Privacy policy
Last updated October 4, 2026
QR Code 42 is operated by Frequency 42 LLC (Marquette, Michigan, USA). This page says what we collect, what we use it for, who else touches it, and how to ask us to change or delete it. We don't sell personal data.
What we collect
When you have an account
- Your email address. There are no passwords. You sign in with an emailed one-time link (valid for 15 minutes, single use) or a passkey.
- Passkey credentials, if you register one: the public key and an identifier. We never receive your biometric data or private key.
- Sign-in requests: the email, a hash of the one-time token, and the IP address of the request. The IP is used to rate-limit and prevent abuse.
- A session cookie (
qr42_session) that keeps you signed in for up to 30 days. It is HTTP-only and sent only over HTTPS. - What you put into the service: your organization's name; the GTINs you claim and any evidence link you provide; products, links, short links, landing pages and brand hostnames; team members' email addresses; and API keys (we store only a hash of each key, never the key itself).
- An activity log of changes made in your organization (who, what, when, and the IP address).
Billing
Payments are handled by Stripe. We store Stripe customer and subscription identifiers and your plan status. We never see or store your card number.
When someone scans a code
When a QR code or short link resolves through our resolver, we log which host and GTIN or short code was used, the kind of link served, the approximate country (supplied by Cloudflare) and a coarse device category. We do not record the scanner's IP address or identity in these logs. This is aggregate data that powers your analytics.
When you visit our website
- Google Analytics 4 measures visits to our public pages (pages viewed, approximate location, device and browser) only if you accept analytics in the cookie banner. We turn off Google's advertising features and personalization signals.
- Cloudflare Web Analytics gives us basic, cookieless page-view counts.
- Cloudflare protects the site from abusive traffic and may set a security cookie (
cf_clearance) after a bot check. - Our typefaces are served from our own servers, so loading them does not contact any third party.
Cookies
When you first visit, a banner asks whether we may use analytics cookies. "Accept" and "Reject" are equal choices, nothing optional loads until you accept, and you can change your mind any time with Cookie settings in the footer. If your browser sends a Global Privacy Control signal we treat it as "reject" and don't show the banner. Your choice is remembered for about six months.
| Cookie | Purpose | Type |
|---|---|---|
| qr42_session | Keeps you signed in (up to 30 days; HTTP-only) | Strictly necessary |
| qr42_consent | Remembers your cookie choice (about 6 months) | Strictly necessary |
| cf_clearance | Set by Cloudflare after a bot check, to keep the site secure | Strictly necessary |
| _ga, _ga_* | Google Analytics visit measurement | Analytics — only if you accept |
Why we use it
- To run the service: sign you in, resolve your codes, show your analytics and export your labels.
- To bill you and keep your plan limits accurate.
- To review GTIN claims, handle disputes, and prevent abuse and fraud.
- To understand how the public website is used and to answer support requests.
Who processes it for us
| Provider | What for |
|---|---|
| Cloudflare | Hosting, our database, DNS, bot protection, scan-count storage and website analytics |
| Stripe | Payments and the billing portal |
| Resend | Sending sign-in and service emails |
| Hostinger | Our support mailbox (mail you send to support@qrcode42.com) |
| Analytics on our public pages, if you accept analytics |
We may also disclose information if the law requires it, or to protect the service and its users from fraud or abuse.
How long we keep it
One-time sign-in links expire after 15 minutes and sessions after 30 days. We keep your account and the content you published for as long as your account exists. Because a printed label can't be recalled, codes and links you've published keep resolving after you cancel, so we keep the data needed to serve them unless you ask us to remove them.
Your choices
Email support@qrcode42.com to ask to see, correct, export or delete the data we hold about you. Deleting a code that is printed on products will make those scans stop working, so we'll confirm with you before we do it. You can block or clear cookies in your browser; the session cookie is required to stay signed in.
Do Not Track
Our site does not currently change its behavior in response to browsers' "Do Not Track" signals. We don't sell personal data.
Your rights where you live
Depending on where you live, such as California and a growing number of other US states, or the EU, UK and EEA, you may have rights to know what we hold about you and to access, correct, delete or take a copy of it, and to object to or limit certain uses. We handle these requests for everyone, wherever you are: email support@qrcode42.com. If you're not satisfied with our answer you can ask us to reconsider, and you can contact your state attorney general or, in Europe, your data protection authority.
Where the law requires a transfer mechanism for moving personal data to the United States, we rely on the safeguards our providers offer, such as standard contractual clauses.
Children
QR Code 42 is a business service and isn't directed at children.
Where data is processed
We're based in the United States, and our providers process data in the United States and in the other countries where they operate.
Changes
If we change this policy we'll update the date at the top, and tell account holders by email if the change is significant.
Contact
Frequency 42 LLC, Marquette, Michigan, USA — support@qrcode42.com.