Privacy Policy
Last updated: September 28, 2026
QrBro is operated by Webkraft Studio LLC, registered in Delaware. This policy explains what data we collect, why we collect it, who can access it, and how you can control it.
1. What we collect
Account information: email address, password (securely hashed, never stored in plain text), and your name if you sign in with Google.
QR code data: code names, destination URLs, and creation dates.
Scan data: when someone scans your QR code, we collect non-personally identifiable usage data such as approximate location, device type, and timestamp to display in your analytics dashboard.
Website usage data: when you visit qrbro.com, including our public pages, sign-in pages, and your dashboard, we record aggregate page statistics: the page you viewed, the referring site, your browser, operating system, device type, and your country, region, and city. Your location is worked out from your IP address, but the IP address itself is not stored. This data is not linked to your account and cannot identify you. See section 3 for details.
We do not collect payment card numbers (handled by our billing provider), precise GPS coordinates, or browsing history outside of QrBro.
2. How we use your data
We use your data to operate the service. We do not sell your data, serve ads, share data with advertisers, or track you across other websites.
3. Third-party services
We share data with third-party service providers only when necessary to operate QrBro. This includes infrastructure providers for security and content delivery, a payment processor for billing, a cookieless analytics provider for website statistics, and Google for optional sign-in. We do not share your data with advertisers or data brokers.
Website analytics (Plausible): we use Plausible Analytics, provided by Plausible Insights OÜ, a company based in Estonia, to understand which pages on qrbro.com are used so we can improve the site. Data is hosted in the EU. Plausible sets no cookies and does not use local storage or any other persistent identifier. It does not collect or store personal data such as IP addresses. Unique visitors are counted using a hash that changes every day and cannot be linked across days or across websites. We only see aggregate statistics, never individual visitors. Plausible processes this data on our behalf as a processor. We do not sell or share it. Our legal basis is our legitimate interest in understanding how the site is used (GDPR Article 6(1)(f)).
3a. Google user data
When you connect Google Forms to QrBro, we request read-only access to your Google Forms data (form structure and responses) through Google's API. This connection is optional and initiated only when you explicitly choose to connect.
What we access: Form titles, question structure, and submission responses for forms you own.
How we use it: To display your form responses and submission counts alongside your QR code scan analytics within your QrBro dashboard. This data is only visible to you.
Storage: Form response data is not stored in our database. It is fetched from Google on demand and displayed in your dashboard. OAuth tokens are encrypted at rest.
Sharing: We do not share, sell, or transfer your Google Forms data to any third party. We do not use Google user data for advertising, analytics, AI model training, credit assessment, or any purpose other than providing the QrBro service to you.
Disconnecting: You can disconnect Google Forms at any time from your dashboard settings. This immediately revokes our access and deletes stored tokens.
Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.
4. Cookies
QrBro uses only functional cookies required to operate the service, such as keeping you logged in and remembering your display preferences. We do not use tracking, advertising, or third-party analytics cookies. We do measure website usage, but with a cookieless analytics tool that stores nothing on your device. See "Website analytics" in section 3.
5. Data retention
Scan data is retained based on your plan tier and permanently deleted after the retention window. Account data is retained for as long as your account exists. If you delete your account, all associated data is removed within 30 days.
6. Your rights
You can export or delete your data from your dashboard settings at any time. If you need help, email us at [email protected].
7. Security
We implement appropriate technical and organizational measures to protect your personal information from unauthorized access, use, disclosure, alteration, or destruction. This includes encrypted data transmission, encrypted storage of sensitive credentials, and restricted access to user data.
8. Children's privacy
QrBro is not intended for anyone under 16. We do not knowingly collect personal data from children.
9. Changes to this policy
We may update this policy from time to time. If we make material changes, we will notify registered users by email. The "Last updated" date at the top reflects the most recent revision.
10. Contact
If you have questions about this policy or how we handle your data, contact us at [email protected].