Privacy Policy
Last updated 3 November 2026
The short version
When someone scans a qbitty code we count it, by day, country and type of device. We don't keep their IP address, their browser details or anything else that could identify them, and we don't use cookies on scans.
For account holders we keep your email address, your codes and your billing status. We don't sell data and we don't show ads.
1. Who we are
qbitty (qbitty.com) is run by RJ Macarthy, a sole trader in the United Kingdom ("we", "us"). Contact us about this policy or your data using the form at rjmacarthy.xyz. We are the controller of the data described here.
2. People who scan a qbitty code
When you scan a code, your phone asks qbitty.com where to go and we send it straight on to the page the business chose. While doing that we record one row: the code, the time, the country your IP address belongs to (looked up on our own server, no third party involved) and your device family (for example "iPhone" or "Android"). The IP address and user-agent are then discarded. They aren't stored with the scan.
The business that owns the code sees totals by day, country and device. It can't see anything about you individually, because we don't have it. Like any web server, our web server (nginx) briefly writes request logs, including IP addresses, for security. These are rotated and deleted within 14 days.
Legal basis: legitimate interests (giving the business basic scan counts, and keeping the service secure).
3. Account holders
| Data | Why | Legal basis (UK GDPR) |
|---|---|---|
| Email address, and your password stored only as a one-way scrypt hash | Your account, signing in, sign-in and verification emails | Contract |
| Your codes: names, destinations, uploaded PDFs, scan counts | Running the service | Contract |
| Plan, and your Stripe customer and subscription IDs | Billing. Card details go straight to Stripe and never reach us. | Contract; legal obligation (tax records) |
| IP address and browser in server logs | Security, abuse prevention, rate limiting | Legitimate interests |
If you sign in with Google, we receive only your email address and whether Google has verified it. The dashboard uses one cookie, to keep you signed in. It isn't used for tracking.
4. Who we share data with
| Provider | What for | Location |
|---|---|---|
| OVHcloud | Server hosting: database and uploaded PDFs | EU |
| Cloudflare | Encrypted off-site backups | Global |
| Resend | Sending emails (sign-in and verification links) | USA |
| Stripe | Payments and the billing portal | USA / EU |
| Only if you choose "Continue with Google" | USA |
Transfers outside the UK rely on the UK International Data Transfer Addendum or the UK–US Data Bridge, as applicable.
5. How long we keep it
Account data, codes and scan counts are kept while your account exists. Deleting a code deletes its scans and any PDF. To close your account, contact us and we'll delete everything within 30 days, apart from billing records we must keep for tax (6 years). Backups roll off within 30 days.
6. Your rights
You can ask for a copy of your data, or ask us to correct it, delete it or stop using it. You can also export your codes yourself from the dashboard at any time. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).