Privacy — what CuteQRs collects
Plain-language summary of the personal data this service processes, why, and for how long.
Your account
We store a username, display name, and (when provided by your identity provider) an email address. Sign-in happens through your organisation's login (Kerberos/FreeIPA or SSO) or a password stored only as an Argon2id hash — never in plain text.
QR code scan analytics
When a dynamic code is scanned, CuteQRs records the time, browser user-agent, referring page, and a salted, truncated hash of the visitor's IP address — never the raw IP, which makes the record pseudonymous. These records are automatically deleted after days and are never shared with third parties.
Security audit log
Logins and admin actions are recorded for security accountability, with IP addresses hashed the same way. Audit entries are pruned after days.
No third parties
CuteQRs is self-hosted. Nothing is sent to analytics vendors, ad networks, or external CDNs. Scanning a QR code with the built-in scanner or uploading an image happens entirely in your browser — no images leave your device.
Your rights
- Access & portability: download everything associated with your account as JSON from /api/export.
- Erasure: ask an administrator to delete your account — this removes your profile, codes, sessions, and scan data, and pseudonymizes the audit trail.
- Object / rectification: contact your site administrator (see below).
Data controller: the operator of this CuteQRs instance. If you have questions, reach the administrator of your organisation — this page is generated from the instance's current retention settings and reflects what the software stores, not who operates it.