DATA PRIVACY & TELEMETRY PROTOCOL

PRIVACY POLICY

Last updated: October 2026 • Applies to all QR/ROUTE customer domains, dynamic redirect engines, and hosted landing pages.

1. SCOPE & OVERVIEW

QR/ROUTE ("the Platform", "we", "us") provides high-performance dynamic QR code routing, short links, and mobile app attribution infrastructure. This policy describes how we collect, process, and protect your information when you register an account, configure routing rules, or when visitors scan your published dynamic QR codes.

2. INFORMATION WE COLLECT & PROCESS

A. Account & Profile Information:When you create an account, we collect your email address and authentication credentials. We support both direct email/password sessions and Firebase Authentication. Passwords are never stored in plaintext and are salted and hashed.

B. Route Configuration & Content:We store the destination URLs you configure (e.g., Google Play Store URLs, Apple App Store URLs, web fallback links), custom slugs, monogram branding letters, and optional base64 logos injected into generated QR codes.

C. Scan Telemetry & Redirection Data:When a user scans a dynamic QR code (`/r/:code`) or accesses a short link (`/go/:code`), our edge redirect engine processes visitor requests to deliver the appropriate operating system destination. We collect:

Client Device Type (iOS, Android, Desktop, or Unknown)
Browser Family and User Agent string
Timestamp of access
Referring URL or installation referrer
Approximate geolocation (country level) derived from IP headers

D. IP Address Privacy Salt:We respect visitor privacy. Visitor IP addresses are immediately run through a one-way cryptographic hash with an internal rotating salt (`IP_SALT`) to detect unique scans without storing raw visitor IP addresses in the database.

3. BILLING & PAYMENT INFORMATION

Paid subscription upgrades (Monthly ₹49, Annual ₹399) are processed via Razorpay (PCI-DSS Level 1 certified gateway). QR/ROUTE never receives, processes, or stores your full credit card number, debit card number, CVV, or banking credentials. We receive only tokenized payment identifiers, transaction confirmation status, and invoice receipt IDs.

4. COOKIES & LOCAL STORAGE USAGE

We employ strictly essential HTTP-only cookies and local browser storage strictly for system security and operational integrity:

auth_token: Secure HTTP-only session cookie maintaining authenticated user state.
qrroute_guest: Cryptographic token linking unauthenticated QR generation sessions to an account upon registration.
qrroute_cookie_consent: LocalStorage item recording your consent preferences.

QR/ROUTE does not use third-party advertising cookies, behavioral tracker pixels, or cross-site tracking scripts.

5. DATA SHARING & THIRD PARTIES

We do not sell, rent, or monetize your personal information or redirect telemetry. Data is shared exclusively with infrastructure providers strictly necessary to operate the service:

Cloud hosting and database infrastructure for secure data persistence.
Razorpay for payment gateway transaction settlement.
Firebase (Google Cloud) for authentication identity verification.

6. SECURITY CONTROLS & PROTECTION

We enforce multi-layered defense mechanisms, including HTTPS encryption in transit, strict HSTS, rate-limiting on authentication and redirection endpoints, tenant isolation, and hashed IP aggregation.

7. INQUIRIES & CONTACT

If you have inquiries regarding this Privacy Policy or wish to request data account deletion, contact our administrative team at: support@qrroute.io