Privacy Policy

Last updated July 26, 2026. The short version: we collect what the service needs to run, and nothing else.

Who's responsible

SolidQR, LLC, an Arkansas limited liability company, operates solidqr.co. Privacy questions and requests: support@solidqr.co.

What we collect, and why

When you buy a code: your email address and your purchase details, so we can give you access to your code and send receipts. Payment is processed by Stripe. Your card number goes to Stripe, never to us, and their handling of it is covered by the Stripe privacy policy.

When someone scans a code: we record the scan so the code's owner can see that it happened: timestamp, coarse location (country, region, city), device type, and the referring source. The scanner's IP address is used to derive that coarse location and a one-way visitor code computed with a secret key we hold, so repeat scans can be counted without storing the address; the raw IP address is never stored in scan analytics. Scan data belongs to the code's owner; we don't sell it or use it for advertising.

When you join a waitlist: the email and the address you wanted, so we can tell you if it becomes available. Nothing else, and no marketing list by stealth.

When you design a code: the designer runs in your browser. While you're checking address availability we use a temporary session identifier to hold your address for a few minutes; it expires on its own.

When you sign in to the dashboard: a sign-in cookie keeps you signed in on that device for 30 days. It identifies your session and nothing else; it doesn't track you, and signing out deletes it on the spot.

If you arrive through an affiliate's link: the link sets a first-party cookie (sqr_ref) on your browser for 90 days, remembering which affiliate sent you so they get credit if you buy something. It contains only the affiliate's code, follows you nowhere, and is never shared beyond the purchase record.

Server logs: like every website, our servers keep standard access logs (IP, request, time) for security and debugging, retained briefly and then discarded.

If you join the affiliate program: your name, email, and the payout handle you give us (PayPal or Venmo), so we can pay you. If your earnings reach the IRS reporting threshold, we ask for tax information (a W-9, including a tax ID) so we can file the required 1099. That form is encrypted before it's ever stored, decrypted only to file taxes, and every decryption is logged.

If you join the affiliate waitlist: your email, and, if you're outside the United States, the country you tell us you're in. We use it to email you when the program opens where you are, and to work out which countries to open first. Nothing else.

What we don't do

No selling or renting personal data. To anyone. Ever.
No advertising trackers, no cross-site tracking, no third-party analytics scripts on this site.
No third-party or cross-site tracking. Every cookie we set is first-party and listed on this page, and the site works without asking you to accept anything.
No reading your destination content; we scan destinations only for abuse (phishing, malware).

Who we share with

Only the vendors required to run the service: Stripe (payments), our infrastructure providers (hosting and content delivery), and an email delivery service for receipts and service notices. Each receives only what its job requires. We disclose data if the law genuinely compels us to, and we'll tell you when we're allowed to.

Retention and your rights

Purchase records are kept as long as your code is active (that's the product) plus what tax law requires. Waitlist entries are kept until the address is resolved or you ask out. You can ask us at any time to show you or correct the personal data we hold about you. Email support@solidqr.co and a human will handle it.

If you're a California resident, this covers your rights under the CCPA: to know what we hold, to correct it, to delete it, and to opt out of the sale or sharing of your data. On that last one, we already don't sell or share personal data with anyone, for any reason, so there's nothing to opt out of. If you're in the EU or UK, the GDPR gives you the same rights, plus the right to erasure described below under "Deleting yourself." Whichever law you're writing under, the same email address handles it.

One exception: if we've filed a 1099 using your affiliate tax information, that record can't be deleted on request. Tax law requires we keep it for several years after filing, and we do, even if you'd otherwise qualify for full erasure. Everything else about your affiliate account (name, email, payout handle) follows the same deletion rights as the rest of this policy.

Deleting yourself

You can delete yourself completely. We won't make you hunt for it, and we won't guilt you out of it. Here is exactly how it works:

Ask, then verify. Email support@solidqr.co from the address on your purchase, or use the delete option in your dashboard. We confirm the request through a verification link sent to that email, so nobody can delete you but you.
Your codes stop working. This is the one thing you can do that ends your codes, and we want it in bold before you confirm: deletion permanently invalidates every dynamic code you own. Anything printed with them stops redirecting.
Two weeks to change your mind. Your codes are switched off the moment you confirm, but we retain your information for 14 days in case you reconsider. Reply to the confirmation email within those 14 days and everything is restored exactly as it was. After 14 days, your personal data is permanently erased.
Or right now. If you explicitly demand immediate erasure instead of the 14-day window, we honor that: personal data is permanently erased right away, and there is no restoring it. This is the same right the GDPR calls erasure and the CCPA calls deletion; asking for either by name works exactly the same way.
No refunds on self-deletion. Deleting yourself is not a return. One-time purchases are not refunded when you delete your account (the standard 30-day guarantee in our terms still applies on its own merits), and an active Pro subscription is canceled without proration.
Your old address is retired, not resold. After deletion, your personalized address is permanently retired. We never resell it, so nothing you printed can ever be pointed somewhere else by a stranger.

Children

The service isn't directed at children under 13 and we don't knowingly collect their data.

Changes

If this policy changes, the new version is posted here with a new date. We won't quietly grant ourselves new uses of old data.

Related: Terms of service