so there is nothing for us to retain, export or delete on request. Analytics data is retained according to the property’s Google Analytics settings. Hosting request logs are retained by Cloudflare under their own policies.
Children
This site is a general-purpose utility, is not directed at children, and does not knowingly collect information from them.
Changes
If this policy changes, the date at the top of the page changes with it. Material changes — a new third-party service, a new category of data — will be described here rather than quietly folded in.
Contact
Questions about any of this: support@plainqrcodes.com.