The short version
- There is no account. No sign-up, no email address, no password, no profile.
- Your codes, cards and history live on your phone, in the app's own storage. We operate no server that stores them and we cannot see them.
- The camera is used to read codes and nothing else. No frame is recorded or uploaded.
- Three things do leave the phone, each for a named purpose: the address of a web link you scanned (to Google Web Risk), an advertising request on the free plan (to Google AdMob), and a purchase (to Google Play). A settings fetch to Firebase Remote Config carries an app instance identifier.
- We do not sell, rent or trade personal information, and we run no analytics of our own.
Overview
QR Craft (the “App”) is published by Epsilon Developers, operated by Satyam Kushwaha & Anurag Mahajan (“we”, “us”, “our”). This Privacy Policy explains what the App touches, what leaves your device, who else is involved and what choices you have.
It applies to the QR Craft Android application distributed on Google Play under the package name com.epsilondevelopers.qrcraft, and to this website. By installing or using the App you confirm that you have read it.
1What stays on your device
The following never leaves your phone unless you deliberately share or export it:
- Scan history — the codes you scan, their type and the time they were scanned.
- Created codes — their contents, colours, shapes, frames and labels.
- Cards and standees — the designs you build and the details you type into them.
- My Card — the personal details you save for autofill.
- Saved UPI payees — the UPI IDs and payee names you choose to remember.
- Preferences — theme, language, sound, vibration, search engine, link behaviour and the link-safety switch.
- Images you pick — a photo or brand mark placed inside a code is copied into the App's own storage so it can be redrawn later.
These are held in a database and in preference files inside the App's private storage area. Clearing them, or uninstalling the App, removes them from the device. There is no cloud copy to delete because none was ever made.
2What we collect
We collect nothing directly
We do not ask for your name, email address, phone number or location. We have no user accounts and no server that receives your content. Everything described in the rest of this policy is handled by the third parties named there, under their own privacy policies.
If you write to us at contact@epsilondevelopers.xyz, we will have whatever you put in that email, including your email address, and we keep it only to answer you.
3Link safety checks
When the App decodes a web link, it first checks the address itself, on the phone: an address that hides its real destination before an “@”, look-alike characters, a raw IP address, a known shortener, a missing encryption, a risky domain ending, an unusual port, or an unusual depth of subdomains. Those checks send nothing anywhere.
It then asks Google Web Risk whether that address is on Google's lists of harmful sites. That request contains the address of the link you scanned and nothing else — not your identity, not your other codes, not your history. Google's handling of it is covered by the Google Privacy Policy.
- You can switch it off. Settings → Google Safe Browsing. With it off, no address is ever sent.
- It is skipped when it cannot run — offline, or once a device's monthly allowance of lookups is used. The App then says Not checked rather than implying a link is safe.
- Answers are cached on the device for a short time, so re-scanning the same poster does not repeat the lookup.
4Advertising
The free plan is supported by ads served by Google AdMob. To serve them, the ads SDK receives your device's advertising ID and technical information about the device, as described in Google's documentation and the Google partner policy.
- Nothing you scan, create or save is part of an ad request.
- Consent. Where the law requires it (for example in the EEA and the UK), you are shown Google's consent form before personalised ads are used, and Settings → Ad Privacy Options reopens that choice at any time.
- Your device controls apply. Android's “Delete advertising ID” and “Opt out of ads personalisation” settings work here as they do everywhere else.
- Premium removes ads entirely, and with them the ad requests.
5Purchases
Premium is sold through Google Play Billing. Google takes the payment and tells the App whether a purchase is active. We never see your card, bank or billing address, and we keep no purchase database of our own — “Restore Purchase” simply asks Google Play again.
Google's handling of the transaction is covered by the Google Privacy Policy and the Google Play Terms of Service.
6Remote configuration
The App asks Firebase Remote Config for a small set of operational settings — for example whether ads are shown at all, and whether to prompt for an update. That request carries an app instance identifier and basic device and app information generated by the Firebase SDK. It carries nothing you have scanned, created or saved.
It is what lets us turn an ad unit off for everyone without shipping a new version. Firebase is operated by Google; see the Firebase privacy documentation.
7Permissions
| Permission | Why | When |
|---|---|---|
| Camera | To read QR codes and barcodes in the viewfinder. | Asked the first time you open the scanner. Frames are processed on the device and never recorded. |
| Contacts (read & write) | To save a scanned contact code to your address book, and to fill your own details into a card. | Asked only when you tap Save to Contacts or use contact autofill. |
| Internet | Link safety lookups, ads, purchases and remote settings. | Granted at install, as on every Android app that uses a network. |
| Vibration | The short buzz when a code is read, if you leave it on. | Granted at install; switch it off in Settings. |
| Advertising ID | Declared because the ads SDK uses it on the free plan. | Not used when ads are off or you are on Premium. |
| Storage (legacy) | Saving an image to the gallery on Android 9 and older. | Not requested on modern Android, where the system handles the save. |
The App does not ask for photo-library access: choosing an image goes through the Android system photo picker, which hands over only the file you picked. It does not ask for location, microphone, calendar or Wi-Fi permissions — adding a scanned network goes through the system Wi-Fi sheet instead.
8Sharing and exports
When you share or export a code or a card, the file goes where you send it: your gallery, a messaging app, a printer, a cloud drive you chose. We are not in that path and receive no copy.
A share from the free plan appends a short credit line with a link to QR Craft on Google Play. On Premium that line becomes a personal credit instead, and Settings → Share anonymously removes your name from it.
9Children
QR Craft is a general-purpose utility and is not directed at children. We do not knowingly collect personal information from children, and — as set out above — we do not collect personal information from anyone. If you believe a child has provided personal information through a message to us, write to contact@epsilondevelopers.xyz and we will delete it.
10Retention and deletion
- On your device: kept until you delete it. Settings → Backup clears scan history, generated codes and saved cards separately; uninstalling the App removes everything, including preferences.
- With us: nothing to retain, because we hold nothing. Emails you send us are kept only as long as needed to deal with them.
- With Google: Web Risk lookups, ad requests, purchases and Firebase requests are retained under Google's own policies, linked above.
The Data Deletion Notice sets out the steps.
11Security
App data is held in Android's private per-app storage, which other apps cannot read on an unmodified device. Network requests are made over HTTPS. Because we hold no copy of your content, there is no account of yours for anyone to break into.
No system is perfect: a device that is rooted, shared or compromised can expose anything on it, and a code you print is readable by anyone who can see it.
12International transfers
We are based in India. The services named in this policy are operated by Google and may process requests on servers outside your country under their own safeguards. Since the App sends no personal content of yours to us, there is no transfer of your data by us to describe.
13Your rights
Depending on where you live, you may have rights to access, correct, delete or port your personal data, or to object to its processing — for example under the EU/UK GDPR, India's Digital Personal Data Protection Act, 2023, or a US state privacy law.
In this App those rights are mostly exercised directly: the data is on your device, and you can view, change and delete all of it without asking anyone. For anything held by Google as a result of an ad request, a Web Risk lookup or a purchase, please use Google's own privacy controls. If you would like help, write to contact@epsilondevelopers.xyz.
We do not sell or share personal information as those terms are used in US state privacy laws.
Legal basis for processing
Where the EU/UK GDPR, India's Digital Personal Data Protection Act, 2023, or a similar law applies, the processing described here rests on:
- Consent — for permissions you grant (camera, contacts) and, where required, for personalised advertising by Google AdMob.
- Contract — to deliver the features you ask for, including Premium once purchased.
- Legitimate interests — checking scanned links for known threats, and keeping the App working and secure.
- Legal obligation — where the law requires us to keep or disclose information.
14Third-party links and destinations
A QR code can point anywhere. Opening a scanned link, a UPI app, a map, WhatsApp or a store page takes you to a service we do not control and whose privacy practices are its own. The App's link-safety warnings are a help, not a guarantee — see the Terms of Use.
15Changes to this policy
If this policy changes, the new version is published here with a new “last updated” date, and a material change will also be noted in the app listing. Continuing to use the App after a change means you accept the updated policy.
16Contact
Questions, corrections or requests: contact@epsilondevelopers.xyz.
Epsilon Developers, India. We answer to the address you write from, usually within a few working days.