appqr.io

Privacy Policy

Last updated: September 9, 2026

1. Who We Are

appqr.io ("we", "us", "our") is operated by Appik Studio. We provide smart app store redirect links and QR codes. This policy explains how we collect, use, store, and protect your data, including data obtained through Google APIs.

2. Data We Collect

We collect the minimum data necessary to provide our service:

  • Account data: Email address and password (hashed) when you create an account, or profile information from Google if you use Google Sign-In (see Section 5 for details on Google data).
  • Link data: The app store URLs, slugs, and QR code configurations you create.
  • Click analytics: When someone clicks your redirect link, we keep aggregate counts by day, device type, normalized traffic source, and approximate country. We do not store IP addresses.
  • Android install attribution: If a Business customer enables the beta SDK, we store a hash of an anonymous 30-day click token, the configured Android package, Play-provided click/install timestamps, SDK version, and the attributed link. Google Play Integrity verifies that the report comes from a licensed, Play-recognized app on an intact device; AppQR does not retain the integrity token or verdict. We do not store advertising IDs, IP addresses, user agents, or device fingerprints for this feature.
  • Native SDK abuse prevention: Android first-open and native-open verification temporarily store app-scoped, one-way network hashes to prevent excessive Play Integrity requests. The hashes expire after five minutes. AppQR does not retain the raw IP address, user agent, or a device fingerprint.
  • Payment data: Payments are processed by Creem.io (our Merchant of Record). We store your Creem customer ID and subscription status. We never see or store your credit card details.
  • Account funnel milestones: We store when an account creates its first link and when an authenticated checkout starts, produces a payment URL, fails, or completes. These operational records include the account, plan, billing period, and a broad first-touch audience segment when available. They do not include card details, page-view histories, or raw error messages.
  • Operational account and billing notifications: When a verified account is created, a prepared account is claimed, or a purchase, renewal, or refund occurs, we send a restricted internal Slack notification. Account notifications contain the account name and email, sign-in method, and, for a claim, the invited email and prepared app link. Billing notifications also contain the event type, plan, amount, account creation date, aggregate link and monthly click counts, and available consented campaign context. We do not send passwords, claim tokens, card details, or raw Creem identifiers to Slack.
  • Usage data: With your consent, we use PostHog for product analytics such as page views, feature usage, application errors, and purchase, renewal, or refund lifecycle events with plan, billing period, value, currency, and first-touch campaign context. We do not send raw Creem customer, checkout, order, transaction, subscription, or product identifiers to PostHog. No client-side or server-side PostHog event is sent when analytics consent is declined.
  • Advertising measurement: With your consent, the Meta Pixel measures visits to our public marketing and signup pages and completed registrations, while Meta's server-side Conversions API measures completed purchases. Pixel events may include the page URL, referrer, browser and device information, IP address, and Meta cookie identifiers. Purchase events include value and currency, pseudonymous hashed AppQR account and event identifiers, the consented landing page, and available Meta click or cookie identifiers. We do not send names, email addresses, card details, Creem customer, order, transaction, or product identifiers, customer-created redirect activity, or dashboard activity to Meta.

3. How We Use Your Data

  • To provide and improve the appqr.io service
  • To authenticate your account
  • To display click analytics on your dashboard
  • To process payments and manage your subscription
  • To monitor account onboarding and billing operations and provide customer support
  • To send critical service notifications (downtime, security issues)
  • With your consent, to measure advertising performance and build audiences for future Meta advertising campaigns

We do not sell your data. We do not send marketing emails unless you opt in.

4. Data Sharing

We share data only with the following third-party processors, strictly to operate the service:

  • Convex — database and backend infrastructure (stores account and link data)
  • Vercel — web hosting and edge delivery
  • Creem.io — payment processing (Merchant of Record)
  • Slack — restricted internal account and billing notifications, retained according to our workspace settings
  • PostHog — product analytics (EU-hosted)
  • Meta — consented advertising measurement for public marketing, signup, registration, and purchase conversions
  • Google — OAuth authentication (only if you choose Google Sign-In; see Section 5) and Play Integrity verification for opted-in Android attribution

We will never sell, rent, or trade your personal data to third parties. Data obtained through Google APIs is not shared with any third parties except as described above for the sole purpose of providing and operating the appqr.io service.

5. Google User Data

If you choose to sign in with Google, the following applies:

5.1 Data Accessed

We request access to the following Google user data through OAuth 2.0:

  • Email address (from your Google account profile)
  • Name (first and last name from your Google account profile)
  • Profile picture URL (from your Google account profile)

We only request the minimum scopes necessary for authentication. We do not access your Google contacts, calendar, Drive files, Gmail, or any other Google services.

5.2 How We Use Google Data

Google user data is used exclusively to:

  • Create and authenticate your appqr.io account
  • Display your name and profile picture within the appqr.io dashboard
  • Communicate with you about your account (e.g., service notifications)

We do not use Google user data for advertising, marketing to third parties, or any purpose unrelated to providing the appqr.io service. We do not use Google user data to train AI or machine learning models.

5.3 Google Data Sharing

Your Google user data (email, name, profile picture) is stored in our database hosted on Convex. It is not shared with, sold to, or disclosed to any other third parties beyond what is strictly necessary to operate the service as described in Section 4. We do not transfer Google user data to any advertising platforms, data brokers, or information resellers.

5.4 Google Data Storage and Protection

Google user data is stored securely on Convex's infrastructure with the following protections:

  • All data is encrypted in transit (TLS/HTTPS) and at rest
  • Access to user data is restricted through role-based access controls
  • Authentication tokens are stored securely and are never exposed to client-side code
  • We conduct regular security reviews of our data handling practices

5.5 Google Data Retention and Deletion

We retain Google user data only for as long as your appqr.io account is active. You can request deletion of your Google user data at any time by:

  • Deleting your appqr.io account from the dashboard settings
  • Emailing support@appqr.io with a deletion request

Upon account deletion or data deletion request, all Google user data (email, name, profile picture) will be permanently deleted from our systems within 30 days. You can also revoke appqr.io's access to your Google account at any time through your Google Account permissions page.

6. Data Retention

We retain your account data and account funnel milestones for as long as your account is active. New aggregate click analytics are retained for 7 days on Free and up to 365 days on paid plans. Unconsumed Android attribution tokens expire after 30 days; attributed first-open records are retained for up to 365 days. Legacy analytics created before August 27, 2026 are being retired and are not retained longer than 24 months. If you delete your account, we will delete all associated data within 30 days, except where retention is required by law.

7. Your Rights

You have the right to:

  • Access, correct, or delete your personal data
  • Export your data in a portable format
  • Withdraw consent for analytics or advertising tracking using the Privacy choices control
  • Request deletion of your data by emailing support@appqr.io
  • Revoke third-party access (e.g., Google) at any time

We will respond to data access or deletion requests within 30 days.

8. Cookies

We use essential cookies for authentication and service operation. Optional PostHog analytics and Meta advertising measurement are disabled until you make a choice. If accepted, these providers may use cookies or local storage. You can reject either purpose or change your selection at any time using the Privacy choices control.

9. Security

We use industry-standard security measures including HTTPS encryption, hashed passwords, and access controls. Data is stored on Convex's infrastructure with encryption at rest. However, no method of transmission over the Internet is 100% secure.

10. Children

appqr.io is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us.

11. Changes

We may update this policy from time to time. We will notify registered users of material changes via email. Continued use of the service after changes constitutes acceptance.

12. Contact

For any privacy-related questions or requests, including data access or deletion requests, contact us at: support@appqr.io

appqr.io — Operated by Appik Studio