Privacy policy

The short version

There is no account system, no cookie and no database. The QR code and barcode generator runs in your browser, so what you encode there never reaches a server. The content pages of this site — the ones with a navigation bar — load a cookieless analytics script that counts visits in aggregate. The share pages and the image API do not load it.

This page used to claim there was no analytics at all. That was wrong, and it is corrected here. The source code is public, so every statement below can be checked.

The generator

The generator on the home page encodes your input with JavaScript running inside your browser tab and paints the result onto a canvas. The URL or text you type, any UTM values you add, the logo image you select and the SVG mask you upload are all processed locally and are never transmitted. Downloading a PNG or SVG is a local canvas export, not a server round trip. The same applies to the other tools: an image you load into the QR code reader is decoded inside your browser tab, and a list you paste into the bulk generator is rendered there too; neither is sent anywhere. You can confirm all of this in your browser's network panel: typing in the generator produces no requests.

Analytics

Content pages load a cookieless analytics script from api.panalytics.money. Per page view it sends:

• the host name and path of the page you opened;
• the referring site, if you arrived from a link;
• campaign tags from the query string, such as utm_source and utm_campaign;
• your browser, operating system and a country, derived from the request itself.

It does not set a cookie, does not write to local storage, does not read one, and does not create an identifier that could follow you to another website — the number attached to each request is random and thrown away. The output is a visit count, not a profile.

The analytics script is deliberately not loaded on makeqrco.de/<url> share pages, because the URL you encoded is part of that page's path and sending it to an analytics provider as a page view would be exactly the thing this site says it does not do. It is also not loaded by the /qr/ image API, which returns a PNG and no HTML at all.

The URL routes

makeqrco.de/qr/<url> and makeqrco.de/<url> both take the payload from the request path, render a QR code and return it. The application does not write the payload to a database or a file, does not queue it, and does not pass it to a third party. There is no storage layer in this application at all.

What that cannot promise is that the request is invisible: the URL you encode travels over the network as part of the request path, and standard HTTP infrastructure — the reverse proxy and the Node process in front of the application — can log request lines the way any web server can. If a link is genuinely confidential, generate its code in the browser rather than through the URL routes.

Cookies and storage

This site sets no cookies of its own, and neither does the analytics script. Nothing is written to local storage or session storage. There is no consent banner because there is nothing to consent to.

Third parties

Two external services are involved in serving this site: the analytics endpoint at api.panalytics.money, as described above, and the hosting and DNS providers that run the server. No advertising network, no tag manager, no social widget, no embedded font from a third-party CDN and no A/B-testing script is loaded on any page.

Your rights and contact

Because no personal data is stored, there is nothing to export or erase on request. If you have a question about any of this, or you believe something here is inaccurate, email Kyllian at hello@makeqrco.de or open an issue on GitHub. Material changes to this policy will be reflected in the date at the top of the page.