What we keep, and why.

• Scanning a code or opening a short link sets no cookies, and we never store the scanner’s IP address.
• Your images are used to make your code and for nothing else. We never use them to train AI models or for advertising.
• Brand landing pages carry no AriaQR analytics tags. Brands see cookie-free counts. A Business brand may add its own Meta and Google ad tags, behind a consent choice.
• Google Analytics, PostHog, our Meta Pixel, Google’s quick sign-in prompt and our search-optimisation script on ariaqr.com wait for your consent in the EU, the EEA, the UK and Switzerland, and anyone can turn them off from “Cookie settings” in the footer.
• We do not sell data.

You can make and buy a picture code without an account. The code is yours through a private link shown once when it is made; this browser also keeps a copy so a refresh can bring the code back, and signing out clears it. You need an account for free codes, short links, landing pages, the plans, teams and API keys.

You sign in with Google or with a six-digit code we email you. For an account we store your email address; the name and picture Google gives us, if you used Google; how you have signed in; when the account was created and last used; the codes, short links and pages on it; your plan status and payment history; billing details if you add them; your team memberships; and your API keys. Sign-in codes are stored only as a one-way hash, last ten minutes and work once. Your session is kept in a sign-in cookie for up to 30 days. We do not ask for anything else and we do not build a profile of you.

Your image is used to generate your code and for nothing else. We store the source picture, the preview and, once the code is activated, the print-ready master, so you can restyle without uploading again and download whenever you need. Codes you generate but never activate are deleted, image and all, after seven days (thirty days for live codes made in the Canva app, see below). Free classic codes store no image.

Codes made by bulk upload or through the API are handled the same way. If you give the API the web address of an image, we fetch the image from that address.

Image enhancement is optional and only runs when you click it. Your image is sent to Google’s Gemini image model, through our own AI service on our Google Cloud project, to sharpen and restore it, and the result is shown next to the original for you to accept or discard. The temporary copy we hold for the enhancement is deleted within a day; only a version you accept becomes part of your code. Faces and other recognisable features can change during enhancement, which is why nothing is applied automatically.

The landing-page designer runs when you ask it to. Depending on the button, it sends Google’s Gemini models, through the same service, the brief you typed (your business name, what it does, the goal, where the code will be, style words, the website and Instagram addresses you entered and your colours), the text you asked to rewrite, or your current brand kit and the direction you gave for a restyle. It never receives your photos and it does not generate images.

Google processes this under its Cloud terms for business customers, which do not allow it to use the content to train its models.

Free classic codes with an editable link are up to ten live codes per account and need a sign-in, because the renewal reminders go to that email. Each lives for a year from its last renewal. We email you 30, 7 and 1 days before the year ends; one click renews it. A code nobody renews pauses, and is deleted 30 days later.

Free codes that carry their content inside the code itself, such as Wi-Fi or UPI codes, need no account: we draw the code and keep nothing.

Short links need a signed-in account; there are no anonymous links. For each one we store the destination, its name, when it was made, the account that owns it, and its clicks, recorded as described under scan and click analytics. Free accounts can keep 10 short links, each live for a year and renewed the same way as free codes; short links made on a plan have no yearly expiry. When you delete a short link, its name stays reserved for your account for 60 days so nobody else can catch its old clicks. A name that was blocked for abuse is never given out again.

Every destination is checked before the link is made or changed, as described under link safety.

Each dynamic code carries a short AriaQR link that redirects to the destination you chose. We store the destination and the code’s settings, such as campaign tags, separate app-store links for iPhone and Android, a placement name and location, and alerts. A contact card or a message hosted in a code is shown to anyone who scans it, so only put in what you are happy to share.

If you type a placement address, we look it up on OpenStreetMap’s Nominatim service to put it on your map. Alerts go to an email address you confirm by clicking a link we send it, or to a webhook address you give us. A read-only statistics link exists only if you create and share it.

When someone scans a code or opens a short link we record one event: the time; whether it was a camera scan, a link opened from somewhere, or a link-preview bot; the operating system and its version; the browser or the app it was opened in; the language; and an approximate location worked out from the network address at that moment (continent, country, region, city, sometimes a postal code, rounded coordinates and the time zone).

The location comes first from our hosting provider’s network lookup, then from an offline copy of MaxMind’s GeoLite2 database that we keep ourselves. When neither places the network to a city, the address is sent to two location services, ipwho.is and ipinfo.io, and we keep a city only if both agree. We never store the scanner’s IP address, we set no cookies, and we do not identify the person. Unique-visitor counts use a one-way hash of the network address and browser, mixed with a secret that changes every day, so a repeat visit is recognised for that day only. Visits from data centres and link-preview bots are labelled and kept out of the numbers.

Code owners see these events in aggregate, a list of recent ones, and can export them as a spreadsheet. If the owner sets where a printed code hangs, camera scans are shown at that place. Events are kept while the code or link exists, so its owner can see its history, and are deleted together with it: when its owner deletes it, when an expired free code or free short link is cleared out, when an unactivated code is cleared out after seven days, and when its account is deleted. A daily job also removes any events left behind by codes that no longer exist.

A code owner may switch on a precise-location prompt. A phone that scans such a code first sees a short page, and the phone asks for its location in its own permission dialog. If the person allows it, the phone sends the coordinates to BigDataCloud to look up the town and postal code, and we store the coordinates rounded to about 100 metres with that postal code, city, region and country. These precise locations are deleted after 90 days; the scan then keeps only the approximate location from the network (city, region and country). If they decline, nothing more is recorded and they go straight on to the destination.

Anyone signed in can build and preview landing pages; publishing them needs the quarter plan or the Business plan. We store what the brand puts on a page: the words, colours, fonts, links, contact details, and the photos and logo it uploads. Uploaded photos are re-encoded when they arrive, which removes hidden metadata such as the location a photo was taken, and anything that is not really an image is refused.

A published page is public at aqr.li/ followed by its name (older links to ariaqr.com/p/ forward there), and, if the brand turns it on, at its own subdomain (name.aqr.li, or name.ariaqr.com for pages published before that). A “Save contact” block lets visitors download a contact card with the name, role, company, phone, email and website the brand entered. Before a page goes live, every link on it is checked as described under link safety.

A page stays until its owner deletes it. Deleting a page also deletes its visitor statistics and the photos it used that no other page of the owner shows. If the Business plan ends, published pages are taken offline and the drafts stay.

The brand decides what its page says and what it asks visitors for, and it is responsible for that towards its visitors (where data-protection law uses the word, the brand is the controller). We host the page and count visits for the brand.

On the Business plan a brand can add its own Meta Pixel and Google tags to its pages, so it can show its ads later to people who visited, including which of its printed codes they scanned. Those tags come from Meta and Google, set their cookies and send them the visit; what they do with it is governed by the brand’s agreements with them and their own policies. In the EU, EEA, UK and Switzerland, and wherever we can’t tell the country, they load only after the visitor accepts on the page; elsewhere the visitor can say no thanks, and a browser’s Global Privacy Control signal counts as no. “Ad cookies” at the foot of the page changes the choice. The brand is responsible for these tags and for mentioning them in its own privacy notice.

Visits are counted the same way as scans, and more simply: the time; whether it was a page view or a tap, and which button; whether the visitor came from a QR code or a link, and for links whether it was opened from social media, a search engine, another site or directly; the kind of device and operating system; an approximate location from the network address (country, region, city) from our hosting provider; and a pseudonym that changes every day. We do not store visitors’ IP addresses, we set no cookies on brand pages, and brand pages load no AriaQR Google Tag Manager or Google Analytics. The brand sees these numbers in aggregate.

A brand may add a YouTube video (in its privacy-enhanced mode), a Vimeo video or a Google Map. These load from those services when the visitor scrolls to them, and the services apply their own policies. Links on a page go wherever the brand chose.

An API key is shown to you once. We store only a one-way hash of it, with its label, its first few characters, when it was created and when it was last used, so we cannot read a key back. Requests are rate-limited per key.

You can connect an AI assistant, such as Claude, ChatGPT or another app that speaks MCP, to your account with your key. The assistant then works with your codes, short links and landing pages, within what your plan allows, and what it sends us is handled as described on this page. What the assistant’s own provider does with your conversation is governed by that provider’s terms, not ours. Anything that holds your key, including a connector address with the key in it, can act on your account, so keep it secret and revoke a key you no longer trust from your account page.

A team is a shared workspace. We store its name and, for each member, their email address, role and when they were invited and joined. An invite is emailed to the address you enter, and nothing changes until that person accepts it on their account page. Members see every code made in the team. If you belong to a team, the workspace you are working in is remembered in a cookie.

Most tools at /tools run entirely in your browser: what you type and the files you choose stay on your device. Three upload an image to our server: the QR code reader, the QR code tester and the QR code to SVG converter. We read or test the code, check any link it holds against Google Safe Browsing, and send back the answer. We do not keep the image.

When you use AriaQR inside Canva, Canva tells us who is asking with a signed token that carries an opaque Canva user and team identifier. It does not give us your name or email address, and we do not ask for them.

A free code made in Canva is generated and handed straight back to your design. We keep neither your image nor the code afterwards; the working files are deleted as soon as the code is returned. The identifier is used only to limit how many codes can be made in an hour.

A live code made in Canva is an ordinary AriaQR code, handled as described on this page, except that an unactivated one is kept for thirty days rather than seven, because a design may be printed weeks later. We store the Canva identifier with the code so the app can list your live codes and show when one has been activated; it is deleted with the code. Payment happens on ariaqr.com, not inside Canva.

Rupee payments are processed by Razorpay and dollar payments by PayPal. Card, UPI and bank details are entered with them and are never seen or stored by us. From each payment we keep what an invoice needs: the amount, currency, date, what was bought, the provider’s payment and order references, the email the receipt went to, and the approximate location the payment came from (country, region, city), which sets the place of supply for GST. If someone pays for a code that is not theirs, we keep their email for the receipt only and never send them the code’s private links. Invoices carry a sequential number and are kept for as long as the law requires us to keep accounting records, currently eight years in India, even if you delete your account.

If you enter billing details (name, company, tax ID, address, billing email) they are stored on your account and printed on your invoices; you can change or clear them at any time. Receipts and invoices are emailed with the PDF attached. Promo codes you use are recorded against the purchase so the offer can be honoured and its use counted.

We read the country a request comes from, as provided by our hosting provider, to show and charge prices in the right currency. If your device’s time zone is India, we may set rupees for you. Your currency is remembered in a cookie for a year, and the pricing page lets you change it, though rupees are only offered when the network is in India or cannot be placed.

Needed for the site to work:

• Sign-in cookies: your session (up to 30 days), protection against forged requests, and where to return after signing in.
• aq_currency: rupees or dollars, for a year.
• aq_lang: the language you read the site in, for a year.
• aq_team: the team workspace you are in, for a year, only if you use teams.
• Browser storage: aq:consent (your cookie choice), your in-progress picture code and its private link (cleared when you sign out), and a promo code you typed (until you close the tab).

Analytics and advertising measurement: Google Tag Manager loads Google Analytics, which we use to understand traffic and measure our advertising, under Google Consent Mode. If your device’s time zone is in Europe (or in an EU region outside it, such as the Canary Islands or Cyprus), or your network’s country is in the EU, the EEA, the UK or Switzerland (checked when your time zone says otherwise, for example on a VPN or while travelling), these cookies stay off until you accept them in the bar at the bottom of the page. The country check keeps nothing and sets no cookie. Elsewhere they are on by default. Anyone, anywhere, can accept or decline at any time with “Cookie settings” in the footer, and the choice is remembered. When you are signed in and these cookies are on, we also give Google Analytics a scrambled code for your account, so visits from your phone and computer count as one person; it is never your email or name, and it stops when you sign out. Google Analytics may also use Google signals: for visitors signed in to Google who allow personalised ads, Google adds age-range and interest reports (only in totals, never about one person) and lets us show our ads again to people who visited. You can turn personalised ads off at any time in Google’s Ads Settings (adssettings.google.com).

Product analytics: PostHog shows us how people use ariaqr.com: which pages and buttons they use, where they stop, and replays of visits with everything typed into forms hidden. It follows the same choice as Google Analytics: off in the EU, the EEA, the UK and Switzerland until you accept, on by default elsewhere, and off whenever you decline. Replays pause on account, sign-in and payment pages. PostHog stores this data in the United States.

Google’s quick sign-in: when you are signed out, Google may show a “Continue as…” prompt. It loads Google’s sign-in script, which lets Google know the page was visited and, if you are signed in to Google, show your Google name and picture. We receive nothing unless you tap it. It follows the same choice as the analytics above; the Google button on the sign-in page works either way.

Advertising: ariaqr.com uses the Meta Pixel so we can measure our own ads on Facebook and Instagram and show them to people who visited. It loads only under the same choice as the analytics above, never on account, sign-in, payment or code-statistics pages, never on brand landing pages, and not on a page whose address carries anything you typed. It tells Meta which public page you viewed and when you start a checkout, subscribe, send a business enquiry or complete a purchase (the amount and currency only). Meta sets its own cookies and handles that data under its own policies, including in the United States.

Search optimisation: a script from Nuwtonic loads search-optimised content for the page you are on, such as its title, description and structured data. Your browser fetches it from Nuwtonic’s servers, which see your network address and the page’s address. It follows the same choice as the analytics above, and never runs on brand landing pages.

Vercel Web Analytics: page views of ariaqr.com are also counted by Vercel, who hosts the site, without cookies: the page’s address with nothing after the question mark, the country, the kind of device and browser, and the page the visit came from. It is off on customers’ landing pages, file pages, scans and your account pages, and Vercel keeps the counts in the United States.

Our own visit counter: every page of ariaqr.com is also counted the same way as landing-page visits, without cookies or anything stored on your device: the page, how long it was on screen and how far you scrolled, where the visit came from (an ad, a search engine, an AI assistant, an email, another site), the kind of device, an approximate location from the network, and a pseudonym that changes every day. We never store your IP address for this, and the counts are only seen by our own staff.

Scanning a code, opening a short link and visiting a brand’s landing page set no cookies, as described above.

Sign-in codes and find-my-code codes; receipts and invoices; plan reminders before a quarter ends and when a plan lapses; renewal reminders for free codes and free short links; team invites; the alerts and digests you switch on for a code, and the link that confirms an alert address; and notices about your own links, such as a warning placed on one after reports. When you create an account, a welcome email and up to two short follow-ups about getting started. When you claim a free art code, that code and up to two reminders while it is unused; in the EU, the EEA, the UK and Switzerland the reminders only come if you ticked the box to hear from us, and the two sign-up follow-ups are not sent there either. If you came from one of our ads and typed your email at checkout but didn’t finish, one reminder the next day (not in the EU, the EEA, the UK or Switzerland). Tips and offers only if you ticked that box. Every one of these has a one-click unsubscribe. Email is sent through Resend. The records behind these emails (which address got which, and when) are kept for 180 days after a series ends, two years for a free-code claim, and 30 days for a checkout reminder. If making a code fails on our side and you leave your email, we use it only to tell you when it works, and delete it after 30 days.

Destinations we host are checked against Google Safe Browsing when a code, short link or landing page is made, changed or published, and short links and free codes are checked again every day. That check sends Google the destination address, nothing about you.

Anyone can report a link without an account. We keep the reason, the details the reporter writes, and an optional email for us to reply to, which goes to our abuse inbox. To count each reporter once we keep a salted one-way hash of the reporter’s network block (the first three parts of an IPv4 address, or the first half of an IPv6 address), never the address itself. When 3 different networks report a short link or a free code, visitors see a warning first, and we email the link’s owner. Reports stay on the link until we review it. The rules are on the acceptable use page.

The business enquiry form stores your name, email, company, role, expected volume, use case, message and the network address it was sent from, and emails them to our inbox so we can reply. “Find my code” emails a one-time code to the address you paid with and, once you enter it, lists the codes bought with that address; it does not sign you in. Emails you send us are kept in our inbox.

To stop scripts abusing free features, we count requests per account or per network for a short window. Network addresses are counted as a salted one-way hash, never stored as they are.

Under data protection laws such as the GDPR, each use of personal data needs a legal basis. Ours are:

• To provide the service you ask for (a contract with you): your account and sign-in, making, storing and serving your codes, short links and landing pages, payments and invoices, the API, MCP and Canva app, and the emails that go with them.
• Our legitimate interests, weighed against yours: keeping the service safe and working (link safety checks, abuse reports, rate limits, error logs), placing scans and clicks to a city for the owner’s analytics, and counting visits to ariaqr.com without cookies. You can object to these at any time.
• Your consent, which you can withdraw at any time: Google Analytics, PostHog, the Meta Pixel, Google’s quick sign-in prompt and the Nuwtonic script on ariaqr.com where consent is required; marketing email; and a precise location a scanner chooses to share.
• A legal obligation: keeping invoices and payment records, and answering lawful requests from authorities.

When a business uses AriaQR for its codes, short links or landing pages, that business decides why the scans, clicks and visits are counted, and we process that data on its behalf under our data processing terms.

We do not sell data. We use these services, each only for what is listed, or share data where the law requires it:

• Vercel: hosting and storage for everything on this page, and the network location lookup.
• Google: sign-in if you choose Google, and its quick sign-in prompt under your cookie choice; Google Tag Manager and Google Analytics on ariaqr.com, as set out under cookies; Safe Browsing (destination addresses); and the Gemini models, for images you choose to enhance and for the page designer’s briefs and text.
• Resend: the recipient address and contents of the emails we send.
• Razorpay and PayPal: payments.
• ipwho.is and ipinfo.io: a scanner’s network address, only when our own lookup cannot place it to a city.
• BigDataCloud: a scanner’s coordinates, sent by their phone, only for codes with the precise-location prompt and only after the scanner agrees.
• OpenStreetMap Nominatim: a placement address you type.
• PostHog (United States): product analytics and visit replays on ariaqr.com, under your cookie choice.
• Nuwtonic: the search-optimisation script on ariaqr.com, under your cookie choice.
• Meta Platforms (Ireland and the United States): the Meta Pixel for our own ads on ariaqr.com, under your cookie choice.
• OpenFreeMap: the map tiles in your analytics dashboard, which your browser loads.
• Canva: only when you use our Canva app, as described above.

Your data is stored and processed on our hosting provider Vercel’s servers in the United States, with a global network that serves pages from near you. The other services above process data in the countries where they operate. Realityrift Innovations Private Limited is a company registered in India.

When personal data from the European Economic Area, the United Kingdom or Switzerland is processed outside it, we rely on the European Commission’s Standard Contractual Clauses, and the UK addendum to them, included in our main providers’ data processing terms. You can ask us for a copy of the safeguards that apply.

• Your account: until you delete it, or ask us to.
• Picture codes never activated: seven days (thirty for live codes made in Canva). The temporary copy for AI enhancement: within a day.
• Activated codes and short links made on a plan: for as long as you keep them.
• Free codes and free short links: a year from their last renewal, then paused, then deleted 30 days later.
• Scan and click events: while their code or link exists, and deleted with it. Precise locations a scanner chose to share: 90 days.
• Landing pages, their photos and visitor statistics: until the page is deleted.
• Sign-in codes: ten minutes.
• Abuse reports: until we review the link, and kept even if its account is deleted.
• Payments and invoices: as long as the law requires accounting records, currently eight years in India.

• Every page, scan and API call travels over TLS 1.2 or 1.3. Plain HTTP is redirected, and browsers are told never to use it.
• Images, codes and account data sit in a private store with no public addresses, encrypted at rest with AES-256. Every read goes through our servers.
• There are no passwords to leak: you sign in with Google or a one-time code. API keys are kept only as salted hashes, and private links carry long random secrets.
• Card, UPI and bank details are entered with Razorpay or PayPal and never reach us.
• Access to production systems is limited to the people who run AriaQR.

If a breach puts your personal data at risk, we tell you without undue delay, and we notify the data protection authority within 72 hours where the law requires it.

Realityrift Innovations Private Limited is certified to ISO/IEC 20000-1 (IT service management) and ISO 9001 (quality management). The certificates are valid until 22 June 2029 and 10 November 2027. They cover how the company runs services and quality; they are not security or privacy certifications.

You can delete your account yourself: on your account page, choose “Delete account” and type DELETE to confirm. You can also email us and we will do it for you. Deletion is permanent and removes:

• the account and its sign-ins;
• every code it owns, with their images and files. Live codes stop working, including printed ones, so download or move what you need first;
• its short links. Their names stay held for 60 days, so nobody else can take them and catch their old clicks;
• its landing pages, their photos and their subdomains;
• all of its scan, click and visitor analytics;
• its API keys and AI connectors;
• teams it owns, whose members lose access to those teams’ codes, and its memberships in other teams.

Unused plan time and activations are given up, with no refund. Two things are kept because the law or safety requires it: invoices and payment records, for as long as the law requires accounting records (currently eight years in India), and abuse reports about the account’s links.

You have the right to:

• access the personal data we hold about you, and get a copy in a common, machine-readable format to take elsewhere;
• correct it if it is wrong, and delete it;
• restrict how we use it while a question about it is settled;
• object to uses based on our legitimate interests;
• withdraw consent where we rely on it, without affecting what happened before;
• not be subject to decisions made only by automated means that have legal or similarly significant effects. We make none.

Much of this you can do yourself: delete codes, short links, landing pages or your whole account, change or clear your billing details, revoke API keys, and export a code’s scan events. For anything else, write to the address below. We answer within one month at most, and usually within a few days.

If you are unhappy with how we handle your data, tell us first so we can fix it. You also have the right to complain to the data protection authority where you live or work.

AriaQR is not directed at children under 13, and we do not knowingly collect their data.

If we change how we handle data, we update this page and the date above.

Realityrift Innovations Private Limited is responsible for the personal data described on this page. For privacy questions, requests and complaints, write to info@realityrift.co. See also our terms, data processing terms for businesses, acceptable use policy and refund policy.