Privacy Policy

3a. Our Cookie Policy in Summary

We do not use tracking cookies, advertising cookies, or analytics cookies. No cookie is set that identifies you personally or tracks your browsing behaviour across sites.

The following table lists every browser storage item this website sets:

No cookies or localStorage values are shared with, or readable by, any third party. You can clear all localStorage data at any time via your browser settings.

3b. Third-Party Cookies from External Services

The qreagle.com website loads the Inter typeface from Google Fonts. This causes your browser to send a request to fonts.googleapis.com and fonts.gstatic.com. Google may set its own cookies according to its privacy policy. We have no control over these cookies.

• Scope: Font delivery only. Google does not receive any QR code content or user-generated data from us.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in providing a consistently styled website.
• Opt-out: You can block Google Fonts via a browser extension (e.g. uBlock Origin). The site remains fully functional — system fonts are used as fallback.

No other third-party scripts, iframes, tracking pixels, social-media buttons, ad networks, or analytics services are loaded on any page of qreagle.com.

3c. Cookie Consent Banner

When you first visit qreagle.com, a cookie-notice banner appears. You can:

• Accept (Got it) — Dismisses the banner and stores qreagle_cookie_consent_v1 = accepted in localStorage. No additional data is collected as a result.
• Decline — Also dismisses the banner and stores qreagle_cookie_consent_v1 = declined. This signals your preference; we do not change what is collected (because nothing beyond the functional localStorage item is collected regardless of your choice).

Because we do not use tracking or advertising cookies, your choice does not affect the functionality of the website in any way.

4a. QR Code Content You Enter

All text, URLs, phone numbers, addresses, and other data you type into QREagleStudio forms are used exclusively to generate the QR code on your device. This data:

• Is never sent to any server (except Smart Card data — see §5b — and Dynamic QR destination URLs — see §5d).
• Is stored locally in the QR library using Apple’s standard UserDefaults and file-system mechanisms, encrypted by macOS at the file-system level.
• Can be deleted at any time from within the app or by uninstalling QREagleStudio.

Legal basis: Art. 6(1)(b) GDPR — performance of the service you requested.

4b. Style Settings and Preferences

Your chosen pixel shapes, colours, gradients, presets, label text, logo settings, frame options, and all other design preferences are stored locally in UserDefaults on your Mac. These settings never leave your device and are not shared with us or any third party.

Legal basis: Art. 6(1)(b) GDPR — necessary to provide the service.

4c. Address Book / Contacts (Optional)

The app may request access to your macOS Contacts when you create a vCard QR code. This access is entirely optional — you can type contact details manually.

• Purpose: To auto-fill contact fields (name, phone, email, address) in the vCard QR form.
• Scope: Only the specific contact you select is read. The app does not scan, index, or transmit your contacts list.
• Storage: Contact data is processed in-memory only. It is not stored, logged, or transmitted.
• Consent: macOS displays a system permission dialog before any access is granted. Revoke at any time: System Settings → Privacy & Security → Contacts.

Legal basis: Art. 6(1)(a) GDPR — your explicit consent via the macOS permission dialog.

4d. Location Data (Optional)

The app may request your device location when you create a GPS Coordinate, Google Maps, or Apple Maps QR code.

• Purpose: To pre-fill latitude/longitude fields with your current position.
• Scope: A single location reading at the moment you click “Use Current Location”. No background or continuous tracking.
• Storage: The coordinate is placed into the form field only. It is not separately logged or transmitted to us.
• Consent: macOS displays a system permission dialog before access. Revoke at any time: System Settings → Privacy & Security → Location Services.

Legal basis: Art. 6(1)(a) GDPR — your explicit consent.

4e. Photos and Image Files (Optional)

When you add a custom logo, a custom background image, or use the AI colour palette extractor, the app reads the image file you select. The image is processed locally (colour extraction, compositing, logo embedding). It is never uploaded to any server by us.

Note: If you use the AI QR generation feature, your text prompt (not the image) is sent to the Replicate API (see §6b). No image you provide to the app is sent to Replicate.

Legal basis: Art. 6(1)(b) GDPR — necessary to provide the feature you requested.

4f. API Keys for AI Services (Optional)

If you use the AI QR generation feature, you may enter a Replicate API key. This key is stored exclusively in your macOS Keychain — encrypted with AES-256, sandboxed to QREagleStudio’s bundle identifier. It is never written to disk in plaintext, logged, or transmitted to our server. It is sent only to Replicate’s API (api.replicate.com) as your authentication credential for the AI generation requests you initiate.

Legal basis: Art. 6(1)(b) GDPR — necessary to use the AI generation service.

4g. In-App Purchase State

Your StoreKit purchase transaction is used to derive your Dynamic QR API key (see §5c). The derivation happens on your device; only the resulting API key and your transaction ID are sent to and stored on our server. No payment card details, Apple ID, or billing information is ever received or stored by us. Apple’s privacy policy governs the purchase process.

Legal basis: Art. 6(1)(b) GDPR — necessary to unlock the features you paid for.

4h. Cryptographic QR Signing Key Pair (Optional)

If you use the Cryptographic QR Signing feature, QREagleStudio generates a P-256 ECDSA key pair entirely on your device using Apple’s CryptoKit framework:

• Private key: Generated once and stored exclusively in your macOS Keychain, protected by the Secure Enclave where available. It never leaves your device and is never transmitted to any server — including ours.
• Public key: Embedded in the signed QR code URL as a URL-safe base64 parameter (k=). It is not stored on our servers.
• Signature: A P-256 ECDSA signature over the QR content, embedded in the URL (s=). Computed locally on your device.
• Signer name (optional): A display name you enter, embedded in the URL (n=). It is not stored on our servers.

All cryptographic operations (key generation, signing) happen on-device only. No private key material, no biometric data, and no Keychain secrets are transmitted anywhere.

Legal basis: Art. 6(1)(b) GDPR — necessary to provide the signing feature you requested.

5a. Web Server Access Logs

Like all web servers, qreagle.com’s Apache server automatically generates access logs whenever any resource is requested. These logs contain:

• IP address of the requesting client
• Date and time of the request
• URL path requested (e.g. /go/abc123 or /api/links)
• HTTP status code and response size
• User-Agent string (browser / OS identifier sent by the client)

Retention: Access logs are retained for a maximum of 30 days and then deleted automatically. They are used solely for server security monitoring (detecting abuse, brute-force attempts, and DDoS patterns).

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in maintaining server security and operational integrity.

Third parties: Logs are stored on our hosting provider’s infrastructure. No log data is shared with analytics services, advertisers, or any other third party.

5b. Smart QR Card Rendering

When someone scans a Smart QR Card, their browser opens a page at qreagle.com (e.g. qreagle.com/api/gift.php?...). The card’s content is URL-encoded in the QR code itself and passed as query parameters to the rendering script.

• No card data is stored on our server. The rendering script decodes URL parameters and builds the HTML page in real time. Nothing is written to any database.
• The scanner’s IP address and request path appear in the web server access log (§5a) and are deleted after 30 days.
• No cookies are set on card pages. No analytics scripts are loaded. No fingerprinting occurs.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in delivering the card page requested by the scanner.

5c. Dynamic QR — Authentication and Key Provisioning

The Dynamic QR feature is available to Pro subscribers. After purchase, the app automatically calls our POST /api/auth endpoint to provision a personal API key.

• What is sent: Your Apple StoreKit originalTransactionID (a numeric identifier assigned by Apple).
• What we derive: A personal API key using HMAC-SHA256 keyed with a secret known only to our server. The derivation is deterministic — the same transaction always yields the same key, so Restore Purchases works automatically.
• What is stored: The derived API key (a 64-character hex string prefixed with qre_) and the transaction ID, linked by a random internal ID. No payment details, Apple ID, or name is stored.
• On your device: The API key is stored exclusively in your macOS Keychain, encrypted and sandboxed to QREagleStudio. It never appears in plaintext in any log or UI.
• Retention: The record persists as long as you maintain a Pro subscription. See §10 for deletion options.

Legal basis: Art. 6(1)(b) GDPR — processing necessary for the performance of the service contract.

5d. Dynamic QR — Link Data

When you create a Dynamic QR short link, the following data is stored on our server:

• Slug: The short identifier appended to qreagle.com/go/. Auto-generated or chosen by you.
• Destination URL: The URL scanners are redirected to.
• A/B Variants (optional): If you configure A/B testing, the variant destinations and traffic weights are stored as a JSON array. No scanner data is embedded in this field.
• Label: An optional descriptive name for your reference only.
• Active state: Whether the link is currently enabled or paused.
• Aggregate scan counter: An integer that increments by one each time the link is opened.
• Timestamps: Created-at and last-modified dates (UTC ISO 8601).
• API key identifier: An internal reference scoping your links to your account. Not exposed in API responses.

What is NOT stored per scan: IP address, full User-Agent string, precise timestamp, cookies, session ID, device fingerprint, or any cross-site identifier. See §5e for the anonymised event data that is collected.

Legal basis: Art. 6(1)(b) GDPR — processing necessary to perform the Dynamic QR service you subscribed to.

Retention: Link data (including scan events) is retained until you delete the individual link or request account deletion (§10). Deletion is immediate and permanent.

5e. Dynamic QR — Scan Redirects and Anonymised Analytics

When someone scans a Dynamic QR code, their browser opens qreagle.com/go/{slug}. Our server performs the following steps:

1. Looks up the slug in the database.
2. If A/B variants are configured, selects one according to the configured traffic weights.
3. Records one anonymised scan event (see table below).
4. Increments the aggregate scan counter by 1.
5. Issues a 302 Found redirect to the (variant) destination URL.

Anonymised event data recorded per scan

What is NOT stored: IP address, full User-Agent string, precise timestamp, cookies, session ID, device fingerprint, browser version, or any cross-site identifier. This data cannot identify or re-identify any individual.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest of the link owner in understanding aggregate scan patterns. Processing is limited to what is strictly necessary; the anonymisation measures (no IP, family-level UA parsing, date-only resolution) make individual identification impossible.

GDPR Art. 25 (Privacy by Design): The IP address is never written to any variable or buffer reaching our database layer. It cannot be reconstructed after the fact.

Retention: Scan events are deleted when the parent link is deleted, or upon account deletion request (§10).

5f. Cryptographic QR Signature Verification

When someone visits qreagle.com/api/verify to verify a signed QR code, the following data is processed:

• QR content (d=): The original content of the QR code, base64url-encoded in the URL. Decoded in memory for verification; never stored.
• Signature (s=): The P-256 ECDSA signature, base64url-encoded. Used only to run openssl_verify(); never stored.
• Public key (k=): The signer’s raw P-256 public key (64 bytes), base64url-encoded. Used only for signature verification; never stored.
• Signer name (n=): An optional display name chosen by the QR creator, base64url-encoded. Displayed on the page; never stored.

The /api/verify endpoint is completely stateless. All four parameters are passed in the URL itself and processed entirely in memory for the duration of the request. Nothing is written to any database or log beyond the standard web server access log described in §5a (deleted after 30 days).

No private key material is ever sent to this endpoint — only the public key and signature, both of which the QR creator intentionally embeds in the QR code for public verification.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in providing a publicly accessible, stateless signature verification service with no personal data retention.

6a. Data Sent to Replicate

• Your text prompt (and optional negative prompt, parameter values, and seed).
• Your Replicate API key, as the authentication credential for the request. This key is yours — issued by Replicate when you create a Replicate account — and is stored only in your macOS Keychain.
• A black-on-white QR code image (the ControlNet conditioning image) generated entirely on-device and sent as the generation input.

What is NOT sent: Any personal data from your QR content, your name, your email, or any data from your QR library.

Legal basis: Art. 6(1)(b) GDPR — you explicitly initiated the AI generation request.

6b. Replicate’s Privacy Policy

Replicate’s data practices are governed by Replicate’s Privacy Policy. We are not responsible for how Replicate processes data it receives. Replicate is incorporated in the United States; data sent to Replicate may be processed outside the EEA under appropriate transfer mechanisms (Replicate’s DPA).

6c. AI-Generated Images and Export

AI-generated images are composited with the QR code on your device and treated as a background image. The composited result is available for export as PNG. Saving to your Photos library is disabled for AI-generated images to prevent accidental exposure; export to file is always available.

Apple Inc. (App Store, StoreKit, macOS)

QREagleStudio is distributed via the Mac App Store. Apple’s privacy practices govern the App Store download and purchase process. Apple may collect diagnostic and usage data as described in their privacy policy. We have no control over or access to Apple’s data collection.

Reference: apple.com/privacy

Web Hosting Provider (EEA)

The qreagle.com server infrastructure is operated by a European web hosting provider. Server access logs (§5a) are physically stored on their infrastructure within the EEA. The hosting provider acts as a data processor under Art. 28 GDPR. A Data Processing Agreement (DPA) is in place. The hosting provider does not independently access or process your data beyond infrastructure operation.

Google Fonts

The qreagle.com website loads the “Inter” typeface from Google Fonts via a request to fonts.googleapis.com. This request transmits your IP address to Google’s servers. Google’s privacy policy applies: policies.google.com/privacy.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in providing a consistently styled website.

Replicate AI (Optional — AI QR Feature Only)

If you use the AI QR generation feature, prompts and conditioning data are sent to Replicate, Inc. (USA). Replicate processes this data under their privacy policy and DPA. The transfer is based on Standard Contractual Clauses (SCCs) as provided by Replicate. This processing only occurs if you actively initiate AI generation; it does not occur during normal app use.

Reference: replicate.com/privacy

International Data Transfers

Our primary server infrastructure is located within the European Economic Area (EEA). If any third-party service (Apple, Google, Replicate) processes data outside the EEA, they do so under standard contractual clauses (SCCs) or other GDPR-compliant transfer mechanisms. We do not independently transfer personal data outside the EEA.

🇺🇸 California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), California residents have the following additional rights:

• Right to Know: You may request disclosure of the specific pieces and categories of personal information we have collected, the categories of sources, the business or commercial purpose for collection, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of personal information we collected from you, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: We do not sell or share personal information with third parties for cross-context behavioural advertising. No opt-out is required, but you may confirm this at any time by contacting us.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes beyond those permitted under the CPRA (i.e. we do not use it to infer characteristics).
• Right to Non-Discrimination: Exercising your CCPA rights will not result in denial of service, different prices, or diminished quality.

Categories of personal information collected (CCPA categories): Identifiers (transaction ID, API key); Commercial information (product purchased); Internet/network information (anonymised scan events: country, browser family, OS family, language, referrer host, date — no IP). We do not collect geolocation data, biometric data, sensitive personal information, or financial account numbers.

Shine the Light: California Civil Code §1798.83 permits California residents to request information regarding disclosure of personal information to third parties for direct-marketing purposes. We do not disclose personal information for direct-marketing purposes, so no such disclosure has occurred.

To submit a CCPA request: email info@it-egarter.at with subject line “CCPA Request”. We will respond within 45 days (extendable by 45 days with notice).

🇬🇧 United Kingdom Residents (UK GDPR)

The UK GDPR (as retained in UK law) provides rights substantially equivalent to the EU GDPR listed in §11. The Information Commissioner’s Office (ICO) is the UK supervisory authority.

Transfers of personal data from the UK to the EEA (our server) are covered by the UK adequacy regulations. No additional safeguards are required for this transfer.

🇧🇷 Brazilian Residents (LGPD)

Under the Lei Geral de Proteção de Dados (LGPD), Brazilian residents have rights of access, correction, anonymisation, blocking, deletion, data portability, and the right to be informed about sharing. Our legal basis for processing is:

• Contract performance (Art. 7(V) LGPD): Processing of Dynamic QR link data and authentication data is necessary to perform the service you contracted.
• Legitimate interest (Art. 7(IX) LGPD): Anonymised scan analytics serve the legitimate interest of link owners; the same anonymisation safeguards described in §5e apply.
• Consent (Art. 7(I) LGPD): Camera/location access on device.

Data transfers from Brazil to Austria (EEA) are based on the adequacy of the European data protection framework as recognised by Brazilian data protection authorities.

National Data Protection Authority (ANPD): gov.br/anpd

🇨🇦 Canadian Residents (PIPEDA / CPPA)

Under PIPEDA, individuals have the right to access their personal information and request corrections. We collect only the minimum information necessary to provide the Dynamic QR service, and we obtain meaningful consent before any collection beyond service performance. Data is retained only as long as necessary (see §15). To submit a PIPEDA access or correction request, contact our Privacy Officer at info@it-egarter.at.

Office of the Privacy Commissioner of Canada: priv.gc.ca

🇯🇵 Japanese Residents (APPI)

Under Japan’s Act on the Protection of Personal Information (APPI), we notify users of the purpose of use of personal information and handle retained personal information in accordance with the Act. You have the right to request disclosure, correction, addition, deletion, and suspension of use of retained personal information. Requests may be submitted to info@it-egarter.at.

Transfer of personal data from Japan to Austria is based on the adequacy determination and appropriate safeguards including contractual protections consistent with APPI requirements.

🇨🇭 Swiss Residents (nFADP)

The revised Swiss Federal Act on Data Protection (nFADP, in force since September 2023) provides rights broadly equivalent to the GDPR. Our EEA-based server satisfies the adequacy requirements for data transfers from Switzerland. You may contact us at info@it-egarter.at to exercise your rights under the nFADP.

Federal Data Protection and Information Commissioner (FDPIC): edoeb.admin.ch

🇦🇺 Australian Residents (Privacy Act 1988)

Under the Australian Privacy Principles (APPs), you have the right to access and correct personal information we hold about you, and to make a complaint to the Office of the Australian Information Commissioner (OAIC). We collect, use, and disclose personal information in accordance with the APPs and only for the stated purposes. Contact info@it-egarter.at for access or correction requests.

OAIC: oaic.gov.au

🇮🇳 Indian Residents (DPDP Act 2023)

Under India’s Digital Personal Data Protection Act 2023, you have the right to access information about personal data processed, right to correction and erasure, right to nominate a successor, and right to grievance redressal. We process data lawfully under the Act and handle it responsibly. Contact info@it-egarter.at to exercise your rights. The Data Protection Board of India is the regulatory authority.

🇨🇳 Residents of China (PIPL)

Under China’s Personal Information Protection Law (PIPL, in force 1 November 2021), individuals have the right to know and to decide on the processing of their personal information, the right of access and copy, the right to correction, the right to deletion, the right to withdraw consent, and the right to request explanation of automated decision-making. We process data on the basis of contractual necessity. Contact info@it-egarter.at for any PIPL request. Cross-border transfer to Austria is made with appropriate safeguards to meet PIPL requirements.

🇰🇷 South Korean Residents (PIPA)

Under South Korea’s Personal Information Protection Act (PIPA), you have the right to access, correction, deletion, and to suspend processing of your personal information. We comply with PIPA’s requirements including lawful basis and data minimisation. Contact info@it-egarter.at for any PIPA request. The Personal Information Protection Commission (PIPC) is the supervisory authority: pipc.go.kr

🇸🇬 Singapore Residents (PDPA)

Under Singapore’s Personal Data Protection Act (PDPA), 2021 amendments, you have the right to access and correct your personal data, and the right to withdraw consent. We collect and use data only for the purposes notified and rely on contractual necessity as our primary basis. Contact info@it-egarter.at for PDPA requests. The Personal Data Protection Commission (PDPC) is the supervisory authority: pdpc.gov.sg

🇿🇦 South African Residents (POPIA)

Under South Africa’s Protection of Personal Information Act (POPIA, in force 1 July 2021), you have the right to access, correction, deletion, and objection to processing of your personal information. We process data as a responsible party and comply with the eight conditions for lawful processing. Contact info@it-egarter.at for POPIA requests. The Information Regulator is the supervisory authority: inforegulator.org.za

🇳🇿 New Zealand Residents (Privacy Act 2020)

Under New Zealand’s Privacy Act 2020, you have the right to access and request correction of your personal information. We follow the 13 Information Privacy Principles (IPPs). Contact info@it-egarter.at for requests. The Office of the Privacy Commissioner (OPC) is the supervisory authority: privacy.org.nz

🇹🇭 Thai Residents (PDPA)

Under Thailand’s Personal Data Protection Act (PDPA, fully in force 1 June 2022), you have the right to access, portability, erasure, objection, restriction of processing, and withdrawal of consent. We process data on the basis of contract performance and legitimate interest, with appropriate safeguards. Contact info@it-egarter.at for PDPA requests. The Personal Data Protection Committee (PDPC) is the supervisory body.

🇦🇪 UAE Residents (PDPL 2021)

Under the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL), you have the right to access, correction, deletion, restriction, and portability of your personal data. We process data lawfully and transparently and implement appropriate technical and organisational security measures. Contact info@it-egarter.at for any PDPL request.

ℹ️ All Jurisdictions — No Sale of Data

Regardless of your location: we do not sell, rent, lease, or trade personal data to any third party for monetary or other valuable consideration. This applies to all QREagleStudio users worldwide.

Austrian Data Protection Authority
(Datenschutzbehörde, DSB)

Barichgasse 40–42
1030 Vienna, Austria

Phone: +43 1 531 15-202525

Email: dsb@dsb.gv.at

www.dsb.gv.at

IT Solutions Egarter

Mag. Wolfgang Egarter

St. Oswalderstraße 14

A-9546 Bad Kleinkirchheim, Austria

Email: info@it-egarter.at

We aim to respond to all data protection enquiries within 72 hours (business days) and to fulfil formal requests within one calendar month.