Privacy Policy
Last updated: October 2, 2026
The controller of personal data processed through QRPebble is Appvolt (앱볼트) (business registration no. 793-33-01389, 2F #201, 74 Gucheonmyeon-ro 68-gil, Gangdong-gu, Seoul 05307, Republic of Korea; [email protected]).
What we collect
- Static QR codes and barcodes are generated in your browser. The content you type is not sent to our servers.
- Account data: your email address and a hashed password.
- Site usage: for each page view we log the page path, whether you arrived from an ad or tagged link (not the click ID itself), device type, country (from our CDN), time on the page, how far you scrolled, which buttons or links you clicked and sign-up form errors. We do not log IP addresses, and this log is kept on our own server; no analytics vendor receives it. Outside the EEA, the UK and Switzerland a random tab-session ID is kept in your browser's session storage until the tab closes, so page views in one visit can be grouped.
- Dynamic codes: the name and destination URL you save.
- Scan events for dynamic codes: time, country (derived from the network by our CDN) and device type (mobile, tablet or desktop). We do not store IP addresses or build profiles of people who scan.
- Billing: handled by Polar Software, Inc., our Merchant of Record, which collects your payment and billing details under its own privacy policy. We receive a customer ID, subscription status and order amounts, never your full card number.
How we use it
To run the service, show you analytics, process payments, calculate affiliate commissions, prevent abuse and answer support requests. We do not sell personal data.
Cookies
A session cookie keeps you logged in. If you arrive through a referral link, a first-party cookie (qp_ref) stores the referral code for 60 days.
If you arrive from an ad or a tagged link, a first-party cookie (qp_attr) stores the campaign parameters (utm tags and the Google Ads click ID) for 90 days, and we save them with your account when you sign up so we can tell which campaigns bring customers. We use the Google Ads tag to measure sign-ups and checkouts from our ads; we do not use it for remarketing or personalized ads. Visitors in the EEA, the UK and Switzerland get Google's ad and analytics cookies disabled by default.
Processors
Polar (Merchant of Record for payments, tax and refunds), Cloudflare (network and CDN), Google (Google Ads conversion measurement) and our hosting provider.
Retention and deletion
We keep account data while your account exists. Email [email protected] to delete your account and its codes and scan data; we complete requests within 30 days, except records we must keep for tax purposes.
Your rights
Depending on where you live (for example the EU, UK or California) you can ask to access, correct, export or delete your data, or object to processing. Contact [email protected].