Privacy Policy
Last updated · 4 May 2026
QR Pelle is run from Sweden, hosted in the EU, and follows GDPR. This page explains what we collect and why, in plain language. If anything is unclear, email pelle@3dpelle.se.
Who's the data controller?
Pelle Malviker, Linghem, Sweden. Reach me at pelle@3dpelle.se.
What we collect about you
- Account info — your email, optional name, password, and your plan (Free / Pro). Passwords are never stored in plain text.
- Your QR codes — the destination, label, and the design choices you made.
- A login cookie — keeps you signed in. No third-party trackers.
What we collect about people who scan your codes
- Roughly where they are — country, city, and rough coordinates, derived from their IP at scan time.
- What they scanned with — browser, operating system, device type, and the page they came from if any.
- An anonymous fingerprint — we hash visitor IP addresses with a server-side secret. The raw IP is never stored. The hash lets us count unique scanners without knowing who they are.
Drafts and Free-tier codes don't collect any of this — only live, published codes do. If you'd prefer your codes to log only country-level location, email us and we'll set that up for your account.
Why we collect it
- To run your account and let you log in.
- To send people to the right place when they scan a code.
- To show you the analytics for your codes.
- To prevent abuse and enforce our Terms.
Who else touches your data
- Vercel — hosts the app and serves your codes.
- Supabase — stores your account and scan data, in the EU (Stockholm).
- Resend — sends our emails (verification, password reset, weekly recap).
- Google — only if you choose Sign in with Google. They tell us your email and name.
We don't sell your data, train models on it, or share it with marketing networks. The full list of subprocessors lives in our DPA.
How long we keep it
- Account data — until you delete your account.
- Scan data — for as long as the QR code exists. Deleting the code deletes its scans.
Your rights
Under GDPR you can:
- See the data we have on you.
- Get a copy you can take elsewhere.
- Correct anything that's wrong.
- Have your account deleted.
- Object to or limit how we process it.
- Complain to the Swedish data protection authority (IMY) if you think we're handling your data badly.
To exercise any of these, email pelle@3dpelle.se. We'll respond within 30 days.
Cookies
One cookie keeps you signed in. That's it. No analytics or advertising cookies — we use Vercel Analytics, which is cookie-less and aggregated.
Changes
We'll let you know if we change this policy in any meaningful way and update the "last updated" date at the top.