Privacy policy
Last updated 11 November 2026
Who we are
SealQR (sealqr.codes) is run by Taraxa Studio, a software studio founded by Ribhararnus Pracutian. For account data, Taraxa Studio is the controller. Write to privacy@sealqr.codes with any privacy question or request.
What we collect
Your account. Your email address. If you sign in with Google, also your name and profile picture from Google.
Sign-in records. Each signed-in session stores the IP address and browser it started from, so we can spot a stolen login. A session lasts up to 30 days. Email sign-in links expire after 15 minutes.
Your codes. Each code's name, short link, the link it opens, every earlier link (so you can see its history), and a log of who in your workspace changed what.
People who scan a code. When someone scans a code, our redirect service looks up the short link and sends them on. We add one to a daily count for that code, split by country and city (from the network, not GPS), type of device, operating system and browser. To count each phone once a day, we keep a one-way code made from the IP address, the browser and a secret key, and delete it the next day. We never store the IP address itself, we keep no record of the individual scan, and we set no cookies on the people who scan.
Codes made in the free generator. Static codes are made in your browser. What you type into the generator never reaches our servers.
Cookies. We use cookies only to keep you signed in. The website has no advertising or analytics cookies. If you switch the site to dark mode, your browser remembers that choice locally.
Payments. When you buy a paid plan, Polar handles the checkout as merchant of record. Polar tells us which plan you are on and whether it is paid. We never see your card number.
Why we use it
- To run your account and your codes (contract).
- To keep the service safe: stopping stolen logins, phishing codes and abuse (legitimate interests).
- To keep billing and tax records the law requires (legal obligation).
We do not sell personal data and we do not use it for advertising.
Who processes it for us
- Cloudflare: hosting, database, the redirect service, forwarding of email sent to sealqr.codes addresses, and the check of each code's link against its malware and phishing lists.
- Resend: sends sign-in emails.
- Google: Google sign-in.
- Polar: payments and tax, for paid plans.
Some of these companies process data outside your country, including in the United States. We rely on their standard data protection terms for those transfers. We will list any new provider on this page at least 30 days before it starts handling your data.
How long we keep it
- Account and code data: while your account exists.
- Sign-in sessions: up to 30 days.
- Billing records: as long as tax law requires.
When you ask us to delete your account, we delete your account details and sign-in records within 30 days. Your codes keep opening their last link, because printed codes must not break, unless you ask us to switch them off too.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask for it in a file you can take elsewhere. Email privacy@sealqr.codes from your account's email address. We reply within one month. You can also complain to the data protection authority where you live.
Age
SealQR accounts are for people aged 16 and over.
Changes
If we change this policy in a way that affects you, we email account holders before the change takes effect. The date at the top shows the latest version.