Privacy Policy

If you create an account, Supabase Auth processes your email address, password authentication, account identifier, confirmation status, sessions, and related authentication records. LumenQR does not receive or store your plaintext password.

If you choose Google sign in, Google and Supabase may return the basic identity details used for authentication, such as your name, email address, and profile image. LumenQR does not request Google Drive or Gmail data, offline access, or additional Google product scopes, and the application does not read or save a Google provider token in custom storage.

After you finish creating an account, LumenQR sends one welcome email to your account address through Cloudflare Email Service. It is a one-time transactional message with no marketing content or tracking, and it is sent only when an account first becomes confirmed.

When you use Dynamic QR codes, LumenQR stores each code's name, destination URL, generated short code, design data and schema version, status (live, paused, or archived), safety and synchronization state, record version, lifetime scan total, and creation, update, publication, and archival timestamps. These records are associated with your account so that only you can manage your codes through the dashboard.

Dynamic QR codes are live: the short link they encode temporarily redirects scanners to your stored destination. When a live code is scanned, the redirect service reads only the short code and records the scan as privacy-minimized aggregates — a lifetime count and a per-code, per-UTC-day count. It does not read or store the scanner's IP address, user agent, referer, or destination query data.

For the hosted destination types (PDF, image gallery, video, social links, app, menu, event, coupon, and feedback), LumenQR also stores the content you enter — such as titles, descriptions, links, menu items, event details, coupon terms, and feedback prompts — and the files you upload. Uploaded PDFs and images are kept in private Supabase Storage that is not publicly listable, and scanners receive the bytes only through same-origin /p/ links that proxy them while your code is live — storage object paths and account identifiers are never exposed. Hosted pages are served by LumenQR under the /p/ path with noindex instructions. When a record is archived and later tombstoned after account deletion, its hosted content is removed and its files are detached and purged by an automated cleanup; abandoned uploads that are never attached to a code expire and are removed the same way.

Responses submitted to a feedback QR code are protected by Cloudflare Turnstile verification and store only the star rating and comment the scanner writes, plus a pseudonymous anti-abuse HMAC derived from the scanner's IP address under a server-only secret, kept for up to 180 days for throttling and duplicate detection. The scanner's raw IP address, user agent, referer, and device data are never stored. As the code owner, you see the response count, the average rating, and the five most recent responses in your dashboard.

The feedback page (/feedback) shows a curated selection of user feedback that anyone can read without an account. Sending feedback requires a signed-in account, and every submission is linked to your account identifier. When you submit, LumenQR collects the feedback category you choose, the message you write, the same-origin page path (pathname only) you sent it from, and an optional reply email address if you choose to provide one. Do not include passwords, authentication links, access tokens, or other secrets in your message.

Submissions are private by default and are reviewed by the LumenQR team before anything is published. When you submit, you may explicitly opt in — through an unchecked-by-default consent checkbox — to let an approved message be published anonymously. If you do, a reviewer may later publish it; if you do not, it is never published. Public display is always Anonymous and is limited to the feedback category, the message text, and the publication date: your email address, account identifier, page path, and all other submission details are never published and are never returned by the public feedback API.

To prevent spam and abuse, each submission is protected by Cloudflare Turnstile verification, and LumenQR stores a pseudonymous anti-abuse HMAC derived from your IP address under a server-only secret, kept for up to 180 days for rate limiting and duplicate detection. Your raw IP address, user agent, and device data are never stored in the feedback database. Rate limits restrict how much feedback one submitter can send, and duplicate submissions are detected with a normalized content hash.

Feedback submissions are stored in the Supabase database and reviewed by the LumenQR team. Each accepted submission also triggers a notification email to the team delivered through Cloudflare Email Service; the notification contains the feedback content and your publication-consent choice but never your IP address or the abuse hash.

Hosting, security, and authentication providers may process technical information needed to deliver and protect the service, such as IP address, request time, requested route, browser or device information, security signals, and error or request identifiers.

Google Analytics is used only on public pages. It is not loaded on sign-up, authentication callback, or dashboard routes, and it is disabled while the account sign-in modal is open. Analytics can resume only after the modal closes and its authentication query parameters are removed. Public-page analytics uses a sanitized page location containing only the site origin and pathname; query strings and URL fragments are excluded. Google may also process ordinary analytics information such as device, browser, approximate location, referral, and interaction data according to your browser and Google settings.

Account and Dynamic QR data is retained while needed to provide and secure the account-based service. Archiving a Dynamic QR code is a permanent action in the current service: the record is logically archived rather than physically deleted, it cannot be restored through the service, and its short code remains reserved. This prevents an old or distributed code from later being reassigned to an unrelated destination.

Feedback submissions, including any optional reply email address, are retained for up to 180 days so the team can review and act on them, and may be deleted sooner once reviewed. Responses to feedback QR codes are deleted automatically after the same 180 days. Pseudonymous anti-abuse HMACs follow the same 180-day feedback retention period, and the same limit applies to submissions that were published anonymously.

Provider logs, security records, backups, and analytics may follow provider-specific retention periods. To ask about access, correction, account deletion, withdrawing a published feedback message, or another privacy request, use the feedback page. Requests are reviewed under applicable requirements and may be subject to identity verification and operational, security, recordkeeping, or legal constraints.

LumenQR uses reasonable technical and organizational safeguards, including encrypted transport and access controls. No online service or storage method can be guaranteed completely secure.

The service is not directed to children under 13. If you believe a child has provided account or contact information, please use the feedback page so the situation can be reviewed.