Privacy Policy

If you create an account, Supabase Auth processes your email address, password authentication, account identifier, confirmation status, sessions, and related authentication records. LumenQR does not receive or store your plaintext password.

If you choose Google sign in, Google and Supabase may return the basic identity details used for authentication, such as your name, email address, and profile image. LumenQR does not request Google Drive or Gmail data, offline access, or additional Google product scopes, and the application does not read or save a Google provider token in custom storage.

After you finish creating an account, LumenQR sends one welcome email to your account address through Cloudflare Email Service. It is a one-time transactional message with no marketing content or tracking, and it is sent only when an account first becomes confirmed.

When you use Dynamic QR codes, LumenQR stores each code's name, destination URL, generated short code, design data and schema version, status (live, paused, or archived), safety and synchronization state, record version, lifetime scan total, and creation, update, publication, and archival timestamps. These records are associated with your account so that only you can manage your codes through the dashboard.

Dynamic QR codes are live: the short link they encode temporarily redirects scanners to your stored destination. When a live code is scanned, the redirect service reads only the short code and records the scan as privacy-minimized aggregates — a lifetime count and a per-code, per-UTC-day count. It does not read or store the scanner's IP address, user agent, referer, or destination query data.

For the hosted destination types (PDF, image gallery, video, social links, app, menu, event, coupon, and feedback), LumenQR also stores the content you enter — such as titles, descriptions, links, menu items, event details, coupon terms, and feedback prompts — and the files you upload. Uploaded PDFs and images are kept in private Supabase Storage that is not publicly listable, and scanners receive the bytes only through same-origin /p/ links that proxy them while your code is live — storage object paths and account identifiers are never exposed. Hosted pages are served by LumenQR under the /p/ path with noindex instructions. When a record is archived and later tombstoned after account deletion, its hosted content is removed and its files are detached and purged by an automated cleanup; abandoned uploads that are never attached to a code expire and are removed the same way.

Responses submitted to a feedback QR code are protected by Cloudflare Turnstile verification and store only the star rating and comment the scanner writes, plus a pseudonymous anti-abuse HMAC derived from the scanner's IP address under a server-only secret for throttling and duplicate detection. A daily retention job deletes these response records after they become more than 180 days old. The scanner's raw IP address, user agent, referer, and device data are never stored. As the code owner, you see the response count, the average rating, and the five most recent responses in your dashboard.

The feedback page (/feedback) shows a curated selection of user feedback and occasional LumenQR community notes that anyone can read without an account. Feedback you submit through the form requires a signed-in account and is linked to your account identifier. When you submit, LumenQR collects the feedback category you choose, the message you write, the same-origin page path (pathname only) you sent it from, and an optional reply email address if you choose to provide one. Do not include passwords, authentication links, access tokens, or other secrets in your message.

User submissions are private by default and are reviewed by the LumenQR team before anything is published. When you submit, you may explicitly opt in — through an unchecked-by-default consent checkbox — to let an approved message be published anonymously. If you do, a reviewer may later publish it; if you do not, it is never published. Public display of a user submission is always Anonymous. For every public entry, the page and public feedback API return only an opaque entry ID, a non-personal source type, the feedback category, the message text, and the publication date: your email address, account identifier, page path, and all other submission details are never published or returned.

LumenQR community notes are published directly by the team rather than through the user feedback form. They contain no submitter account identifier, reply email address, IP-derived abuse hash, or other user identity data, and they follow the same daily feedback retention schedule.

To prevent spam and abuse, each submission is protected by Cloudflare Turnstile verification, and LumenQR stores a pseudonymous anti-abuse HMAC derived from your IP address under a server-only secret for rate limiting and duplicate detection. The HMAC is removed with the submission under the daily retention schedule described below. Your raw IP address, user agent, and device data are never stored in the feedback database. Rate limits restrict how much feedback one submitter can send, and duplicate submissions are detected with a normalized content hash.

Feedback submissions are stored in the Supabase database and reviewed by the LumenQR team. Each accepted submission also triggers a notification email to the team delivered through Cloudflare Email Service; the notification contains the feedback content and your publication-consent choice but never your IP address or the abuse hash.

Hosting, security, and authentication providers may process technical information needed to deliver and protect the service, such as IP address, request time, requested route, browser or device information, security signals, and error or request identifiers.

Google Analytics is enabled for public-page measurement, but the Google tag loads only after you choose Allow analytics. Before you make a choice, or if you choose No thanks, LumenQR does not create the Google Analytics command queue or load the Google tag. It is never loaded on sign-up, authentication callback, or dashboard routes, and it remains off while the account sign-in modal is open. Analytics can resume only after the modal closes and its authentication query parameters are removed.

When you allow analytics, each public-page event uses a sanitized page location containing only the site origin and pathname. LumenQR does not include the page's query string, URL fragment, or referrer in the analytics event. Google Analytics may use cookies or similar technologies and process information such as your device and browser type, approximate location, and interactions with public pages. You may allow or decline analytics when the privacy choice is shown, and you may later withdraw an earlier allowance or change your choice using Analytics preferences in the site footer.

Account and Dynamic QR data is retained while needed to provide and secure the account-based service. Archiving a Dynamic QR code is a permanent action in the current service: the record is logically archived rather than physically deleted, it cannot be restored through the service, and its short code remains reserved. This prevents an old or distributed code from later being reassigned to an unrelated destination.

Feedback submissions, including any optional reply email address, may be deleted sooner once reviewed. A daily retention job deletes any remaining submission after it becomes more than 180 days old. Responses to feedback QR codes follow the same daily schedule. Pseudonymous anti-abuse HMACs are stored only inside those records and are removed with them; published user feedback and LumenQR community notes follow the same schedule.

Provider logs, security records, backups, and analytics may follow provider-specific retention periods. To ask about access, correction, account deletion, withdrawing a published feedback message, or another privacy request, use the feedback page. Requests are reviewed under applicable requirements and may be subject to identity verification and operational, security, recordkeeping, or legal constraints.

LumenQR uses reasonable technical and organizational safeguards, including encrypted transport and access controls. No online service or storage method can be guaranteed completely secure.

The service is not directed to children under 13. If you believe a child has provided account or contact information, please use the feedback page so the situation can be reviewed.