QRStudio privacy policy
In short. QRStudio has no account, no advertising and no usage tracking, and it sends nothing to a server run by the developer. Your scans, saved codes and settings stay on your device.
The app goes online in two cases: when you turn on and use the feature that reveals where a shortened link leads, and, on Android, when Google's ML Kit scanning library sends Google technical diagnostics.
- Who is responsible
- What stays on your device
- Permissions
- When it uses the internet
- Actions you start
- The web version and this site
- Android backups
- Sharing and selling data
- Children
- Your rights
- Changes and contact
Who is responsible
QRStudio is developed by Otniel Didraga and published by DDG Business Consulting SRL, VAT RO41270745, registered office at str. Marcel Iancu nr. 8, ap. 1, 300371 Timișoara, Timiș County, Romania. For the purposes of the GDPR, DDG Business Consulting SRL is the controller for the data described in this policy. For any question about this policy, write to contact@ddgbc.com.
What stays on your device
The app keeps the following data only in its own local storage (on Android and iOS) or in the browser's storage (in the web version):
- Scan history: the content of each code or NFC tag you read, the code's type and format, and the time of the scan. At most 200 entries are kept; the oldest are removed automatically.
- Saved codes: the fields you filled in under Create (for example the link, a Wi-Fi network name and password, or a contact's details), the label you chose and the date.
- Export log: the name and location of files you exported.
- Settings: language, theme and the options under Settings.
Camera frames and the photos you scan (including images opened with “Open with” or shared to QRStudio) are analysed in memory and are neither saved nor sent anywhere. A logo you add to a code is not kept after you close the app.
Files you export become your files: on Android, PNG and JPG images go to your gallery under Pictures/QRStudio and SVG files to Documents/QRStudio; in a browser they go to Downloads. They stay on your device after you uninstall the app.
You can clear your history at any time under History with “Clear all”, and delete saved codes under Saved. Uninstalling the app, or clearing its data in Android settings, removes everything listed above. In a browser, the data goes when you clear the site's data.
Permissions
Each permission is requested only when you use the feature that needs it, and you can decline any of them; the rest of the app keeps working.
| Permission | What it is used for |
|---|---|
| Camera | Reading codes while the Scan screen is open. Frames are analysed on the device and never saved. |
| Contacts | Only when you tap “Pick from contacts” under Create. The app reads the contact you choose (name, organisation, phone, email, address, website, note) to fill in a contact code. It does not read the rest of your address book and never changes a contact. Android groups reading and writing contacts into one permission, which is why writing is listed too, although the app never uses it. |
| NFC | Reading and writing NFC tags, only from the NFC screen. |
| Storage (Android 9 and older only) | Saving exported images to the gallery. Not needed on Android 10 and newer. |
| Internet | Only for the cases described in the next section. |
When it uses the internet
Revealing a shortened link's destination
This feature is off by default. If you turn on “Allow revealing shortened links” in Settings and tap “Reveal destination” next to a shortened link, the app sends a request to that link's address and follows its redirects to the final destination. The servers involved (the link shortener and any site it redirects to) receive your IP address and the usual technical details of a web request, exactly as they would if you opened the link in a browser. The result is not sent anywhere else.
Google ML Kit (Android app)
On Android the camera reads codes with Google's ML Kit library, which runs on the device. According to Google's documentation, ML Kit sends Google, encrypted, data about how the library performs: device and app information, performance metrics, configuration, error codes and a per-installation identifier that is not designed to identify a person or a device. Google states the purpose as diagnostics and usage analytics, and that ML Kit does not transfer this data to third parties. The content of the codes you scan is not part of this data. Google's handling of it is governed by the Google Privacy Policy.
The web version does not use ML Kit. It reads codes with libraries that run entirely in your browser.
Actions you start
Some buttons hand information to other apps or websites, which process it under their own terms: opening a scanned link in your browser, opening a location in a maps app (Google Maps), adding an event to Google Calendar, looking a product code up online (Google Search), starting an email, SMS or call, and sharing a code through the system share sheet. Text you copy to the clipboard can be read by other apps, under your operating system's rules. None of this happens unless you tap the button.
The web version and this site
The ddgbc.com website and the web version of the app are static files. They use no cookies, no traffic analytics and no third-party fonts or scripts. Like any web server, the company hosting the site logs technical details of each request (IP address, browser, the page requested and the time), which it uses to deliver the pages and for security. The legal basis is the legitimate interest in providing the site securely (Art. 6(1)(f) GDPR).
After its first load, the web app is stored in your browser and works without an internet connection. In a browser, the camera, picking a contact (Chrome on Android) and NFC (Chrome on Android) work as in the app: the browser asks for your consent, and the data stays on your device.
Android backups
If backup is turned on in your Android settings, the system may include the app's data (history, saved codes and settings) in the backup stored in your Google account. That backup is managed by Google under your settings; the developer has no access to it. You can turn backup off in your phone's settings.
Sharing and selling data
Neither the developer nor DDG Business Consulting SRL receives, sells or shares your data, because the app never sends it to them. The app contains no advertising and no advertising or analytics SDKs.
Children
QRStudio is not directed specifically at children and does not collect personal data from any user, whatever their age.
Your rights
Under Regulation (EU) 2016/679 (GDPR) you have the right of access, rectification, erasure, restriction, portability and objection. Because the app's data lives only on your device, you can view it, export it (History → Export JSON or Export CSV) and delete it directly in the app. For data processed by Google through ML Kit, you can contact Google. For any other request, write to contact@ddgbc.com.
You also have the right to lodge a complaint with the Romanian data protection authority, ANSPDCP, at www.dataprotection.ro, or with the authority in your own EU country.
Changes and contact
If a new version of the app changes how data is used, we update this page and the date at the top before that version is released. Questions: contact@ddgbc.com.