Privacy Policy

• You sign in with Google. We receive your name, email address and profile picture, and nothing else from your Google account.
• We don’t store Google access or refresh tokens and cannot act on your Google account.
• When someone scans a dynamic code, we record broad, non-identifying details about the scan. We never store IP addresses.
• We don’t sell personal information.
• You can delete your account and everything in it at any time from your settings.

When you sign in with Google, Google tells us your name, email address, whether that email is verified, and your profile picture URL. We store these to create and identify your account. We also store your Google account identifier so the same Google account always signs in to the same Trioga QR account.

We record when your account was created and when you last signed in, your role (for example, whether you are an administrator) and your account status. If an administrator suspends an account, we store the reason they gave.

Google OAuth access tokens, refresh tokens and ID tokens are not stored. We use Google only to confirm who you are.

We store the QR codes you create: their name, type, content (for example a web address, Wi-Fi network details or contact-card fields), design settings and, for dynamic codes, the current destination and its short link. Content you enter into a static code, such as a Wi-Fi password, is stored so you can view, edit and re-download the code.

If you upload a logo, we check that it is a PNG, JPEG or WebP image, resize it and re-encode it as a PNG. This removes embedded metadata such as camera or location information. The processed image is stored with your account.

We keep a history of significant actions on your codes, such as creating a code or changing a destination (including the previous and new destination), so you and our moderators can see what changed and when.

When someone scans a dynamic code, their device requests the code’s short link and we redirect it to the destination the owner configured. For each scan we record:

• the date and time of the scan;
• a broad device category (mobile, tablet, desktop, automated/bot or other);
• the browser family and operating system family (for example “Chrome” and “Android”), derived from the user-agent header;
• the country, only when our hosting network supplies it as a two-letter country code. We don’t look up locations ourselves and never record precise location;
• a short pseudonymous value calculated from the IP address, user-agent and the current date with a secret key. It changes every day, can’t be reversed into an IP address, and lets us estimate daily unique visitors.

We do not store IP addresses, full user-agent strings, cookies or any identifier that follows a person across days. Code owners see these details only as totals and categories. Counts are scan requests, not unique people.

Static codes contain their content directly. Scanning a static code doesn’t contact our service, so we receive no information about those scans.

Anyone can report a code they think is harmful. A report contains the code, the reason you choose, any details you write, and an email address if you choose to give one so we can follow up. To limit duplicate reports we store a daily-rotating pseudonymous value derived from your IP address, not the IP address itself.

• Session cookie. When you sign in we set a secure, HTTP-only cookie that identifies your session. The session itself is stored on our servers, so signing out (or a suspension) ends it immediately. Sessions last up to 30 days.
• Sign-in security cookies. The sign-in process sets short-lived cookies that protect against cross-site request forgery and keep track of where to return you after signing in.
• Preferences in local storage. Your light/dark theme choice and your decision about advertising cookies are stored in your browser’s local storage. They never leave your device.

We don’t use analytics or tracking cookies on our own pages.

Some public pages of this website (not your dashboard, and never the redirect that happens when a code is scanned) may show advertisements. If an advertising provider that uses cookies, such as Google AdSense, is enabled, its script is loaded only after you choose “Allow” in the advertising notice on that page. If you decline, no advertising script is loaded. Once loaded, the provider processes data under its own privacy policy.

We may also show simple sponsored images that don’t use cookies or scripts. Clicking one takes you to the sponsor’s website.

All traffic is served over HTTPS. To protect the service from abuse we count requests per IP address in the memory of our application server for short periods (a minute to an hour). These counters are not written to disk or a database and disappear when they expire or the server restarts.

Our server logs record errors and operational events. We design these logs to exclude passwords, tokens, cookies and session identifiers. Our hosting and network providers may keep their own access logs.

• Your account data, QR codes, logos and scan records are kept while your account exists.
• When you delete a QR code, it stops working immediately and is hidden from your dashboard. Its short link is permanently reserved so it can never point anywhere else.
• When you delete your account, we permanently delete your profile, sessions, QR codes, scan records, uploaded logos and your own activity history. Your codes’ short links are retired so they can never be reassigned. A record that an account was deleted is kept, without your name or email.
• Actions taken by administrators are kept in an audit log so moderation decisions remain accountable.

• You can view, edit, pause and delete your codes at any time from your dashboard.
• You can change your display name and delete your account from Settings.
• You can decline advertising cookies, or change your choice by clearing this site’s data in your browser.
• For any other request about your information, contact us through the contact page.

If we change how we handle information, we will update this page and the date at the top. For questions about this policy, contact us through the contact page.