Privacy Policy

What happens to a check

When you submit an image, it is decoded and then deleted — it is not archived. When you submit a link, we request it and follow its redirects to see where it ends up. The result is held in your browser session and disappears when the session ends. It is not attached to you, because there is nothing to attach it to: no account is required.

What we do keep

To see whether the decoders and safety checks are working, we record a technical event per check: which decoder succeeded, how long it took, how many redirect hops there were, the verdict, and the type of code. Identifying details are hashed and truncated before storage — the IP address is shortened and hashed, never stored in full, and the checked link itself is not stored. These records cannot be traced back to you or to what you checked.

Third parties

A check involves services outside our own servers:

• Google Safe Browsing receives the destination address of each hop to check it against known threats.
• Google Gemini receives your uploaded image, but only when every local decoder has failed — roughly one in a hundred checks — and only when this fallback is switched on. If you would rather no image ever leaves our servers, do not use the upload for sensitive material.
• The destination itself sees a request from our server, not from you. Your IP address is not passed on.
• Our hosting provider processes traffic on our behalf under a processing agreement.

Cookies

A functional session cookie holds your results while you are on the site, and remembers your language. Analytics cookies are only set if you accept them; declining costs you nothing.

Bulk scans

A bulk scan of a document with many codes is kept longer than a single check, because processing takes time and results must remain retrievable. Those batches and their results are deleted automatically after seven days.

Legal basis

Processing rests on performance of the service you requested, on legitimate interest for security and aggregate statistics, and on consent where cookies require it.

Retention

Session results: until your session ends. Bulk scan batches: seven days. Technical event records: each check writes one record with the verdict, the date and a set of one-way hashes derived from your IP address and browser; those hashes are cleared automatically after ninety days, leaving only counts. Server logs: no longer than ninety days.

Your rights

You have the right to access, correct and delete personal data we hold about you. In practice there is little to exercise these rights against, because a check without an account produces no data tied to a person. If you believe we hold something about you, write to us and we will respond within a month.

Contact

Questions about this policy can go to the address below.