Privacy Policy

1. Who We Are

appqr.io ("we", "us", "our") is operated by Appik Studio. We provide smart app store redirect links and QR codes. This policy explains how we collect, use, store, and protect your data, including data obtained through Google APIs.

2. Data We Collect

We collect the minimum data necessary to provide our service:

• Account data: Email address and password (hashed) when you create an account, or profile information from Google if you use Google Sign-In (see Section 5 for details on Google data).
• Link data: The app store URLs, slugs, and QR code configurations you create.
• Click analytics: When someone clicks your redirect link, we log the device type, approximate country (from IP), referrer, and timestamp. We do not store IP addresses.
• Payment data: Payments are processed by Creem.io (our Merchant of Record). We store your Creem customer ID and subscription status. We never see or store your credit card details.
• Usage data: We use PostHog for product analytics (page views, feature usage). You can opt out via your browser's Do Not Track setting.

3. How We Use Your Data

• To provide and improve the appqr.io service
• To authenticate your account
• To display click analytics on your dashboard
• To process payments and manage your subscription
• To send critical service notifications (downtime, security issues)

We do not sell your data. We do not send marketing emails unless you opt in.

4. Data Sharing

We share data only with the following third-party processors, strictly to operate the service:

• Convex — database and backend infrastructure (stores account and link data)
• Vercel — web hosting and edge delivery
• Creem.io — payment processing (Merchant of Record)
• PostHog — product analytics (EU-hosted)
• Google — OAuth authentication (only if you choose Google Sign-In; see Section 5)

We will never sell, rent, or trade your personal data to third parties. Data obtained through Google APIs is not shared with any third parties except as described above for the sole purpose of providing and operating the appqr.io service.

5. Google User Data

If you choose to sign in with Google, the following applies:

5.1 Data Accessed

We request access to the following Google user data through OAuth 2.0:

• Email address (from your Google account profile)
• Name (first and last name from your Google account profile)
• Profile picture URL (from your Google account profile)

We only request the minimum scopes necessary for authentication. We do not access your Google contacts, calendar, Drive files, Gmail, or any other Google services.

5.2 How We Use Google Data

Google user data is used exclusively to:

• Create and authenticate your appqr.io account
• Display your name and profile picture within the appqr.io dashboard
• Communicate with you about your account (e.g., service notifications)

We do not use Google user data for advertising, marketing to third parties, or any purpose unrelated to providing the appqr.io service. We do not use Google user data to train AI or machine learning models.

5.3 Google Data Sharing

Your Google user data (email, name, profile picture) is stored in our database hosted on Convex. It is not shared with, sold to, or disclosed to any other third parties beyond what is strictly necessary to operate the service as described in Section 4. We do not transfer Google user data to any advertising platforms, data brokers, or information resellers.

5.4 Google Data Storage and Protection

Google user data is stored securely on Convex's infrastructure with the following protections:

• All data is encrypted in transit (TLS/HTTPS) and at rest
• Access to user data is restricted through role-based access controls
• Authentication tokens are stored securely and are never exposed to client-side code
• We conduct regular security reviews of our data handling practices

5.5 Google Data Retention and Deletion

We retain Google user data only for as long as your appqr.io account is active. You can request deletion of your Google user data at any time by:

• Deleting your appqr.io account from the dashboard settings
• Emailing support@appqr.io with a deletion request

Upon account deletion or data deletion request, all Google user data (email, name, profile picture) will be permanently deleted from our systems within 30 days. You can also revoke appqr.io's access to your Google account at any time through your Google Account permissions page.

6. Data Retention

We retain your account data for as long as your account is active. Click analytics data is retained for 24 months. If you delete your account, we will delete all associated data within 30 days, except where retention is required by law.

7. Your Rights

You have the right to:

• Access, correct, or delete your personal data
• Export your data in a portable format
• Withdraw consent for analytics tracking
• Request deletion of your data by emailing support@appqr.io
• Revoke third-party access (e.g., Google) at any time

We will respond to data access or deletion requests within 30 days.

8. Cookies

We use essential cookies for authentication (session tokens). We use PostHog for analytics which may set cookies. We do not use advertising or third-party tracking cookies.

9. Security

We use industry-standard security measures including HTTPS encryption, hashed passwords, and access controls. Data is stored on Convex's infrastructure with encryption at rest. However, no method of transmission over the Internet is 100% secure.

10. Children

appqr.io is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us.

11. Changes

We may update this policy from time to time. We will notify registered users of material changes via email. Continued use of the service after changes constitutes acceptance.

12. Contact

For any privacy-related questions or requests, including data access or deletion requests, contact us at: support@appqr.io

appqr.io — Operated by Appik Studio