Privacy Policy

Waylum Inc., Ontario, Canada, runs FernQR and is responsible for your personal data (the “controller”). We collect as little as we can. This page says what we keep, why, and for how long.

What we collect and why

• Free codes. Made entirely in your browser. What you type, including Wi-Fi passwords, is never sent to us.
• Account. Your email address and, if you sign in with Google, your name and profile picture, held by our sign-in provider Clerk. We keep an account id and your plan. Legal basis: to provide the service you asked for (contract).
• Editable codes. Each code’s name, destination link and style. Legal basis: contract.
• Scans. A daily count per code. We do not store who scanned, or their IP address, device or location, in our database. Legal basis: contract, so we can show you scan counts.
• Security. IP addresses are used briefly to limit abuse, and our host Cloudflare processes them to deliver and protect the service and may keep them in short-lived logs. Destination links are checked against Google Safe Browsing when you save them. Legal basis: our legitimate interest in keeping people safe from harmful links.
• Payments. Polar, our merchant of record, collects your payment and billing details as an independent controller under its own privacy policy. We never see card details. Polar tells us what you bought so we can unlock it. Legal basis: contract and legal obligations such as tax records.
• Launch emails. If you ask us to tell you when paid codes open, we keep that email address and use it for that one message. Legal basis: consent.
• Reports. If you report a code, we keep the report and the email you choose to give. Legal basis: legitimate interest in handling abuse.
• Emails from us. Only about your account, purchases and important service changes. We do not send marketing without your consent.

Service providers

These companies process data for us under data processing terms:

• Cloudflare: hosting, redirects, database and security.
• Clerk: sign-in and account management, including Cloudflare Turnstile bot checks on the sign-in form.
• Google: Safe Browsing checks of destination links (the link only).
• Polar: payments, tax and receipts (as merchant of record).

Some of them process data outside your country, including in the United States. Where the law requires it, transfers are covered by safeguards such as the EU Standard Contractual Clauses and the UK Addendum.

How long we keep it

• Account and codes: until you delete your account.
• Unpaid codes: deleted after 2 days.
• Scan counts: as long as the code exists.
• Reports: up to 2 years, to handle repeat abuse.
• Launch emails: deleted once we send that message.
• Payment records: kept by Polar for as long as tax law requires.

Cookies and storage

We use only cookies that are strictly needed to keep you signed in and secure. Your browser also remembers your last chosen color and style in local storage. We use no advertising, analytics or tracking cookies, so there is no cookie banner.

Your rights

Depending on where you live, including under the GDPR, UK GDPR and California law (CCPA/CPRA), you can ask to access, correct, delete or export your data, and object to or restrict how we use it. Email hello@fernqr.com and we will reply within 30 days. You can also complain to your data protection authority. We do not sell or share personal information for advertising, and we will not treat you differently for using your rights.

Children

The service is not meant for anyone under 16, and we do not knowingly collect their data.

Security

Data is encrypted in transit, access is limited to what is needed to run the service, and we never store payment card details.

Changes

We will post updates here and email account holders about significant changes.