Security & data handling

Scan data

A scan record holds the time, the country and city, the device category (mobile, tablet or desktop), and a visitor identifier. It does not hold an IP address, and it does not hold coordinates.

The visitor identifier is how “40 scans” becomes “40 scans from 12 people”. It is an HMAC-SHA256 of the scanner’s IP address, their browser’s user agent and the account the code belongs to, keyed with a secret held only on our servers and truncated to 128 bits. The IP is used to compute it and then discarded — it is never written to the database. Because the account id is part of the input, the same person scanning two different customers’ codes produces two unrelated identifiers, so nobody can be followed across accounts.

Scans older than 90 days move to an archive table. They are not deleted: your analytics count both, so your history stays complete for as long as your account exists.

Where IP addresses are stored

Stating this plainly because the section above is a narrow claim, not a general one. We record IP addresses in our own website analytics, in session records, in checkout events, and in security and account-activity logs — the ordinary operational logging any hosted service keeps to diagnose problems and investigate abuse. What we do not do is attach an IP to a scan of your QR codes.

Payments

Card details are entered on Stripe’s hosted checkout and stored by Stripe. No card number, expiry or security code ever reaches our servers or our database. We store Stripe’s identifiers for your customer and subscription so we can show your plan and let you manage billing; the last four digits shown in your account are read from Stripe at the moment the page loads and are not kept.

Accounts and credentials

• Passwords are handled entirely by Supabase Auth. We never receive, see or store your password, and there is no code in this application that hashes one.
• API keys are stored as SHA-256 hashes. The key itself is shown once, when you create it, and cannot be recovered afterwards — only replaced.
• Webhook payloads are signed with HMAC-SHA256 over a timestamp and the body, so your endpoint can verify a delivery came from us and is not a replay.
• Two-factor authentication is not currently available. We would rather say so here than have you discover it after signing up.

Requests we make on your behalf

Several features fetch a URL you supply: link previews, image imports and webhook deliveries. Each one resolves the hostname first and refuses any address on a private, loopback, link-local or cloud-metadata range, re-checking after every redirect. This is what stops a URL in your account from being used to reach systems that are not on the public internet.

Infrastructure

The application runs on Vercel. Data is stored in Supabase’s managed Postgres, hosted on AWS in the United States, encrypted at rest by the provider. All traffic to and from the application uses TLS.

Who else processes your data

The complete list, and what each one receives:

• Supabase — the database and authentication. Everything stored is stored here.
• Stripe — payments. Your email, billing details and payment history.
• Vercel — hosting, uploaded files (such as logos), and website performance measurement.
• Brevo — transactional and lifecycle email. Your name, email address and plan.
• Sentry — error reporting, which includes the request details of a failing request.
• Google Analytics and Tag Manager — our own website analytics. These run on our hostnames only, and never on a customer’s custom domain.
• ipapi.co — a geolocation fallback, used only when our host does not supply the country itself. It receives an IP address and returns a country and city.

If you connect your own analytics — Google Analytics 4, or a tag on your landing pages — that is an additional recipient you have chosen, and the disclosure and consent for it are yours to handle.

Deleting your account

You can delete your account yourself, from your account settings. It removes your profile, your QR codes, your scan history including the archive, your API keys, your website and session analytics, your support messages, and your Stripe customer record. Your login is removed from our authentication provider. It is immediate and it is not recoverable.

One thing is deliberately kept: records of payments and refunds, detached from your identity, because we have to be able to account for money that moved. Note that deleting your account does not stop your printed codes from being scanned — it stops them resolving, so anyone who scans one reaches a page saying the code is no longer active.

Certifications

We hold none. There is no SOC 2 report and no ISO 27001 certificate. If your procurement process requires one, we would rather you knew now.

Reporting a vulnerability

Email support@smart-qrcode.com with “Security” in the subject line. We will acknowledge it. We do not run a paid bounty programme, and we will not threaten you for telling us.