Security Policy

1. Our approach

QR Scanner & Barcode Reader is built so that the sensitive parts of the experience — the camera, the images you choose, the codes you scan and the codes you create — stay on your device. We keep the amount of information that leaves your phone to the minimum required to show advertising, measure stability and process purchases.

2. On-device processing

• Camera frames are analysed in real time on your device to locate and decode QR codes and barcodes. This happens in memory while the scanner is active.
• Images you select from your gallery are decoded and, where you request it, read for text — again entirely on your device.
• Codes you generate, including the styling you apply, are rendered locally before you export or share them.
• The app does not transmit scanned content, extracted text, generated codes or exported files to us, and we do not operate a service that could receive them.

3. Storage on your device

• Scan history, favourites, notes and preferences are stored in the app’s private storage area, which other apps cannot read on a standard Android device.
• Only the information needed for the feature is stored: the decoded content, the code type, the time, and anything you add yourself.
• You stay in control: delete single items, clear the whole history, or remove all data by uninstalling the app.
• Files you export are written only to the folder or document provider you choose when saving. We do not keep a copy.
• If your device supports Android’s encrypted storage (file-based encryption), the app’s data benefits from that platform protection.

4. Encrypted connections

• All network traffic produced by the app — advertising requests, analytics, crash reports and purchase verification — is sent over encrypted HTTPS connections using platform networking.
• The app does not disable certificate validation and does not allow unencrypted traffic to third-party endpoints.
• Endpoints are those operated by Google for the services described in our Privacy Policy; we do not route your traffic through additional intermediaries.

5. Permissions and least privilege

The app does not request access to your contacts, calendar, SMS, call logs, precise location or microphone. Permissions can be reviewed and revoked at any time in Android settings; revoking camera access disables scanning.

6. No accounts, no stored credentials

There is no sign-in, so the app does not store passwords, session tokens or profile data about you. This removes an entire category of risk: there is no account to take over and no credential database to breach.

7. Payments

• Pro subscriptions are processed by Google Play Billing. Payment card details are entered into and stored by Google, never by the app.
• The app receives only what is required to unlock Pro features: the product identifier, subscription state and a purchase identifier.
• Subscription management, cancellation and refunds are handled through your Google Play account.

8. Third-party components

• Advertising, analytics, crash reporting, consent management and purchases are provided by official Google libraries, distributed and updated through Google Play.
• We keep these dependencies current and apply security fixes by publishing app updates; keeping the app updated from Google Play ensures you receive them.
• We do not integrate third-party advertising networks other than Google AdMob, and we do not include code that collects your data for unknown third parties.

9. Advertising and consent

• Where required by law, the app asks for consent before using your data for personalised advertising, and records your choice so it is applied consistently.
• You can change your choice at any time in Settings, or reset/delete your advertising ID in Android settings.
• Rewarded videos are always optional: they play only when you choose to watch one.

10. Safe scanning practices

A QR code is just a container for data, and the app cannot know whether the destination behind a code is trustworthy. We recommend the following habits:

• Preview before you open. Check the decoded content shown by the app before visiting a link; be suspicious of shortened links, unusual domains and requests to install software.
• Never scan codes from untrusted places. Stickers placed over legitimate codes on parking meters, posters or payment terminals are a common fraud technique.
• Verify payment details. For payment codes, confirm the recipient name and amount in your banking app before confirming — the app only reads the code, it does not verify the payee.
• Do not share secrets. Treat codes that contain Wi-Fi passwords, one-time passwords or login links as sensitive information.
• Be careful with codes received in messages. Unexpected codes from unknown senders are a frequent phishing vector.
• Keep the app updated. Updates include security fixes and compatibility improvements.

11. Reporting a vulnerability

If you believe you have found a security problem in the app, please tell us so we can fix it:

• Email support.qrscanapp@gmail.com with the subject “Security report”.
• Include what you found, the steps to reproduce it, the app version, your device model and Android version, and any evidence such as screenshots or logs. Do not include other people’s personal data.
• Give us a reasonable opportunity to investigate and release a fix before disclosing the issue publicly.
• Do not test against other users, attempt to access data that is not yours, or degrade the service while investigating.

We review every report and will confirm receipt, keep you informed of our progress and credit responsible reports where you wish to be credited. We do not currently operate a paid bounty programme.

12. Limitations

No software can be guaranteed completely secure. The protections described here depend on your device, its operating system and the services it connects to. In particular:

• On a rooted, compromised or unusually configured device, the app’s private storage may not be protected by the operating system.
• We cannot control the security practices of websites or apps you visit after scanning a code.
• Information you deliberately share, export or send by email leaves the app and is then governed by the destination service.

13. Updates to this policy

We review this policy when the app’s behaviour or our providers change. Updates appear on this page with a new date, and significant changes are announced in the app or in the release notes on Google Play.

Related documents: Privacy Policy · Terms of Use. Questions: support.qrscanapp@gmail.com.