What stays on your device, and what reaches us.

Last updated 2026-10-20.

Making a code

The static generators encode in your own browser, inside a background worker. The link, Wi-Fi password, contact details, payment identifier or spreadsheet you type into them is not sent to us and is not kept after you close the tab. This covers the QR and barcode generators, the bulk generator and the label maker.

Reading a code

The scanner decodes an image file or a camera frame in the page itself; the picture is not uploaded, and camera frames are discarded as they are processed. The camera starts only when you press the button and is released when you leave the page.

The scanner also offers an optional destination check. That one is different, and only runs when you ask for it: the web address the code contained is sent to our server, which follows its redirects and reports where it leads. We do not render or return the page content, and a clean result is never proof that a destination is safe. If you would rather nothing left the device, simply do not run the check.

Country suggestions

Phone fields suggest a country. The page asks our own site for it: the hosting layer in front of us already sees the country your connection appears to come from, and we read only that two-letter code back. No third-party lookup service is used, no location permission is requested and no address is stored. If that answer is unavailable, the suggestion falls back to your device's own language setting, and if that says nothing useful the field's plain default stands. A country you choose yourself is never overwritten.

Favourite and recent tools

If you mark a tool as a favourite, or use one, we keep a short list of tool names — for example “Wi-Fi QR code” — in this browser's own storage. Nothing you typed, no web address, no password and no account detail is in that list, it is never sent to us, and the “Clear” button on the tools page removes it immediately. Blocked or full storage simply means the list is not remembered; every tool keeps working.

Accounts, hosted shop pages and the AI builder

Optional Google review-link lookup

When a signed-in owner presses Find shop, we send the entered shop name and city through our server to Google Maps Platform to find the business and its review link. We do not send your sign-in token or email to Google. Search results are shown only for this lookup; we do not keep a database of Google business names, addresses or reviews. A link you choose becomes part of your shop draft and is saved when you save the shop. We keep account-linked request counters to limit usage. Opening a published shop or clicking its saved review link does not perform this lookup. Google's Privacy Policy applies to information sent to Google.

Signing in creates an account record. While you are building a shop, the draft — its name, contact details, menu items, prices and logo — is held in this browser, and once you save it, on our server as well. Publishing puts the page on a web address anyone with the link can open, showing the fields you put on it. Account and saved shop data use our Supabase backend; our website is prepared for hosting on Netlify.

When enabled, the optional AI builder sends the description you submit through our server to OpenAI to draft a plan. Do not include passwords, payment-card details or other sensitive information in that description. The regular generators and manual shop builder do not require this AI service. If the AI service is not configured, you can still build your shop manually.

Visits to hosted pages

For a published shop page we record anonymous counts for the owner: that a page was opened, a menu was viewed or a button was pressed, with a time and a rough per-visit grouping. We do not store raw IP addresses.

A static code is not registered with us and we never learn that it was scanned — but it does contain a web address, and whoever owns that address sees the visit. If you point a static code at one of your own hosted shop pages, scanning it opens that page on our server, and the visit is counted there like any other.

Advertising

The site is free and is intended to be funded by advertising later. This app currently loads no AdSense script and sets no advertising cookie; the ad areas render nothing at all. We cannot tell whether the person running this site holds an advertising account elsewhere — only that nothing of the sort is running in these pages.

What we do not have yet

Threat-intelligence ratings for scanned links and editable redirect rules are not enabled. When they are, this page will describe exactly what is stored, for how long, and who can read it.