QR Protector privacy policy

We use account and requested checking information to provide the service you request, on the basis of performing our contract with you. We rely on legitimate interests for proportionate service security, abuse prevention, reliable operation and handling support requests.

Where billing, accounting or other records must be kept by law, the basis is compliance with that legal obligation. Choosing to submit a website controls which request is made; it does not make every service or security record consent-based.

The camera or a picture you select is decoded on your device. That source picture is not uploaded for website analysis. Non-web codes, such as contact details, Wi-Fi settings, messages and authenticator details, are interpreted locally rather than sent to the website-checking providers.

Saved scan history is a limited local summary, not a copy of every piece of evidence in the live result. Website history removes the URL path, query and fragment; sensitive non-web values are replaced with redacted or category-only summaries. Optional saved destination screenshots are held in the app's private device storage. Clearing the app's history does not delete an original picture from your own photo library.

A full website address can itself contain personal information, including information in its path or query. Before the first website check covered by the current disclosure version, the app names the backend and providers and asks you to accept that disclosure. Choosing Not now leaves the website unsubmitted.

The backend follows redirects, visits the destination and compares desktop, phone and tablet evidence. Google Web Risk checks addresses, rdap.org supplies domain-registration information, and destination sites receive the backend's visits. Screenshot Machine renders destination pages; Google Cloud Vision analyses the rendered images. Where AI assessment is used, Google's Vertex AI receives images and bounded URL, redirect, page, threat, certificate and domain evidence. Those services see the submitted or observed destination information needed for their part of the check.

These are images of the destination website, rather than photographs from your camera. The current complete website-checking path uses screenshot and visual evidence across scan allowances; those checks are not described here as a premium-only feature. Provider processing and retention are governed by their applicable service terms, so we do not promise that a provider deletes all its records when a scan response arrives.

The app starts with a Firebase guest identity. If you link or use an email, Google or Apple sign-in, Firebase Authentication processes the associated account details. An installation identifier and device label can be associated with your account to manage devices and prevent abuse.

Firebase App Check and its platform attestation provider help establish that requests come from an allowed app. The backend keeps allowance, entitlement and operational records, including pseudonymous identifiers, outcome categories, timings and provider-use counts. These support access control, reliable processing and cost limits; the scan cost ledger does not retain the raw website address.

If store purchases are enabled in a release, Apple or Google handles payment details. Our backend verifies the store proof and retains the purchase references and status needed to provide and restore the entitlement. The current pre-release status is not an offer of a publicly available subscription.

Local scan history has a 30-day age limit and a selected count limit. Expired or excess entries are filtered when history is loaded; physical row and screenshot cleanup is best effort rather than an exact-time background deletion promise. You can clear history or remove individual entries in the app.

Settings includes Delete Account. It calls the authenticated deletion service, removes the known mutable account, device, scan-usage and purchase records, and deletes the Firebase identity. The app also clears its own local data. A partial failure is reported so cleanup can be retried. A limited pseudonymous deletion barrier is retained to prevent a late purchase callback recreating a deleted account.

You can also contact us using the details on this page if you cannot use the app or need another privacy request handled. We may need to verify ownership. Account deletion does not cancel a store subscription: cancellation is managed through the store account. Provider security, billing and support records may have separate retention requirements.

Google Firebase and Cloud Run provide authentication, storage of service records and backend processing. The checking providers are named above; support correspondence is handled through our support email service. Processing can take place outside the UK. Contact us for information about the safeguards relevant to a particular provider or request.

You can choose not to submit a website, clear local history, manage linked devices and delete the account. You can ask us to provide, correct, delete or restrict your personal information, object where applicable, or provide it in a portable form. We will respond to a data-protection request within the applicable statutory period, normally one month. You can complain to the Information Commissioner's Office.

Google Firebase privacy and security

Contact the UK Information Commissioner's Office