Privacy Policy

• Account details: your email, name, and, if you sign in with Google, GitHub, or Facebook, the basic profile those providers share (name, email, avatar). We never see your passwords for those services.
• Waitlist email: if you join the waitlist, just your email address and which page you signed up from.
• Content you upload: logos, images, PDFs, and ZIP files for hosted sites, plus the QR designs and destination settings you create.
• Product usage: how you use the app (pages visited, features used), collected through our own analytics to improve the product. This is internal telemetry, not advertising tracking.

When you buy a plan, your payment details go directly to Polar, which processes payments for us. We never see or store your card number. We keep a record of your plan, its renewal date and your Polar customer reference, so we know what your workspace includes.

When a KuikCode QR code is scanned, our redirect service records a scan event so the code's owner can see how their campaign performs. A scan event contains:

• The time of the scan and which code was scanned.
• Approximate location derived from the network address: city, region, and country. This is the default for every scan.
• Precise location, only if you allow it: some codes have precise scan locations enabled by their owner. Scanning one shows a consent screen first: your exact coordinates are captured only if you tap “Share location” and accept your browser's permission prompt. Declining never blocks the link. Precise coordinates are shown to the code's owner in their scan analytics and are used for nothing else.
• Device basics: device type (mobile/desktop), operating system, browser, language, and timezone.
• Which destination the code sent the visitor to.

We never store raw IP addresses. The IP is used transiently to derive the approximate location and a one-way hashed identifier for counting unique visitors, then discarded. Scan events carry no name, contact detail, or network address, so neither we nor the code's owner can identify who scanned.

Scanning a KuikCode sets no tracking cookie of ours. We don't build profiles of scan visitors, don't track them across sites, and don't use scan data for advertising. The only cookies the scan service sets are functional: one that remembers you unlocked a password-protected code, and one that remembers your answer to the advertising question below.

Retargeting pixels, chosen by some code owners. A code's owner on a Business plan can switch on advertising pixels from Meta (Facebook and Instagram) or Google Ads for that code. Scanning such a code briefly loads the owner's pixel in your browser before the destination opens, which lets that platform set its own cookies and show you the owner's ads later. If you scan from the European Union, the European Economic Area, the United Kingdom or Switzerland, or from a place we cannot determine, nothing loads until you choose Allow or Continue without; either way you reach the destination, and your choice is kept for six months in a cookie tied to that owner. The pixel data goes to Meta or Google under the owner's account and the owner is the controller of it; KuikCode receives none of it.

Note that the destination a code points to (a website, a hosted site, a PDF) is chosen by the code's owner. What that destination collects is governed by the owner's own privacy practices, not this policy.

• To provide the service: routing scans, serving hosted sites, showing analytics to code owners.
• To send transactional email: waitlist confirmation, account and product notices. Marketing email is opt-in and every message has an unsubscribe link.
• To keep the service safe: rate limiting, abuse and fraud prevention. Network addresses are used transiently for this and not retained.
• To improve the product, using our own internal usage analytics.

Where GDPR applies, our legal bases are performance of a contract (running the service for you), legitimate interests (security, product improvement, analytics for code owners), and consent (marketing email).

The KuikCode app uses essential cookies to keep you signed in, and our own product analytics. This marketing site counts visits with cookieless, aggregate analytics: which pages are viewed, the referring site, country and device type. It sets no cookies and builds no profile of you; visitors are counted with an anonymous identifier that resets every day. The free tools on this site run in your browser: what you type in the QR code generator or the event badge maker is never sent to us, and the badge maker asks only for the country your connection comes from, as our hosting provider reports it, to suggest a flag, without storing it. We use no advertising or cross-site tracking cookies anywhere. The scan redirect sets only the two functional cookies described in section 2 (unlocking a protected code, remembering your pixel choice); the advertising cookies a code owner's Meta or Google pixel may set are theirs, and only after your consent where the law requires it.

We share personal data only with the infrastructure providers that run KuikCode (cloud hosting, database, content delivery and storage, scan-analytics processing, rate limiting, transactional email, background jobs, payment processing, website visit analytics, and internal product analytics) under agreements that limit them to processing it for us. If you sign in with Google, GitHub, or Facebook, those providers are involved in sign-in only. A full list of subprocessors is available on request at hello@kuikcode.com.

Beyond these providers, we disclose personal data only if required by law or to protect the rights and safety of KuikCode and its users. We do not sell or rent personal data, and we do not share it with ad networks or data brokers.

• Account data: for as long as your account exists, and deleted when you delete your account or ask us to.
• Content you upload: until you delete it or your account.
• Paused workspaces: if a trial ends or a plan lapses without payment, the workspace is paused, and its codes, pages, sites and files are deleted 60 days later unless a plan is chosen first. We email the owner before that happens.
• Scan analytics: for as long as the owning account is active, so owners keep their campaign history.
• Waitlist emails: until you get access or ask to be removed.

Wherever you live, and specifically under GDPR and CCPA where they apply, you can ask us to access, correct, export, or delete the personal data we hold about you, object to or restrict processing, and withdraw consent. We will never treat you differently for exercising these rights.

You can export your data and delete your account yourself under Settings, Data & Privacy. For anything else, email hello@kuikcode.com and we'll respond within 30 days.

All traffic is encrypted in transit, credentials are hashed, secrets are stored outside the codebase, and access to production data is limited to what operating the service requires. No system is perfectly secure, but the scan-data design above (hashing at ingestion, no raw IPs at rest) means the most sensitive thing we could leak simply isn't stored.

Our infrastructure is primarily in the United States, with content delivered worldwide from a global edge network. Where data moves across borders from the EU/UK, our providers rely on recognized transfer mechanisms such as Standard Contractual Clauses.

KuikCode is not directed to children under 16 and we don't knowingly collect their personal data. If you believe a child has provided us data, contact us and we'll delete it.

We'll update this page as the product evolves. Material changes will be announced by email to account holders. The date at the top always reflects the latest revision.