Privacy Policy

Last updated: October 30, 2026

QR Code Fairy is a product of HyperDirect, LLC (“HyperDirect,” “we,” or “us”). This policy explains how QR Code Fairy handles information when you use the generator, create an account, save QR codes, or use optional Google Analytics.

QR generation and uploaded logos

Ordinary QR generation, customization, previewing, and downloading run in your browser. Simply creating or customizing a QR code does not send the text, URLs, contact details, Wi-Fi credentials, uploaded logos, or QR styling choices you enter to our server or to Google Analytics.

Unless you choose to save a QR code to your account, QR entries are held temporarily in browser memory and are not saved by our application to an application database. A normal reload resets the generator. Files you download remain on your device until you delete them.

Signing in or creating an account does not by itself upload the QR code currently in the generator. QR content is transmitted to our server when you explicitly choose to save it as described below.

A QR code is not encrypted merely because its saved definition is protected by QR Code Fairy. Anyone with the generated QR image may be able to read its encoded contents. Scanning a code can open another website or application, whose privacy practices apply separately.

Saved QR codes

If you have an account, you can choose to save QR codes to your account. Saving is optional and is not required to generate or download QR codes.

When you choose to save a QR code, we receive and retain the information necessary to recreate and edit that QR code. Depending on the type of QR code you create, this may include URLs, text, email or SMS content, phone numbers, contact or vCard information, Wi-Fi network information and passwords, QR appearance and export settings, an optional custom name, and an optional uploaded logo. We save only the validated fields for the active QR type, not entries from inactive generator tabs or a separate duplicate of the encoded QR payload. A retained logo is normalized to a 512-by-512 PNG, and the original uploaded file is not retained.

Because QR codes can contain arbitrary information, you should treat information you choose to save as information you are intentionally storing with QR Code Fairy.

Saved QR content, custom names, and retained logos are protected using application-level authenticated encryption while stored. We decrypt this information when necessary to provide saved-code features to the authenticated account owner. Encryption helps protect stored information but does not make a generated QR image itself encrypted or prevent someone who possesses the QR image from reading its contents.

Saved QR codes are available through the service to the authenticated account that saved them and, only when the account holder specifically authorizes it, temporarily to authorized support personnel as described in the Customer Support section below. We do not create public URLs for saved QR definitions or retained logos.

Saved QR codes remain static QR codes. Saving a QR code does not add scan tracking or analytics. QR Code Fairy does not use saved QR content to monitor scans, visit or validate encoded destinations, or determine whether an encoded destination remains available.

We do not sell saved QR definitions or use their contents for advertising.

Saving before signing in

If you choose Save Generation while you are not signed in, QR Code Fairy temporarily retains the pending QR information in your current browser tab so that your requested save can continue after you sign in or create an account.

This temporary information is used only to continue the save you requested. It is removed after the save is successfully completed and is rejected after a maximum of 30 minutes. Closing the applicable browser tab or session may remove it sooner.

The pending QR information is not sent through Google or Microsoft as part of their authentication process.

Accounts and authentication

An account is not required to generate, customize, preview, or download QR codes. An account is required to use account features such as Saved QR Codes.

When you create or use an account, we process information needed to provide and secure it. Depending on how you sign in, this may include your email address, account identifiers, authentication-provider information, verification status, session information, and security or abuse-prevention records.

Database session records may include your IP address and user-agent information describing your browser or device. We use this information for account security, abuse prevention, and investigation of suspicious activity; it is not required to validate your session.

If you create an account using an email address and password, your password is not stored in plaintext. It is securely hashed for authentication.

We use Cloudflare Turnstile for email-and-password registration to help prevent spam, automated registrations, and abuse. When you access or complete the registration security check, Cloudflare may process technical information, including your IP address, browser and device characteristics, interaction data, and the website hostname, to evaluate whether the registration attempt is legitimate. QR Code Fairy processes the resulting security-verification token and result to protect registration.

Turnstile is not required for anonymous QR code generation and is not currently required for normal login, Google or Microsoft authentication, or other account operations. Cloudflare processes information under its applicable privacy terms; see the Cloudflare Privacy Policy.

If you enable authenticator-app multi-factor authentication, we store the authenticator credential using authenticated encryption and store recovery codes only as one-way verifiers. We also retain limited security-event records, such as when multi-factor authentication is enabled, disabled, recovered, throttled, or used for administrative elevation. These records do not contain authenticator secrets, submitted codes, enrollment QR payloads, or recovery-code plaintext.

If you choose to sign in with Google or Microsoft, those providers authenticate you and provide QR Code Fairy with information needed to establish or identify your account, such as your email address, verification status where available, and a stable provider account identifier. QR Code Fairy does not retain the provider profile name or image. The authentication process may use provider tokens temporarily, but QR Code Fairy does not retain Google or Microsoft OAuth access tokens, refresh tokens, or ID tokens as part of the linked account record. Your use of Google or Microsoft authentication is also subject to the privacy practices of the applicable provider.

Google and Microsoft identities are linked to an existing QR Code Fairy account only through an explicit linking action, not merely because an email address matches. Removing a Google or Microsoft connection, or deleting your QR Code Fairy account, removes QR Code Fairy's internal connection to that identity but does not delete your external Google or Microsoft account.

We use Microsoft and Microsoft Graph infrastructure to send transactional account messages such as email-verification and password-reset emails. We provide Microsoft with the recipient email address and message contents as necessary to deliver the message. Microsoft may retain operational or delivery information under its own applicable practices.

We use essential authentication and session technologies to keep you signed in, protect accounts, and provide private account features. These are necessary for requested account functionality and are separate from your choice about optional Google Analytics.

We use aggregate account counts and account-creation periods to understand adoption and service growth. These aggregate reports do not contain QR content or individual browsing or activity histories.

Customer support

If you create a support ticket, we receive and store the subject, category, messages, ticket status, and related account and security records needed to respond to your request, protect the support system, and maintain an appropriate history of the conversation. Support notifications sent by email identify the ticket but do not include the ticket conversation or saved QR contents.

Most support requests do not require access to saved QR information. When it is reasonably necessary to investigate an issue, QR Code Fairy Support may separately ask you to authorize temporary access to one specific saved QR record or, when broader access is necessary, your saved QR collection. You may approve or decline the request, and you may revoke an active authorization. An authorization expires automatically after no more than seven days and becomes unusable when the ticket is closed or resolved.

Saved QR data remains encrypted at rest, and QR Code Fairy Support does not routinely access saved QR contents. The support authorization is an application-enforced administrative access control; it does not itself provide an encryption key and does not mean that an open support ticket automatically permits access. When you approve a request, authorized support personnel may inspect an eligible saved QR individually through the support ticket while the authorization remains active. This administrative access is subject to additional account-security controls and is logged. Uploaded logo images are not made available through this support workflow.

Optional Google Analytics

On production pages where analytics is enabled, we ask before loading Google Analytics. Rejecting analytics does not prevent you from using the generator or account features.

If you allow it, Google receives page-visit information, identifiers used by Google Analytics to distinguish browsers and sessions, and technical information about your browser and device. Connecting to Google also exposes your IP address to Google as part of the network request. According to Google's documentation, Google Analytics uses IP addresses during collection, including to derive approximate location information, and discards the IP address before Analytics data is logged.

We use analytics to understand aggregate website usage, engagement, and whether visitors return to the service.

We send fixed page labels rather than arbitrary page paths, query strings, fragments, or referring-page URLs. We do not send QR content, QR-generation events, download details, saved QR definitions, account identifiers, custom QR names, uploaded logos, or form values to Google Analytics. Advertising personalization and Google signals are disabled in our tag configuration.

We do not sell your QR content or personal information for money. We do not provide your QR content for advertising.

Google Analytics is not loaded on the Privacy Policy or Terms of Service pages. Login, logout, registration, password-reset, account, user-dashboard, Saved QR Code, and other private pages are also excluded from analytics.

Read Google's information about how it uses information from sites or apps that use its services and Google Privacy Policy for more information about Google's processing practices, including international processing and safeguards.

Aggregate visit count

QR Code Fairy keeps an approximate monthly total of browser visits to understand overall site usage. This counter is separate from optional Google Analytics and does not depend on your Analytics choice. It does not attempt to identify unique visitors.

For this counter, we retain only the calendar month and its total visit count. We do not retain IP addresses, device identifiers, location information, page-view histories, QR code contents, account identifiers, persistent visitor identifiers, or individual visit times or records. A session-only browser flag records whether the current browser tab has already been counted, helping avoid repeated counts from navigation or reloads.

Aggregate monthly visit totals may be retained indefinitely for historical reporting. These totals contain only the reporting month and aggregate count, not individual visit records.

Referral promotion

After a visitor who is not signed in downloads a URL-type QR code, QR Code Fairy may display a referral promotion for UptimeRobot in a reserved promotional area. Signed-in users are not shown this promotion. Displaying it is based only on successful URL-type downloads in the current browser-tab session. We store a session-only boolean indicating that the promotion has already appeared so it is not shown repeatedly; we do not store the QR destination or download count, and we do not send the QR destination, QR settings, or download details to UptimeRobot.

The UptimeRobot destination is a referral link, not an affiliate link. QR Code Fairy does not receive a direct monetary commission, but UptimeRobot may provide QR Code Fairy with non-cash rewards based on resulting referrals. The promotion is labeled accordingly.

UptimeRobot receives information only if you choose to open its link. The link opens UptimeRobot directly with a static referral identifier. QR Code Fairy configures the link not to send the referring page. UptimeRobot may then process ordinary network and request information, such as your IP address and browser information, under its own privacy practices. No QR content is included in the referral URL.

Cookies and browser storage

We save your analytics choice as accepted or rejected in browser storage so that QR Code Fairy can remember your preference. This preference remains until you change it or clear site data.

When you accept analytics, Google Analytics can set first-party cookies such as _ga and related Analytics cookies to distinguish browsers and sessions. Our tag requests a 180-day cookie lifetime; browser restrictions and Google behavior may affect actual expiry. Cookie expiry is separate from Analytics data retention.

We configure Google Analytics to retain user-level and event-level data for 14 months, with user-data retention not reset by new activity. These settings do not control the retention of most standard Analytics reports, which are based on aggregated data.

You can change your analytics choice from the privacy settings on the generator page. Rejecting analytics stops further collection by our tag and attempts to remove its first-party Analytics cookies. It does not erase reports already collected. You can also clear cookies and site storage through your browser or use Google's Analytics opt-out browser add-on.

QR Code Fairy also uses browser storage when necessary for requested functionality, including authentication, the temporary pending-save process described above, the session-only referral-promotion flag, and the session-only aggregate-visit-counted flag described above.

Website delivery, security, and service providers

Like other websites, our hosting infrastructure processes ordinary website requests. This may include your IP address, requested resources, browser and device information, referrer information, and timestamps. This information may be retained in access, error, or security logs as reasonably necessary to deliver, maintain, troubleshoot, and protect the service.

We also process limited security and abuse-prevention information to protect accounts and application functionality from unauthorized or excessive use.

We use third-party service providers where necessary to operate parts of the service, including infrastructure hosting, database hosting, backups, authentication, registration security, analytics, and transactional email delivery.

Cloudflare provides registration security and automated-abuse prevention through Turnstile. Google provides optional Google Analytics and, when selected by the user, Google account authentication. Microsoft provides Microsoft account authentication and transactional email infrastructure. These providers may process information on our behalf or as otherwise described in their own privacy documentation when you interact with their services.

Our hosting and infrastructure providers may process information stored by or transmitted through the service as necessary to provide hosting, database, backup, security, and related infrastructure services.

Service providers do not receive QR content merely because you generate a QR code in your browser. Cloudflare Turnstile and Google or Microsoft authentication do not receive your QR payload as part of registration or authentication.

Retention and deletion

QR content that you do not choose to save is not retained in QR Code Fairy's application database.

Saved QR codes are retained until you delete them or delete the account that owns them. When you delete a saved QR code, its active saved definition and associated retained logo are deleted from the active service. Deleting your account deletes the account's active saved QR definitions and retained logos along with account data that is no longer required.

Our database infrastructure automatically creates backups for service reliability and recovery. These backups may temporarily contain copies of information that has subsequently been deleted from the active service. Under our current infrastructure, database backups and point-in-time recovery data are retained for up to seven days. Information deleted from the active service may therefore remain in backups until the applicable backup data expires.

Authentication sessions are retained while active and ordinarily expire after seven days, subject to renewal during use or earlier invalidation. Verification and password-reset records and temporary abuse-prevention records are retained only as needed for their respective purposes. Expired or unneeded records are removed through regular maintenance and ordinarily no later than 24 hours after they expire or are no longer needed.

Active multi-factor credentials and unused recovery-code verifiers are retained until you disable multi-factor authentication or delete your account. Limited multi-factor security-event records are ordinarily retained for 90 days. Expired administrative-elevation records and multi-factor rate-limit records are removed through regular maintenance.

Google Analytics information is retained as described in the Optional Google Analytics and Cookies and Browser Storage sections.

If you contact us, we retain correspondence for as long as reasonably necessary to respond to your request, maintain appropriate business records, resolve disputes, enforce agreements, and comply with applicable obligations.

Support tickets, their append-only messages, protected-data authorization history, and related support audit records are currently retained with the account while we establish a formal support-record retention period. Authorization expiration is separate from retention: expired, declined, revoked, closed-ticket, and resolved-ticket authorizations remain unusable even while their history is retained.

Some information may be retained longer where reasonably necessary for security, fraud prevention, legal compliance, dispute resolution, or enforcement of our agreements.

Children's privacy

QR Code Fairy is not directed to children under 13, and children under 13 may not create or maintain an account. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe a child under 13 has provided personal information to QR Code Fairy, contact us at [email protected] so we can investigate and take appropriate action, including deletion where required.

Your choices and privacy rights

You can generate and download QR codes without creating an account.

If you have an account, you can manage and delete individual saved QR codes through the service. You may also request deletion of your account and associated information.

You can withdraw Google Analytics consent using the privacy settings on the generator page. Withdrawal stops future collection by our Analytics tag but does not undo processing that already occurred.

Depending on where you live, applicable law may give you rights concerning your personal information, such as rights to access, correct, or delete information or to object to or restrict certain processing. You may also have the right to complain to an applicable privacy regulator.

Contact [email protected] to make a privacy request. We may need information to verify your identity and locate the relevant records.

Contact us

For privacy questions or requests:

HyperDirect, LLC
PO Box 77
Marshfield, MA 02050-0077
[email protected]

Changes to this policy

We will update this policy when the service or its data practices change and revise the "Last updated" date above. Materially different optional processing will be presented before it begins where appropriate.