Skip to content
qr3.app Docs

GDPR & Privacy

Privacy by Design

qr3.app is built GDPR-compliant from the ground up:

  • IP pseudonymisation — IP addresses are immediately converted to purpose-separated HMAC-SHA-256 UTC-day pseudonyms in the edge worker. The original IP is never stored; the pseudonym remains personal data.
  • Retention policies — Scan data is automatically deleted after a plan-dependent period (Free: 7 days, Pro: 90 days, Business: 1 year).
  • Data minimisation — Only data necessary for operation is collected.

Privacy API

Data Summary (Art. 15 GDPR)

GET /v1/account/privacy — Returns an overview of all stored data.

Terminal window
curl https://qr3.app/v1/account/privacy \
  -H "Authorization: Bearer qr3_sk_..."

Response:

{
  "data": {
    "workspace_id": "ws_xxx",
    "stored_data": {
      "qr_codes": { "count": 42, "oldest_at": "2026-03-01T..." },
      "scan_records": { "count": 15000, "oldest_at": "2026-03-01T..." },
      "api_keys": { "count": 2 },
      "webhooks": { "count": 1 }
    },
    "your_rights": {
      "access": "GET /v1/account/export",
      "erasure": "DELETE /v1/account",
      "contact": "[email protected]"
    },
    "data_processing": {
      "legal_basis": "Contract performance (Art. 6(1)(b) GDPR)",
      "sub_processors": [
        { "name": "Cloudflare, Inc.", "purpose": "CDN, edge computing, database" }
      ]
    }
  }
}

Data Export (Art. 20 GDPR)

GET /v1/account/export — Downloads all your data as a JSON file.

Terminal window
curl https://qr3.app/v1/account/export \
  -H "Authorization: Bearer qr3_sk_..." \
  -o my-data.json

GET /v1/account/privacy/consents — Get current consent preferences.

POST /v1/account/privacy/consents — Update consent preferences.

{
  "analytics": true,
  "marketing": false,
  "third_party_integrations": false
}

Account Deletion (Art. 17 GDPR)

DELETE /v1/account — Immediately and irrevocably deletes the account.

Scan Data & Pseudonymisation

Data pointTreatment
IP addressHMAC-SHA-256 UTC-day pseudonym (long-lived master secret + purpose + UTC day), never stored in plain text
Country / RegionDerived from Cloudflare geo data, stored directly
User-AgentParsed to OS/Browser/Device type, raw string discarded
RefererStored as-is (no PII in standard referers)
Accept-LanguageOnly primary language tag stored

Technical implementation of IP pseudonymisation

HTTP request → Cloudflare edge worker
  ↓
CF-Connecting-IP header → HMAC-SHA-256(IP_HASH_SALT, purpose, UTC day, IP)
  ↓
ip_hash (UTC-day pseudonym) → D1 database
  ↓
Original IP is never stored

IP_HASH_SALT is a long-lived master secret; purpose and UTC day automatically derive separate daily pseudonyms. Pseudonyms from different UTC days are not directly equal, but a holder of the secret can recalculate a known IP candidate for a specific day. No KV day salt or manual daily rotation is used.

Contact