QRCage privacy policy

Information handled by the Android app

Camera, selected images, and PDFs

QRCage uses the camera while the Scan screen is open to recognize QR codes. Camera frames are processed on the device. If you choose an image or PDF, Android's system picker gives QRCage access to that selected item; QRCage does not request broad photo-library access. The selected content is decoded on the device.

Scans, history, notes, folders, and settings

Decoded content, verdicts, history, bookmarks, notes, folders, and preferences are stored in the app's local storage. Android backup is disabled for the app. You may create a password-encrypted export of scan history if your plan allows it. The password and plaintext export contents are not sent to QRCage. The export does not include app settings.

Opening a website in the cage

When you choose to open a link, the in-app WebView connects directly to that website. The site receives ordinary connection information such as your IP address and may receive information you enter or allow on the page. QRCage blocks several WebView capabilities and clears session data on close, but it cannot control the destination site's privacy practices. Android System WebView and Safe Browsing may communicate with Google under Google's terms. Do not enter sensitive information on a site you do not trust.

Google Play purchases

Google Play processes purchase and payment information under Google's terms. The app queries Play for product prices and purchase state so it can show and restore eligible benefits. The audited no-account release does not send purchase tokens to a QRCage production server. Secure server verification is a release prerequisite before paid v1 activation; this policy and the Play Data safety form must be updated if that data flow is enabled.

What the current app does not do

• No QRCage account creation, cross-device sync, cloud backup, or drift watchdog.
• No advertising SDK, Advertising ID use, analytics SDK, or behavioral profiling.
• No live redirect following or claim to discover a final URL.
• No QRCage server reputation lookup; verdicts use on-device warning rules in this release.
• No broad photo/media, contacts, location, microphone, SMS, call-log, or notification permission.

Website data

If you join the website waitlist, QRCage stores the email address you submit, submission time, and basic browser user-agent information for launch/product communications. Feedback submissions store your email, subject, message, time, and user-agent. The website also uses a local browser flag to remember that the waitlist form was completed and unlock generator customization. Do not submit sensitive data in feedback.

Website infrastructure providers process normal request data such as IP address, request time, path, and security logs to deliver and protect the site. Retention and production-provider configuration must be confirmed by the owner before this draft is published.

Retention, deletion, and security

Local app data remains until you clear history, clear app storage, or uninstall. Export files remain wherever you saved them until you delete them. For website waitlist or feedback deletion, contact hello@qrcage.com from the submitted address. Current local-data instructions are at Delete QRCage data.

QRCage uses reasonable technical safeguards, but no storage, network transmission, website, or browser view can be guaranteed perfectly secure. If accounts or server-backed features launch, this policy will be revised before collection begins with the exact data, purposes, processors, retention, and deletion path.

Audience, changes, and contact

QRCage's Google Play target audience is adults aged 18 and over; it is not designed or marketed for children. We will date material policy changes and make the current version available at this URL. QRCage is the service/developer name used in this draft. The owner must align the public developer identity and verify hello@qrcage.com before Play publication.