Privacy policy

The short version

• QR codes, barcodes, scans and conversions are processed in your browser. What you type or upload into the tools is not sent to our servers.
• We have no user accounts.
• Like every website, our hosting provider receives standard technical request data such as IP addresses.
• If you contact us, we receive what you send so we can reply.
• We currently use no analytics or advertising cookies.

Information processed only on your device

The following stays in your browser tab and is not transmitted to us or stored by us:

• Content you encode: links, text, contact details, Wi-Fi network names and passwords, event details, and everything else you enter into the generators.
• Logos you upload to style a code. They're re-encoded on your device and discarded when you leave the page.
• Images you decode or convert, and CSV files you use for bulk generation.
• Camera video used by the scanners. The camera is only switched on after you press “Start camera”; frames are analysed locally, never recorded or uploaded, and the camera is released when a code is found, when you press stop or when you leave the page.

Files you download (PNG, SVG, PDF, ZIP and so on) are created on your device. We don't keep copies, so we can't recover codes you've made.

Information our servers receive

Technical request data

When your browser loads a page, our hosting and network providers receive information that is part of every web request: IP address, the page requested, date and time, browser and device type (user agent), and the referring page. This is used to deliver the site, keep it secure and diagnose problems, and is kept in server logs for a limited period set by our hosting provider, after which it is deleted.

Contact and abuse-report messages

If you use our contact or report forms, we receive your name, email address, subject, message and, for reports, any link you include. We use this only to respond, to investigate reports and to keep a record of correspondence. Messages are delivered to us by email and kept for as long as needed to handle your request and any follow-up, generally no longer than two years, unless we need them to deal with a legal issue. To protect the forms from abuse, we count recent submissions using one-way hashes (scrambled codes that can't be turned back into the original) of your IP address and email address, never the addresses themselves. These counters expire automatically within an hour.

Cookies and local storage

We don't use cookies to make the tools work. If optional analytics or advertising are enabled, we store your consent choice in your browser's local storage so we don't ask again on every page. Details are in our cookie policy.

Analytics

We don't currently use any analytics service. If we add one, we'll update this policy and ask for your consent where required.

Advertising

This site does not currently show advertising. If we introduce Google AdSense or other ads in future, we'll update this policy, describe the vendors involved and how to opt out of personalised advertising, and ask for your consent where the law requires it.

Third-party services

• Hosting and delivery providers process technical request data as described above.
• Email delivery: contact messages pass through our email provider.
• Rate limiting: the short-lived hashed counters described above are kept in our server's memory or, where enabled, in a rate-limiting database run by an infrastructure provider (Upstash).
• PayPal: if you choose to donate, you leave our site for PayPal, whose own privacy policy applies. We receive only what PayPal shares with recipients of payments.
• Links you open: when you open a link from a scanned code or a guide, the destination site's own policies apply.

Fonts and scripts needed for the tools are served from our own site; we don't load third-party font or tracking scripts by default.

Legal bases (EEA and UK visitors)

• Legitimate interests for operating and securing the website (technical request data, rate limiting).
• Steps at your request / legitimate interests for replying to messages you send.
• Consent for optional analytics and advertising cookies, which you can withdraw at any time from the “Cookie settings” link in the footer.

Your rights

Depending on where you live, you may have the right to access, correct, delete or restrict the use of personal information we hold about you, to object to processing, to data portability, and to complain to your local data-protection authority. In practice, the only personal information we hold is in messages you've sent us. To make a request, use our contact form or email info@biaoc.online. We'll respond within the time the law requires.

We don't sell personal information, and we don't share it for cross-context behavioural advertising except through optional ad cookies you consent to.

Children

The site is suitable for general audiences, including students, but it isn't directed at children under 13 and we don't knowingly collect their personal information. If you believe a child has sent us personal information, contact us and we'll delete it.

Security

The site is served over HTTPS with security headers that restrict what scripts can run. See our security policy. No method of transmission or storage is completely secure, but processing your content on your own device means there's very little for us to protect in the first place.

Changes

We'll update this policy when our practices change, and revise the date at the top. Significant changes, such as introducing advertising, will also be reflected in the cookie banner.