سياسة الخصوصية
التحليلات
تمثل الأعداد زيارات QR المسجلة لا الزوار الفريدين. تُستبعد الروبوتات المعروفة والتحميلات المسبقة، وقد لا تُسجل الزيارات الزائدة عن الحدود. البلد والجهاز تقديريان وتبقى القيم غير المتاحة «غير معروف». لا تحفظ التحليلات عنوان IP الخام أو User-Agent الأصلي أو GPS أو البصمات. التواريخ بتوقيت UTC؛ تُحفظ التفاصيل 90 يومًا مع إتاحة آخر 7 أيام لخطة Free.
نوع رمز QR
تُحفظ المستندات والصور في تخزين خاص. يمكن فتح ملفات PDF والصفحات المنشورة عبر روابط المشاركة، وتبقى المسودات خاصة. لا يؤدي حذف المورد إلى سحب النسخ التي حفظها الزوار سابقًا.
Your account
QRDesk uses Supabase Auth for your email, password authentication, profile, and saved QR codes. Passwords are handled by Supabase Auth; QRDesk does not store plaintext passwords.
Scan analytics
We retain the code identifier and scan timestamp for up to 90 days. We do not store raw IP addresses, precise locations, or visitor fingerprints. A daily rotating HMAC of a platform-provided address may be held for up to two days for abuse prevention. Infrastructure providers may maintain separate access logs under their own policies. Scan counts are approximate.
Payments
Paddle processes payments as merchant of record. We retain Paddle customer, transaction, subscription, and entitlement identifiers and states. We do not collect card details. Payment methods are determined by Paddle. Currently Sandbox only.
Cookies and providers
Session cookies keep you signed in; a language cookie and local theme preference remember your settings. Supabase, Paddle, and your deployment provider process data needed to deliver the service. Configure provider agreements and international transfer disclosures before launch.
Deletion and retention
Account deletion removes profile, QR codes, and scan events. Required billing records are retained with the user association removed. The operator must set a documented legal retention period and contact method before launch. Exercise account deletion from Settings; cancel subscriptions first.
Operator information
Business operator, privacy contact, jurisdiction, lawful bases, complaint rights, retention obligations, and international transfer safeguards must be supplied and reviewed before real use. No legal entity or address is asserted by this draft.