Privacy notice & terms

Signing in

There is no password. You enter an email address and we send a six-digit code to it. Your account is created the first time you use a code, and the same account works for both tools.

We store your email address, the display name you choose, and when you last signed in. Codes themselves are never stored — only a one-way hash of each, which is deleted or marked used as soon as it is redeemed or expires.

What a QR code stores

• The name you give it, its type, and its appearance settings.
• For a static code: the content encoded into the pattern.
• For a dynamic code: the short link it encodes and the destination it currently points at.

Scanning a dynamic code records the time, a coarse device category (mobile, tablet, desktop), and the website the scan came from, if any. It records a salted one-way hash of the IP address so that two scans from the same phone can be told apart — the IP address itself is never stored. No cookie is set when a code is scanned.

Static codes report nothing at all. They are read straight off the paper and never contact a server, so there is genuinely nothing to count.

What a digital visiting card stores

Exactly what you type into the builder: your name, title, company, tagline, location, biography, contact details, social links, services and any optional sections, along with the layout and colours you chose.

Everything shown on a published card is public. Anyone with the link can read it, and search engines are allowed to index it. Fields you switch to “hidden” are stored but not displayed, and are not included in the downloadable contact file.

A draft or unpublished card is not listed anywhere and is served with instructions telling search engines not to index it. Only you can open it.

Uploaded files and images

Files you upload are stored outside the public web folder under a random name, and are only ever handed out through a /f/… link. Nothing in that folder can be reached by guessing a URL, and nothing in it can be executed.

Images are checked against what the bytes actually are rather than what the filename claims. Deleting a file removes it from the server; any code or card pointing at it stops working.

Contacts left on your card

If someone fills in the “exchange contact” form on your card, their name, phone number, email address and message are stored and shown to you in your dashboard. A copy is emailed to the address on your account.

We keep a salted hash of the sender's IP address and their browser's user-agent string for a limited period, purely to rate-limit abuse. Nothing is sent through WhatsApp automatically — a visitor has to tap a WhatsApp link themselves.

Cookies

One cookie, sfqr_session, keeps you signed in. It holds a random token, is marked HttpOnly and Secure, and is not readable by JavaScript. There are no advertising or analytics cookies on the tools, on published cards, or on scanned links.

Published cards load a web font from Google Fonts; that request reaches Google's servers.

Email

Sign-in codes and card enquiry notifications are sent through the Gmail API from the site's own mailbox. Your email address is not shared with anyone, is not added to a mailing list, and is never sold.

Deleting things

• Delete a single QR code, card or file from your dashboard at any time.
• Unpublishing a card takes it offline without deleting it.
• Delete account in the dashboard permanently removes your account, every code, every card, every uploaded file, all scan history and all collected contacts. Short links and card addresses stop working immediately. This cannot be undone.
• You can export everything you have stored here as JSON before deleting it.

Your responsibilities

• Publish only content you own or have permission to use, including logos and photographs.
• Do not publish someone else's personal details without their consent.
• Do not use a card or a code to impersonate another person or organisation.
• Do not point a dynamic code at malware, a phishing page, or anything illegal.

Codes and cards that breach these terms may be unpublished without notice. These tools are provided free and as-is, with no guarantee of availability.

Security

Content is validated on the server, stored using prepared database statements and escaped on output. Uploads are restricted by type and size. Sessions, sign-in codes and IP records are all stored hashed rather than in the clear.

No system is perfect: please do not put confidential information on a public card.

Getting in touch

Questions, or a request to remove something: use the contact page.