Privacy Policy

myQR is a contact-exchange product. Your card lives at a public URL (myqr.com/your-handle), people scan or open the link, and they save you to their contacts. This page explains what we collect to make that work, how we use it, and the choices you have.

What we collect

Your account. Email and password (stored as a hash, never in clear text), and the name you used to sign up.

Your card. The handle you claim, the display name and bio you write, the photo you upload, the contact fields you add (email, phone, website, address, company, etc.), and the social / web links you add (Instagram, X, LinkedIn, GitHub, custom URLs, and so on). You decide what goes on the card and which visibility level applies to each piece.

Your QR codes. Every account has at least one QR code that points at your card. You can rotate or revoke a code at any time; the URL it encoded then stops working.

Your connections. When someone scans or opens your card and saves you (or you save them), we record a connection row with the snapshot of contact details visible at that moment, plus any note, met-location, or tags you add. The other party sees the snapshot of you that was visible to them at the time.

Anonymous activity signals.When a card is viewed, scanned, or a link is tapped, we record a coarse, IP-fingerprinted event so the owner can see "views" / "scans" / "most-tapped link" on their own dashboard. The IP is hashed for short-window deduplication only; we do not store raw IP addresses, do not link these events to a visitor identity, and do not track visitors across other websites.

How we use it

To render your public card to the people you share it with, to attribute a view or scan to the QR code that produced it, to process connection requests and notify both sides, to show you accurate counts on your own dashboard, and to keep your account secure.

We do not sell your data, run advertising against it, or share it with third parties for marketing. We do not enrich a profile of you for an external data broker. The product makes money (or will) by offering you paid features, never by reselling you.

Sharing

Your card is the deliverable, so by design the parts of it you choose to make visible are visible to anyone who has the link or scans the code. That is the product. Everything else — your email and password, your connections list, your private/unlisted fields, your analytics — stays with you.

We use a small number of vendors to operate the service (database hosting at Neon, web hosting at Vercel, email and authentication infrastructure). They process data on our behalf under contracts that constrain their use of it.

Visibility you control

Three card-level visibility states.Public (search engines may index it), unlisted (the link works for people who have it, but not indexed), private (only you see the card; anyone else gets a generic "not available"). You can change this at any time from the card editor or Settings.

Per-field and per-link visibility.Each contact field and each social link has its own visibility toggle. A hidden field is hidden everywhere — on the rendered card, in the downloadable vCard, in the social-share preview, and in the snapshot a saved-contact gets. The visibility check runs on our servers before any of that data is sent to the visitor.

QR codes are revocable. Rotate or revoke a code and the URL it encoded stops working immediately. Old printed copies still scan to whatever your active code now points at, so you do not have to reprint anything.

Retention and deletion

We keep your account data while your account is active. You can delete your account from Settings; deletion removes your card, your fields, your links, your QR codes, your notifications, and your half of any connection rows. The other person's saved snapshot of you remains in their contacts because it was already copied at save time — we cannot reach into someone else's contact list and remove it.

Anonymous activity events (views, scans, link taps) that cannot be linked back to you are retained for product analytics in aggregated form.

Your rights

You can see, edit, or remove anything on your card at any time. You can change your handle (subject to a short cooldown to keep URLs stable), rotate your QR, change your visibility, and delete your account. If your local law (GDPR, CCPA, and equivalents) gives you additional rights — export, correction, complaint to a regulator — you can exercise them by writing to us.

Cookies and similar tech

We use a small number of cookies that are strictly necessary to keep you signed in and to remember your preferences (theme, language). We do not use third-party advertising cookies or cross-site trackers.

Children

myQR is not directed to children under 13 (or the equivalent age under your local law). If we learn that we have inadvertently collected information from a child below that age, we will delete it.

Where we operate

The service is hosted on US infrastructure. If you access it from outside the US, your data is transferred and processed in the US under the safeguards our vendors and we put in place.

Changes

We will update this page when our practices change. Material changes will be surfaced in-product the next time you sign in.

Contact

Questions about privacy, or a request about your data? Write to privacy@myqr.com.