Privacy policy

NeverExpireQR (neverexpireqr.com) is operated by NeverExpireQR, based in Pakistan. For anything about your data, write to hello@neverexpireqr.com.

Static QR codes (web address, text, WiFi, vCard, email, phone) are built in your browser. What you type, including WiFi passwords and contact details, is not sent to our servers. A static code contains its content directly, so nothing passes through us when it is scanned and we cannot count or see those scans.

We store what is needed to run your account:

• Your email address. If you sign in with Google, Google tells us your email address and confirms it is yours. We do not receive your Google password.
• Your dynamic codes: their names, destinations, folders, design settings, any logo you add to a design, and any PDF you upload.
• Your plan and, if you pay, the identifiers that link your account to your subscription. We never see or store your card details.
• Your email preferences, such as whether you want the weekly scan summary.

A scan passes through our short link (q.neverexpireqr.com) so we can redirect it. For each scan we record:

• the time;
• the country and city, as estimated by our network provider;
• the type of device, the operating system and the browser.

We do not store the IP address. To count unique scans we compute a one-way code from the IP address, the browser details and a secret that is mixed with the date. It cannot be turned back into an IP address and it changes every day, so it cannot be used to follow a person from one day to the next. Visits from bots and link previews are not counted.

The owner of the code sees these statistics. They cannot see who scanned.

We use only the cookies needed to keep you signed in. We do not use advertising cookies or third-party analytics. Our network provider, Cloudflare, may set a short-lived security cookie to tell people from bots. If you pay, the checkout is run by Paddle and uses its own cookies.

To keep our short links from being used for phishing or malware, the destination address of each dynamic code is checked against Google Web Risk when it is saved, and again from time to time. Only the address is sent.

If you report a code, we store the report and, if you give one, your email address so we can follow up.

To limit abuse we count some actions, such as sign-in emails and reports, per network address. The address is scrambled with a secret before it is used and the counts are deleted within two days.

• Cloudflare (United States): hosting, the redirect service and network security.
• Supabase: the database, sign-in and file storage.
• Resend: sending email, such as sign-in links and the weekly summary.
• Google: sign-in with Google, and Web Risk safety checks of destination addresses.
• Paddle: payments. Paddle is the seller of record for paid plans and handles card details, invoices and sales tax under its own privacy policy.
• Sentry: error reports, used to find and fix faults. These contain technical details of the error, not the content of your codes.

These companies may process data outside your country. We do not sell personal data to anyone.

• Account data: until you delete your account.
• Dynamic codes, uploaded PDFs and their scan statistics: until you delete the code or your account.
• Abuse reports and records of codes disabled for abuse: for as long as needed to prevent the abuse from recurring.
• Payment records: kept by Paddle as the law requires.

• Delete everything: use “Delete account” on your account page. This removes your account, codes, uploaded files and scan statistics. Deleted dynamic codes stop redirecting.
• Export: scan data can be exported as CSV on paid plans. For a copy of anything else we hold about you, email us.
• Emails: turn the weekly summary off on your account page or with the link at the bottom of the email. We still send messages needed to run your account, such as sign-in links.
• Access, correction and objection: depending on where you live, the law may give you further rights over your data. Email us and we will respond within 30 days.

NeverExpireQR is a business tool and is not meant for children under 16. We do not knowingly collect their data.

If we change this policy in a way that matters, we will update the date at the top and tell account holders by email.

Questions? Write to hello@neverexpireqr.com.