Last updated: 3 October 2026. ScanArtist.io is a free, client-side QR code generator. This policy explains, in plain language, what data is and isn't handled.

Your QR codes never leave your device

Static QR codes are generated and exported entirely in your browser. The content you type — links, Wi-Fi passwords, contact details, payment information — is used only to draw the code on your device. It is never transmitted to or stored on our servers. There is no middleman URL, so your codes cannot be switched off or held hostage.

No account, no cookies

You do not need to sign up to generate or export codes, so we hold no account or profile data. We do not set cookies — advertising, tracking or otherwise. Your styling preferences are kept in your browser's local storage (so the tool remembers your last look), and so is any design you choose to save, including its content. That storage stays on your device: it is never sent to us, and clearing your browser's site data removes it. When the site reloads itself after an update, or you press Reload on a message saying part of the site could not be loaded, your current design is held briefly in the browser's session storage for that tab so that it survives the reload, and is deleted as soon as it is restored; it never leaves your device.

Anonymous usage analytics

ScanArtist.io does not run third-party ad, analytics or tracking scripts. To see which parts of the app get used, the site may send anonymous, cookieless usage events to an endpoint we run ourselves. This only happens when the published site is built with that endpoint switched on; when it is off, nothing is sent at all.

When it is on, one event is sent each time you open a page, export a code, copy a code image or run the scan test. This is everything we store:

• The event name — one of four: page view, export, copy image or scan test.
• For page views, which page — for example /studio or /faq. Only the page's path is sent, never the part of the address after the #, which is where a shared design travels. Any address that isn't one of the site's own pages is recorded simply as “other”.
• For exports, the file format — PNG, JPG, WebP, SVG, PDF or EPS.
• For exports, what kind of design it was — which kind of code (for example URL or Wi-Fi — the type only, never what is in it), the dot style, the error-correction level (L, M, Q or H), and which optional features were switched on: a logo, a gradient, custom eyes, a frame, a background motif, halftone, negative fill, image fill. Each of those is a plain yes or no — never your colours, your logo or images, or anything you typed.
• When the event arrived — a date and time, plus a random ID for that single event so it can be counted. The ID is made fresh for every event and says nothing about you, your browser or any other event.

Your QR content is never part of this. Nothing you type is sent, and nothing about your design beyond the short list above — not its colours, not your logo or images, not the words on a frame, not a file name. Our server ignores everything except the fixed values listed above. Events carry no cookies, no user or device identifiers and no fingerprinting, so we cannot link an event to you, or tell whether two events came from the same person.

Like every web request, an event arrives with your IP address and your browser's user-agent attached, and our hosting provider handles them in transit to deliver the request. Our analytics code does not store or log them, and we have not turned on request logging for the analytics endpoint.

Events are processed and stored on Amazon Web Services (AWS) in the United States (the us-east-1 region, Northern Virginia), with no third-party analytics provider involved. Each event is set to expire 400 days after it arrives and is then deleted automatically, usually within a few days; database backups can hold a copy for up to 35 days longer.

Third-party services

Fonts are self-hosted, so no font CDN sees your visits. The optional "Buy me a Coffee" link takes you to Buy Me a Coffee's own site, governed by their privacy policy — you only go there if you choose to. The site is served over HTTPS via a content delivery network, which processes standard request metadata (such as IP address and user-agent) to deliver pages and protect against abuse; these logs are not used to profile you.

Your rights

Because we hold no account data and the usage events described above cannot be linked to a person, there is nothing about you for us to look up, correct, or delete. If that ever changes (for example with the optional dynamic-code feature on our roadmap), you will be told exactly what is collected, it will be opt-in where required, and you will be able to exercise your GDPR rights.

Free, with no guarantees

ScanArtist.io is a free service, and using it is your choice and at your own risk. We run it on a best-endeavours basis: we do our best to keep it working well, but there are no guarantees. We can't promise the site will always be available — but static codes you've already made keep working, because they don't route through our servers.

Contact

Questions about privacy? Please open a confidential issue on the project's repository or contact the maintainer. We aim to respond within a few days.