Privacy policy

Who runs the service

• Michał Gwóźdź
• Dylewska 45D, 95-080 Górki Małe
• Tax ID: 7282407206
• REGON (statistical number): 100491012
• Registered in CEIDG, the Polish central register of sole traders

Contact: kontakt@qreska.com

In short

Three sentences. The rest of this page expands on them.

• The content of codes — numbers, addresses, Wi-Fi passwords, business card details, CSV files, photographs and the camera image — is processed in your browser alone and never reaches our server.
• We use no cookies and no third-party tracking scripts.
• The only personal data we can receive from you is an email address you enter on the waiting list of your own accord.

What happens to the content of codes

The generator runs in the browser. A product number, a web address, a Wi-Fi password or business card details typed into the form are turned into an image on your own device. We do not send them anywhere, so we have no access to them and nothing to keep.

The same goes for files. A CSV sheet in bulk generation and a photograph in the reader are read in the browser's memory. The camera image in the reader is examined frame by frame on your device, is not recorded, and goes nowhere.

You do not have to take our word for it. Open your browser's developer tools, go to the network tab and generate a code: you will see no request carrying its content.

What we keep in your browser

We use no cookies. None, not even our own. What we do keep is your generator settings, in the browser's local storage, under a single key: qreska.generator.

It holds the symbology you used last, the appearance of the code — colours, rotation, the text under the code, the export resolution — and the dimensions, separately for each symbology. The content of a code is not a setting and never goes there.

That entry never leaves your device, is never sent to us, and is not used to recognise you. You can remove it by clearing the site data in your browser settings; the service then starts from its defaults.

The waiting list for the paid plan

On the bulk generation page there is a form where you can leave an email address. It is the only form on the site that sends anything.

We then send ourselves a message with your address and a note of which page it came from. The controller of that data is the operator named above, and the basis for processing is your consent, that is article 6(1)(a) GDPR. You may withdraw it at any time by writing to us.

The address serves one purpose: a message when the paid plan starts. We do not add you to a newsletter, we pass the address to nobody, and we use it for nothing else. We keep it until that message is sent or until consent is withdrawn, whichever comes first. If the paid plan never happens, the addresses are deleted.

The form never sends a message to the address typed into it, only to us. That is a safeguard rather than a shortcut: a service that writes to a stranger on request is a tool for harassment.

Server logs and the limit on submissions

Every visit leaves an entry in our server's logs: IP address, time, the page requested, the kind of browser. That is a standard part of running a server, needed to keep it working and secure. The basis is our legitimate interest, article 6(1)(f) GDPR.

At the waiting-list form the IP address serves one further purpose: we count how many submissions came from the same place within ten minutes and refuse the ones beyond that. The counter is held in the server's memory, is written to no database, and disappears when the server restarts.

Visitor statistics

We count visits with Plausible Analytics. It writes no cookie, creates no identifier for the visitor, and cannot recognise you on a later visit or join your visits into one history. That is why we do not ask for consent to statistics and you will not see a banner here: there is nothing to store on your device.

To count a visit the tool uses the address of the page, the address you arrived from, your approximate location (country, region and city worked out from the IP address), the kind of device, browser and operating system, and how long you stayed on the page and how far you scrolled. The IP address and the full browser identifier are not stored: they only go into a hash that recognises the same visit within one day, and the salt for that hash is deleted every 24 hours.

The provider is a processor acting on our behalf under a data processing agreement, and the data is stored on servers in Germany, in the European Union. We share the statistics with nobody and use them for neither advertising nor profiling.

Who else sees the data

We entrust data only to the providers the service cannot run without. Today there are two.

• Hetzner Online GmbH, Gunzenhausen, Germany — the server the site runs on, in a data centre in Finland. The server logs are kept there too.
• Resend, Inc. — delivery of the waiting-list message to our mailbox; it handles only the addresses typed into that form.
• Hetzner processes data within the European Union. Resend is based outside the European Economic Area, so waiting-list addresses may be processed outside the EEA under the standard contractual clauses approved by the European Commission.

Your rights

You have the right to access your data, to rectify it, to have it erased, to restrict processing, to data portability, and to object to processing based on legitimate interest. Consent to be contacted about the paid plan may be withdrawn at any time; that does not affect the lawfulness of processing before the withdrawal.

In practice one message to the address on the contact page is enough. An address is removed from the waiting list straight away, and we confirm that we have done it.

You may also lodge a complaint with the President of the Personal Data Protection Office in Poland.

Changes to this policy

If what we do with data changes, this page changes, and the date at the top says when. A change of provider, or switching visitor statistics on, will be described here before it happens.