Privacy notice

When someone scans a dynamic QR code or opens a digital card, we record:

• The time of the scan
• Approximate location — country, region and city — derived from the network connection
• Device type, operating system and browser
• Preferred language
• The referring site, where one exists; scans made straight from a camera app are recorded as “Manual scan”
• A one-way fingerprint used to recognise repeat scans

• We never store IP addresses. The connecting address is used in memory to derive approximate location and the repeat-visit fingerprint, and is then discarded.
• We do not collect names, email addresses or phone numbers of people who scan a code, unless they choose to submit them through a contact form on a digital card.
• We do not collect GPS or precise location. A scan is an ordinary web request; city level is the limit of what it can reveal.
• We do not track scanners across other websites, and we do not send scan data to third-party analytics services.

To count unique visitors we compute a salted, one-way hash of the connecting address and browser identifier. The result cannot be reversed to an IP address.

For scans originating in the EEA, the United Kingdom and Switzerland the salt is rotated every 2557 days, and the fingerprints from the closed window are permanently erased. What remains is an anonymous record of the scan itself. Account administrators can extend this behaviour to all traffic by enabling strict privacy mode.

When you create an account we keep what is needed to run it: your name, email address and password (stored only as a one-way hash), your company's details, your plan and billing status (card details are held by Stripe, never by us), and everything you create -- codes, links, cards, pages, forms, files and settings.

For security we record each sign-in attempt to an account, successful or not, with its time, the connecting address, the browser or app and approximate country. This is how repeated guessing is detected and blocked. Unlike scan records, these are about account access, not about the people who scan your codes.

Contacts you collect -- people who fill in your forms, exchange cards with you, or whose badge or business card you scan -- belong to your account. You decide what to keep, and you can export or delete them at any time; we process them only to provide the service to you.

When someone uses the free QR generator or the free link shortener on our website, we keep a usage record of the time, the approximate location and the kind of device, with no IP address or fingerprint. For short links made with the free tool, and for web-link QR codes downloaded from the free generator, the destination address is kept in these usage records along with the coarse location and device of the request. For every other kind of QR code (for example Wi-Fi or a contact card) only the kind of code is recorded, never its content.

When you arrive on our website from one of our ads or a tagged link, a first-party cookie (lk_click, kept for up to 90 days) remembers the ad click id and campaign tags. If you then sign up, they are stored with your account, and for a Google ad click the click id and the time you signed up are reported back to Google Ads so we can measure our advertising.

Our marketing pages and our sign-up page also load Google's advertising tag, Microsoft Advertising's and TikTok's pixel, which set those companies' own cookies and tell them when a visit from one of our ads becomes a new account. They are not loaded for visitors in the European Economic Area, the United Kingdom or Switzerland, or for a browser that sends the Global Privacy Control signal. They are never loaded inside the signed-in application, and never on anything our customers publish: a scan of a code, a short link, a card, a page or a form sets no cookie and loads no advertising script.

The app uses the same account and the same data as the website. On top of that:

• Camera. Used only while you are scanning or taking a photo. A photo of a business card or badge is sent to Anthropic, our text-reading provider, to read the printed details, which you check before anything is saved.
• Photos and files. Only the ones you choose to upload are read.
• Push notifications. If you turn them on, the app registers your device's notification token and name with us, and notifications are delivered through Google Firebase Cloud Messaging and Expo. Turning them off, or signing out, removes the token.
• NFC. Tap to share sends your card's public link to a phone held against yours, only while that screen is open. Writing an NFC tag puts the same link on the tag. Nothing is read from the other phone.
• Your phone's contacts. The app never reads them. "Save to phone" opens your phone's own contacts app, filled in, for you to save.
• Fingerprint and face unlock. Handled entirely by your phone. The app is told only whether the check passed.
• Shared links and photos. Only what you share into the app is received, and only to make what you then choose.
• Home-screen widgets and the app's speed check keep their data on your phone only.
• Usage figures. Once a day the app tells us it is in use: a random install number made when it is installed, a one-way code made from your phone's app id (so we can tell a reinstall from a new phone; the id itself never leaves the phone), the phone's make, model and system version, the app version, its language, which Google Play link it was installed from, and whether notifications and fingerprint sign-in are on. Where you are is the approximate city our network sees for the connection, as on the website. Each sign-in in the app records which install and which sign-in method was used. We use this only to count installs and active users and to see which versions are still in use; it is never shared or used for advertising.

The app contains no advertising and no third-party analytics or tracking, and we do not sell personal data.

The account owner can close the whole account at any time, on the website or in the app, under Company settings, with Close this account. Closing it erases the company's data -- users, codes, links, cards, pages, forms, files, contacts and reports -- immediately and permanently, and every printed code stops working. An active subscription ends with it.

If you are a member of someone else's account, you can delete your own account at any time, on the website or in the app, under Account, with Delete my account; an administrator of that account can also remove you on its Team page. Deleting it ends every sign-in on every device and erases your profile, two-step codes and saved sign-ins immediately. What you made for the company (codes, links, pages, files) stays with the company, and the company's own activity log keeps its record of what was done. You can also ask us to delete your account or your personal data using the contact details below; we act on requests within 30 days.

Aggregated reporting data is retained for up to seven years. Individual scan records are retained for a shorter window and then deleted, with the aggregates they produced retained.

Depending on where you live you may have rights to access, correct or erase personal data relating to you. Because we do not store identifying information about people who scan codes, we are usually unable to link a scan record to an individual.

• Use the contact form — choose Privacy for a data request, anything about deletion, or a question about what is recorded when a code is scanned. You do not need an account, and you do not need to have signed up.
• Support: support@lynkarr.com

Every message is read by a person. A request about your own data is answered whether or not you are a customer — most people who need to ask are not.