Privacy

Controller

Hendrik Brucker, Stephanienstraße 90, 76133 Karlsruhe, Germany.
E-mail: hendrik.brucker@mail.de

What stays in your browser

QR content, logos, camera frames and dropped images are processed in the page and its workers.

A share link carries the design after the #, which browsers do not send to the server. Opening one tells us nothing about it. What happens to it after you share it is outside our control.

Stored locally: your theme under qrboat:theme and Simple or Advanced under qrboat:lens. In IndexedDB: the design you are working on, logo included, so a reload keeps it, plus the designs you save and the presets you create. None of it is an identifier, none of it is read by another site, and clearing site data removes it.

Camera

The scan page asks for the camera when you start it, and releases it when you stop or leave the page. Frames are read as pixels and discarded. Nothing is recorded.

Server logs

The web server records each request: IP address, time, address requested, referrer, user agent. It needs them to serve the page and to notice an attack, which is the legitimate interest under Art. 6 (1) (f) GDPR. Logs are deleted after 14 days and combined with nothing else.

Analytics

We count visits with Umami, our own installation, served from this domain. It records the page, where you came from, the region the IP address falls in, and the browser and device class. No cookie, and nothing is stored on your device.

To tell a repeat view from a new one, Umami builds a hash of your IP address, your user agent and a salt that changes daily. The address itself is not stored, the hash cannot be reversed, and yesterday's does not match today's. It is an identifier, so we name it instead of claiming there is none. The basis is our legitimate interest in knowing which pages are used, Art. 6 (1) (f) GDPR.

Two events count what the tool is used for: an export, with its format, whether it was downloaded or copied, the content type, the check's verdict and the page it happened on; and a suggested fix you accepted, with the warning it answered. No event carries what you made. Not the payload, not an address, not a filename, not a logo.

No cookies, no tracking

No cookies, so no consent banner. Nothing follows you to other sites and there's no advertising. Every file the page loads comes from this domain, the analytics script included, so no other company sees that you were here. Fonts are served from here too, not fetched from a font provider.

Hosting

The site runs on a server operated for us by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, located in the European Union. IONOS processes the log data above as our processor under Art. 28 GDPR, for no purpose of its own.

Links off the site

The support link goes to Ko-fi. Nothing loads from Ko-fi until you follow it, and what happens then is their privacy policy, not this one.

Your rights

Under Art. 15 to 21 GDPR you can ask for access, correction, erasure, restricted processing and a portable copy, and you can object to processing based on legitimate interest. Write to the address above. What we hold that could concern you is a log line, findable while it exists only by the IP address in it, and analytics rows carrying that day's visit hash, which we cannot tie to you or to each other once the salt has rotated.

You can also complain to a supervisory authority. Ours is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

Changes

Last updated October 1, 2026.