Privacy Policy

Last updated: October 6, 2026

QRAFT ("the app") is a QR code generator published by Essential Dev Team. This policy explains exactly what data the app does and does not handle. The short version: your QR codes are made entirely on your device, nothing you type is ever sent to us, and the app shares only anonymous usage statistics, which you can switch off.

1. No tracking, no ads

QRAFT has no advertising and no third-party analytics or advertising SDKs. An account is only needed for the optional dynamic-codes subscription (section 8). We do not sell or share personal information, and we do not track you across apps or websites.

2. Every QR code is generated on-device

Every QR code (URL, text, Wi-Fi, email, phone, SMS, contact, location, calendar event) is created entirely on your device. The content you type to build a static code stays on your device unless you choose to sync or save it to your account (section 3). Only the optional dynamic-codes feature uses a hosted backend, as described in section 8.

3. Saved history

Codes you save are stored on your device. They are only uploaded if you are signed in and turn on Settings → Privacy → Sync my saved codes (off by default). With sync on, each saved code — its name, type, content (which can include things like a Wi-Fi password or contact details), style and folder — is stored in your account so it appears on qrft.app and your other devices. Turn sync off at any time; Remove synced copies from server deletes the uploaded copies and keeps everything on your phone. Codes you save on qrft.app are stored in your account in the same way. Folders you create are stored in your account. Deleting a code, or deleting the app, removes the local copy.

4. Photo library

If you export a QR code to your Photos, the app requests permission to add that single image. QRAFT never reads, browses, or uploads your existing photos.

5. Location (when in use)

If you create a location-type QR code, the app can ask for permission to use your location while the app is in use, solely to fill in your current coordinates for that code. This is optional — you can always enter coordinates manually — and your location is used on-device to build the code; it is not sent to us.

6. Purchases

The one-time Design Tools Unlock and the optional subscriptions are processed entirely by Apple via the App Store. We never see or store your payment details. Apple’s privacy policy governs those transactions.

7. Static codes: no backend

Static QR codes are created entirely on your device (or in your browser on qrft.app). Nothing you enter to build them is transmitted to us unless you turn on sync or save them to your account (section 3).

8. Dynamic codes & accounts (optional, subscription)

If you choose to create dynamic codes (an optional, subscription feature), the following applies:

• Backend: dynamic QR codes and scan analytics are powered by Supabase, a hosted backend service (privacy policy: supabase.com/privacy). Your dynamic code destinations, scan counts, and analytics are stored there under your anonymous account.
• Account: you sign in with Apple or email so your codes are saved to your account and reachable from any device. We store your account identifier and email.
• Your codes: the destination URL and label you set are stored so the code can redirect.
• Scan data: when someone scans your dynamic code, we record a timestamp, an approximate country/city, and the device/browser type (from the request's user-agent). To derive the approximate country/city, the scanner's IP address is processed transiently by ipwho.is, a third-party IP geolocation service. We do not store raw IP addresses, precise location, names, or any personal identity of the people scanning.
• More scan details: we also record the scanner's preferred language (two letters, e.g. “es”), an approximate city-level position rounded to about 1 km, the time zone, and the weather at that city at scan time. Scan requests to qrft.app pass through Cloudflare (privacy policy: cloudflare.com/privacypolicy), which supplies the approximate location. Weather comes from the Norwegian Meteorological Institute (MET Norway), which receives only the rounded city coordinates — never anything about the person scanning. A random first-party cookie tells new and returning scanners apart.
• Review pages: if you create a review-page code, people who scan it can give a star rating, pick aspects, and optionally send you a private note and contact details they choose to share. These are stored for you to read. To prevent abuse we keep a one-way hash of the visitor and IP address for rate limiting; the raw IP address is not stored. If a scanner uses the optional “help me write it” button, only their star rating, the aspects they picked and their language are sent to Google Gemini to draft text they can edit (Google’s terms: ai.google.dev/gemini-api/terms); nothing is posted anywhere automatically.
• qrft.app web studio: when you sign in on the web, you see the same account data as in the app. Its map uses map tiles from OpenFreeMap (OpenStreetMap data), which receives the ordinary web requests your browser makes to load the map.

This data exists only to power your editable redirects and scan analytics, and is tied to an anonymous code identifier. If you only ever make static codes, none of this applies to you.

9. Anonymous usage statistics

To learn which features help people and to find crashes, QRAFT sends anonymous usage statistics to our own server (hosted on Supabase). This is our own first-party system — no third-party analytics or advertising SDK is involved. The app identifies itself only with a random installation ID that is created on your device and is deleted together with the app.

What is sent:

• Device model, iOS version and app version
• Language, region and time zone
• Accessibility settings (such as larger text or reduced motion)
• Session start and end, and the last screen you were on
• App events, such as “a code was exported as PNG” or “a code was saved”, including the QR type (URL, Wi-Fi…) — never its content
• Paywall views and which plan was tapped
• Purchase, trial, renewal-status and restore events (the product and plan length only)
• Review-prompt requests
• Crash and performance reports from Apple’s MetricKit

What is never sent: your name, email, phone number or address; your location; the advertising identifier (IDFA) or vendor identifier (IDFV); prices, receipts or transaction IDs; and anything you type or create — QR content, labels, URLs, contacts or Wi-Fi passwords. Your IP address is not stored or used.

Retention: usage statistics are kept for 13 months (crash and performance diagnostics for 6 months), then deleted.

Turn it off: Settings → Privacy → Share Usage Data. When off, nothing is collected or sent, and anything not yet sent is deleted from your device.

Delete it: copy your Installation ID from Settings → Privacy and email it to essentialdevteam@gmail.com; we will delete everything linked to it.

10. Account & data deletion

The app includes an in-app delete account function that permanently removes your account, your dynamic codes, and their scan analytics from our backend. You can also request deletion at any time by emailing essentialdevteam@gmail.com.

11. Children

QRAFT is not directed at children under 13 and does not knowingly collect data from them.

12. Changes

If this policy changes, the updated version will be posted at this URL with a new date.

13. Contact

Questions? Email essentialdevteam@gmail.com.