Privacy Policy

Last updated: October 20, 2026

This policy explains what personal data QR Code OneToDone (the “Service”) processes, why, who receives it, and what rights you have. It covers people with an account and people who scan a QR code created with the Service. Terms we use here are explained in the Terms of Use.

Who is responsible

The Service is operated by OneToDone (“we”, “us”), who is responsible for your personal data (the “controller”). You can reach us at support@onetodone.com.

What we process

Your account

• Your name and email address, and a new address while you confirm a change of email.
• Your password, stored only as a bcrypt hash. We can’t read your password.
• If you sign in with Google or GitHub: the identifier of your account there, linked to your account here, and the name and verified email address it shares with us. We don’t keep the provider’s access tokens or your profile picture.
• When your account was created, when you confirmed your email address, when you last changed your password, when you agreed to the Terms of Use, and when your account was suspended, if it was.
• Single-use links we email you to confirm an address or reset your password. They stop working after 24 hours (confirmation) or 20 minutes (password reset), and are deleted once used.

Your QR codes

For each code: its type, destination, note, shape and colors, short link, number of scans, when its destination was set and last checked, and whether and why it is disabled. A direct code has no short link and no number of scans.

People who scan a QR code

A direct code holds its destination in the image itself, so scanning it opens the destination without contacting the Service, and we receive no data about the scan. When someone scans any other code or opens its short link, we:

• receive their IP address and the details of the request, as every website does;
• use the IP address to limit how many requests one address can make per minute, in memory only;
• check the browser’s user agent to leave bots and link previews out of the count, without storing it;
• add one to the code’s total number of scans.

We set no cookies on short links and don’t record who scanned a code; the code’s owner sees only the total number. The destination is run by the code’s owner or someone else, and its own privacy practices apply there.

Server logs

For every request to the Service we log the time, method, address of the page, IP address, response status, duration, and your user ID if you are signed in. When an email can’t be delivered, we log the recipient’s address. Passwords, tokens and other secrets are masked before anything is logged. We use logs to keep the Service secure, investigate abuse and fix errors.

Emails

We send only the emails your account needs: confirming your email address, resetting your password, notices about changes to your email address, and a notice when someone tries to register with your address. We don’t send newsletters or marketing.

Cookies

Necessary cookies, which the Service can’t work without:

• Sign-in cookies (authjs.session-token, authjs.csrf-token, authjs.callback-url, possibly with a __Secure- or __Host- prefix): keep you signed in for up to 30 days after your last visit and protect sign-in requests.
• reset-token, pending-email, confirm-token: carry a password reset or confirmation link, or the address you registered with, to the page that needs it, so they never appear in page addresses. Each lasts one hour.
• analytics-consent: remembers your choice about analytics cookies for 180 days.

Analytics cookies, only if you accept them: _ga and _ga_…, set by Google Analytics for up to two years, unless you withdraw your consent.

Google Analytics

Only if you accept analytics cookies, we use Google Analytics 4, provided by Google Ireland Limited in the EEA, the UK and Switzerland and by Google LLC elsewhere, to understand how the site is used: pages visited, approximate location, device and browser, and the site you came from. When you are signed in, we also send our internal ID of your account, never your name or email address, so that visits from your different devices are counted together. Google states that Google Analytics 4 doesn’t log or store IP addresses. You can withdraw your consent at any time with “Cookie settings” at the bottom of every page. See Google’s Privacy Policy.

Google Safe Browsing

To protect people who scan QR codes, we check web destinations with Google Safe Browsing when a code is saved and, for codes with a short link, again after scans. We send Google the destination address only, not who created the code or who scanned it. See Google’s Privacy Policy.

Cloudflare Turnstile

To keep bots away from registration, password reset and repeated failed sign-ins, these forms use Cloudflare Turnstile, provided by Cloudflare, Inc. It checks your browser in the background and only rarely asks you to click. For this, Cloudflare receives your IP address and technical details of your browser and device; we receive only whether the check passed. Turnstile doesn’t use the data for advertising. See Cloudflare’s Turnstile Privacy Addendum.

Why we process it

• To provide the Service you signed up for: your account, QR codes, scan counts and account emails (performance of a contract).
• To keep the Service and the people who scan codes safe: server logs, rate limits, bot checks, destination checks, handling abuse reports, and keeping records about codes and accounts disabled for abuse (our legitimate interests in security and in preventing abuse).
• To understand how the site is used, only with your consent, which you can withdraw at any time.
• To comply with legal obligations, such as answering lawful requests from authorities.

Who receives it

We don’t sell your data or use it for advertising. We share it only with providers that run parts of the Service for us and process the data on our behalf:

• Vercel Inc. (United States), our hosting provider, which runs the Service and keeps its server logs;
• our database provider, which stores account and QR code data;
• our email provider, which delivers account emails;
• Cloudflare, Inc. (United States), for the bot check described above;
• Google, as described above.
• the sign-in provider you choose (Google or GitHub), which confirms who you are under its own privacy policy;

We may also disclose data where the law requires it, to answer valid legal requests, or to protect the rights, safety and property of our users, the public or the Service, for example when handling an abuse report. If the Service passes to a new operator, your data passes with it and this policy continues to apply.

Transfers outside your country

Our providers may process data in countries other than yours, including the United States. Where the law requires it, these transfers rely on safeguards such as the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep it

• Account data and QR codes, with their scan counts: until you delete them or your account.
• Server logs: kept by our hosting provider for a limited time, usually no longer than 30 days.
• Confirmation and reset links: deleted when used or when your account is deleted.
• Analytics data: up to 14 months in Google Analytics.
• Records about codes and accounts disabled for abuse, and emails about abuse reports or your requests: as long as needed to handle them and to prevent repeated abuse.

Your rights

Depending on where you live, for example under the GDPR, you have the right to:

• get a copy of the personal data we hold about you, also in a portable format;
• have it corrected; you can change your name and email address in your profile;
• have it deleted; deleting your account in your profile removes your account, QR codes and scan counts at once;
• object to processing based on our legitimate interests, or ask us to restrict it;
• withdraw your consent to analytics at any time with “Cookie settings”;
• complain to a data protection authority, for example in the country where you live or work.

To use these rights, write to support@onetodone.com from the email address of your account. We answer within one month.

Security

Passwords are stored only as bcrypt hashes, sign-in and other sensitive actions are rate-limited, and secrets are masked in logs. All connections to the Service are encrypted (HTTPS). No system is perfectly secure; if you notice a security problem, tell us at support@onetodone.com.

Children

The Service is not for anyone under 16, and we don’t knowingly collect personal data from them. If you believe a child has created an account, tell us and we will delete it.

Changes to this policy

We may change this policy. The date at the top shows when it last changed, and we will tell you about significant changes by email or on the site.

Contact

Questions about this policy or your data: support@onetodone.com.