Privacy Policy

myQR is a contact-exchange product. Your card lives at a public URL (myqr.com/your-handle), people scan or open the link, and they save you to their contacts. This page explains what we collect to make that work, how we use it, and the choices you have.

What we collect

Your account. Email and password (stored as a hash, never in clear text), and the name you used to sign up.

Your card. The handle you claim, the display name and bio you write, the photo you upload, the contact fields you add (email, phone, website, address, company, etc.), and the social / web links you add (Instagram, X, LinkedIn, GitHub, custom URLs, and so on). You choose what stays on the card and whether shown links appear before or after a connection.

Your QR codes. Every account has at least one QR code that points at your card. You can rotate or revoke a code at any time; the old code then stops counting scans and stops connecting people instantly, and your card stays reachable at its own address.

Your connections. When someone scans or opens your card and saves you (or you save them), we record a connection row with the snapshot of contact details visible at that moment, plus any note, met-location, or tags you add. The other party sees the snapshot of you that was visible to them at the time.

Anonymous activity signals. When a card is viewed, scanned, or a link is tapped, we record a coarse, IP-fingerprinted event so the owner can see "views" / "scans" / "most-tapped link" on their own dashboard. The IP is hashed for short-window deduplication only; we do not store raw IP addresses, do not link these events to a visitor identity, and do not track visitors across other websites.

How we use it

To render your public card to the people you share it with, to attribute a view or scan to the QR code that produced it, to process connection requests and notify both sides, to show you accurate counts on your own dashboard, and to keep your account secure.

We do not sell your data, run advertising against it, or share it with third parties for marketing. We do not enrich a profile of you for an external data broker. The product makes money (or will) by offering you paid features, never by reselling you.

Sharing

Your card is the deliverable. On an active card, your name, photo, bio, and handle identify you to anyone who opens the link. Links appear before connecting only when you turn on public links. Contact details, birthday, and the downloadable vCard require a connection. Your account email and password, connections list, hidden card items, and analytics stay with you.

We use a small number of vendors to operate the service (database hosting at Neon, web hosting at Vercel, email and authentication infrastructure). They process data on our behalf under contracts that constrain their use of it.

Visibility you control

Public links on or off. When public links are on, every link you have chosen to show is visible before a visitor connects, and search engines may index the card. When public links are off, the card still works from its link or QR, stays out of search, and holds links until a connection.

Contact details require a connection. Phone, email, address, birthday, and the downloadable vCard are never part of the public layer. They are withheld until the visitor connects and are still subject to the individual sharing choices you make.

Each card item still has its own switch. A hidden field or link is hidden everywhere — on the rendered card, in the downloadable vCard, in the social-share preview, and in the snapshot a saved contact gets. The visibility check runs on our servers before any of that data is sent to the visitor.

You can pause the whole card. Pausing turns off the public link and QR for everyone but you. Resuming makes the card reachable again with public links off by default.

QR codes are revocable. Rotate or revoke a code and it immediately stops counting scans and stops connecting people instantly. Old printed copies still open your card, so you do not have to reprint anything — but rotating a code does not take back anything you have already shared.

Retention and deletion

We keep your account data while your account is active. You can delete your account from Settings; deletion removes your card, your fields, your links, your QR codes, your notifications, and your half of any connection rows. The other person's saved snapshot of you remains in their contacts because it was already copied at save time — we cannot reach into someone else's contact list and remove it.

Anonymous activity events (views, scans, link taps) that cannot be linked back to you are retained for product analytics in aggregated form.

Your rights

You can see, edit, or remove anything on your card at any time. You can change your handle (subject to a short cooldown to keep URLs stable), rotate your QR, change when links appear, pause your card, and delete your account. If your local law (GDPR, CCPA, and equivalents) gives you additional rights — export, correction, complaint to a regulator — you can exercise them by writing to us.

Cookies and similar tech

We use a small number of cookies that are strictly necessary to keep you signed in and to remember your preferences (theme, language). We do not use third-party advertising cookies or cross-site trackers.

Children

myQR is not directed to children under 13 (or the equivalent age under your local law). If we learn that we have inadvertently collected information from a child below that age, we will delete it.

Where we operate

The service is hosted on US infrastructure. If you access it from outside the US, your data is transferred and processed in the US under the safeguards our vendors and we put in place.

Changes

We will update this page when our practices change. Material changes will be surfaced in-product the next time you sign in.

Contact

Questions about privacy, or a request about your data? Write to privacy@myqr.com.