Privacy Policy

• Last updated: 21 October 2026
• App: QR Code Scan Kit (in the stores as “QR Code & Barcode Scan Kit”), for iPhone, iPad and Android
• Made by: BUILDLANES (“we”, “us”), India
• Contact: [email protected]

This policy covers the QR Code Scan Kit app and the website qrcodescankit.com.

The short version

• No account, no login. Your scans, history, folders and the codes you make stay on your phone. We never see them, and we can’t get them back.
• Anonymous usage stats and crash reports go to PostHog, on EU servers. Never what you scan or make. Turn them off any time with “Share usage anonymously” in Settings.
• Purchases go through Apple or Google. RevenueCat keeps your Scan Kit Pro status under a random ID.
• No tracking. We don’t use your phone’s advertising ID (IDFA) and don’t track you across other companies’ apps or websites. To see which App Store search ads bring installs, we use Apple’s own ad attribution, which needs neither.
• No third-party ads. The free version shows cards for our own products. Scan Kit Pro users don’t see them.
• We never sell or share your data.

What stays on your phone

• Scans, history, folders, favourites and the codes you make, including any logo you add. Kept in the app’s private storage on your phone.
• Camera and photos. Codes are read on your phone. The camera image is never recorded or uploaded, and the app only sees the photos you pick.
• Wi-Fi codes. The network name and password go from the app to your phone’s system so it can join. They never come to us.
• Link safety check. Runs on your phone.
• Product details already looked up, so they show again without internet.
• Settings and the free-limit counter. The counter holds only numbers and dates for the free daily limits. On iPhone it is kept in the Keychain and can stay after you delete the app. It is never used to identify you.

Clear history in Settings, or delete the app, to remove your scans. If you use your phone’s own backup (iCloud Backup or Android backup), it may include the app’s data. That backup is kept by Apple or Google in your own account; we can’t access it. The app has no iCloud sync and no server of ours that holds your scans.

What leaves your phone

• Product lookups. When you scan a product barcode, only the barcode number goes to Open Food Facts or Open Beauty Facts (France). The product photo loads from their servers. Like any web request, they also see your IP address.
• Link previews. To show a preview, the app loads the scanned website, so that site sees your IP address and device type, like any visit. Links the safety check marks as dangerous are never loaded. Turn previews off in Settings › previews.
• Site icons. When you make a QR code for a link, the app loads that site’s icon from the site itself (no icon service in between). Logos for social codes load once from that network’s own website.
• Purchases. See “Purchases” below.
• Usage stats and crash reports. See “Anonymous usage and crash reports” below.
• Ad measurement. See “Measuring our ads” below.
• Things you open. When you tap “open”, “call”, “pay”, “add contact” and so on, the app hands that one item to the app or website you chose.
• Emails you send us. If you email us, we get your address and what you write. Emails sent from the app’s Settings add the app version, iPhone model, iOS version, your plan and the app’s random IDs, so we can help. You see all of it before you send.

Anonymous usage and crash reports

• Who: PostHog, on its EU servers in Frankfurt, Germany.
• What: a random install ID made by the app, which screens are opened, taps on the main buttons, when the Scan Kit Pro page is shown, when a trial starts or a purchase is made, and that a scan happened with the code type only (for example “QR” or “EAN-13”). Each event carries the app version, device model, system version and language.
• Crash reports: when the app crashes, freezes or hits an error, the technical report (stack trace, app version, device model, system version) goes to PostHog. On iPhone these come from Apple’s MetricKit.
• Never: what you scan or make, links, Wi-Fi names or passwords, product names, photos, contacts, file names, your name or your email.
• IP address: we set PostHog to discard it, so it is not stored.
• Your choice: on by default. Turn it off any time with “Share usage anonymously” in Settings. When it’s off, the app sends nothing to PostHog, crash reports included.
• Kept: up to 1 year, then deleted.

Send a report. Settings › Help › “Send a report” opens an email to us with the app’s latest crash or error log as text. You can read it first, and nothing is sent unless you tap send.

Separately, if you share analytics with app developers in your phone’s settings, Apple or Google send us their own crash reports. You control that in your phone’s settings.

Measuring our ads

We advertise the app in App Store search. To see which of those ads bring installs and purchases, the app uses Apple’s own ad attribution through RevenueCat: Apple gives the app a token that says which search ad led to the install, and RevenueCat matches it with the purchase. It never identifies you, uses no advertising ID and needs no tracking prompt.

The app doesn’t use your phone’s advertising ID (IDFA on iPhone, the advertising ID on Android), has no ad-network code, and doesn’t track you across other companies’ apps or websites. If we ever start measuring ads on other platforms, we’ll update this policy and ask your permission in the app first.

Cards for our own products

There are no ad networks and no third-party ads in the app. The free version shows small cards for our own products, such as our wallpapers website. These cards use no tracking and no ad ID. We count how often each card is shown and tapped, anonymously, as part of the usage stats above. Scan Kit Pro users don’t see them.

Purchases

Scan Kit Pro is sold through the App Store or Google Play. Apple or Google takes the payment; we never see your card or payment details.

RevenueCat (USA) checks whether you have Pro and lets you restore it. It gets a random app user ID (not your name, email or store account), your purchase history (plan, dates, trial, price, currency, store country), basic device details and your IP address. If you installed from an App Store search ad, it also gets Apple’s attribution token (see above).

If you ask Apple or Google for a refund, they may ask us how the subscription was used (for example, how long you’ve had Pro). We share that only to help them decide.

Email list

Joining our email list is optional. In the app, it’s offered only to people with a paid plan (not during a free trial). You type your address in the app and tick the box to agree; we check that your plan is paid and pass the address to our email provider, beehiiv. Nothing else is sent with it. We use your address only to send news about our apps, products and tools we like, never sell or share it, and every email has a one-tap unsubscribe.

Permissions

• Camera: to read codes.
• Photos: to read codes from pictures you pick, and to save codes you make.
• Notifications: optional, for trial reminders before a free trial ends. They are set on your phone and don’t go through any server.
• Contacts and Calendar: only when you tap “add contact” or “add to calendar”. The app opens your phone’s own screen for that one item and doesn’t read your contacts or calendar.

Change any permission in your phone’s settings.

Why we use data (legal bases)

• Features you ask for (lookups, previews, icons, Pro): to provide the app you asked for (contract).
• Purchases, restores, refunds and accounting: contract and legal obligations, including tax law.
• Usage stats and crash reports: our legitimate interest in fixing bugs and improving the app. You can turn them off any time.
• Apple Search Ads attribution: our legitimate interest in knowing which of our ads work. It doesn’t identify you.
• Answering your emails: our legitimate interest in helping you.
• Email list: your consent.

Under India’s DPDP Act, we rely on your consent, or on your own voluntary use of a feature (like a lookup). You can withdraw consent any time.

Who gets data (our service providers)

We don’t sell your personal information. We only share it with these providers, each for the job described above:

• Apple: App Store, payments, Apple Search Ads attribution. Privacy policy
• Google: Google Play and payments on Android. Privacy policy
• RevenueCat, Inc. (USA): purchases and Pro status. Privacy policy
• PostHog Inc. (EU servers, Frankfurt): anonymous usage stats and crash reports. Privacy policy
• beehiiv, Inc. (USA): the email list, only if you join. Privacy policy
• Open Food Facts and Open Beauty Facts (France, non-profit): product lookups. Privacy policy
• Cloudflare, Inc.: hosts our website. Privacy policy

We also share information if the law requires it, or with a buyer if the app or BUILDLANES is sold (see below).

These providers are in the USA, the EU and elsewhere. For data from the EU, UK and Switzerland, transfers rely on the European Commission’s Standard Contractual Clauses or the EU-U.S. Data Privacy Framework where the provider is certified.

How long we keep data

• On your phone: until you delete it or delete the app.
• Usage stats and crash reports (PostHog): up to 1 year.
• Purchase records (RevenueCat, Apple, Google): while you have a subscription, then as long as tax and accounting laws require.
• Emails you send us: up to 3 years after your last message, unless the law requires longer.
• Email list: until you unsubscribe or ask us to delete it.

Deleting your data

• Scans and history: Settings › clear history, or delete the app.
• Usage stats and crash reports: email us from the app (Settings › the envelope), so the email carries the app’s random IDs. We delete the PostHog data for that ID within 30 days.
• Purchase records: email us. We delete what we can within 30 days and keep only what tax law requires.

Your rights

• EU, UK, Switzerland and Brazil: you can ask to see your data, correct it, delete it, restrict or object to its use, get a copy, and withdraw consent. You can also complain to your local data protection authority.
• California and other US states: see the next section.
• India (DPDP Act, 2023): you can ask for a summary of your data and how it is used, ask us to correct, complete, update or erase it, nominate someone to act for you, and raise a grievance with us. If our answer doesn’t satisfy you, you can complain to the Data Protection Board of India.

Email [email protected]. Because there is no account, we hold very little that identifies you; we may ask for the app’s IDs (see “Deleting your data”) or your store order ID. We answer within 30 days.

California and other US states

We don’t sell your personal information, and we don’t share it for cross-context behavioural advertising. What we collect: identifiers (random app IDs; IP addresses reach our providers with each request, and PostHog discards them), purchase history, and app activity (the usage events above). We collect no sensitive personal information.

You have the right to know, delete and correct your data, to use an authorised agent, and not to be treated differently for using your rights. Email [email protected]. You can also stop usage stats any time with “Share usage anonymously” in Settings.

Our website

qrcodescankit.com uses no cookies and no trackers. The only thing it saves is your light or dark theme choice, in your own browser. The free tools on the site run in your browser and don’t upload your files. Cloudflare hosts the site and, like any web host, handles your IP address to deliver the pages.

Security

Your scans stay in the app’s private storage, protected by your phone’s security and encryption. Everything the app sends uses encrypted connections (HTTPS) wherever the other side supports it. If a breach affects your personal data, we will tell you and the authorities as the law requires.

Children

The App is for people 13 or older (16 or older in the EU and UK). Under that age, only with a parent’s permission. In India, users under 18 should use the app with a parent or guardian, and purchases should be made by or with a parent. We don’t knowingly collect data from children. If you think a child has sent us personal data, email us and we will delete it.

If the App changes owner

If the App or BUILDLANES is sold or merged, the little data described here moves to the new owner, who must keep this policy or tell you before changing it.

Changes

If we change this policy, we update this page and the date at the top. For important changes, we also tell you in the app.

Contact and grievance officer

BUILDLANES, India. Email [email protected]. This address also reaches our grievance officer under India’s DPDP Act. We acknowledge grievances within 7 days and resolve them within 30 days.