Privacy policy

This policy explains what personal data Qwirl processes, why, how long we keep it and what rights you have. It applies to the website, the app and the scan pages at qwirl.io.

1. Who we are

• Data controller: PDB CREATIVE DATA SYSTEMS S.R.L., registered office in Oradea, Bihor County, Romania, tax ID (CUI) 49804830 ("we").
• For any question about personal data: app@qwirl.io.

2. What data we process

If you have an account

• Account data: your email address, name, password (kept only as an irreversible hash; we can't read it), chosen language, country (optional; at first it's guessed from your browser's language settings, and you can change or remove it), plan and chosen color theme.
• Signing in with Google (if you use it): your Google account ID, email address, name and whether the email is verified (the openid, email and profile permissions). We never receive your Google password.
• Connected Twitch accounts: your Twitch user ID, account name, display name and profile picture. We ask for no extra permissions and keep no Twitch passwords or tokens.
• Connected YouTube channels: public channel data (ID, title, handle, image) and public video data (IDs, titles, thumbnails, whether a stream is live), read through YouTube API Services.
• The content you add: QR code names, texts, links, images, videos, prizes (their names, the prize codes you enter, their chance and design settings), the No win screen, look settings and QR code passwords (kept only as a hash).
• Uploaded images: the file, its name, size, dimensions and upload date.
• Activity log: what changed in your account and content, when, and from which part of the service.
• Moderation data: the results of automatic checks, reports about your codes, admin decisions, strikes and appeals.
• Emails sent: which service email we sent you and when (for example sign-in links, confirmations, moderation decisions).
• Company details (optional, only if you fill them in under Account): company name, tax ID, registration number, address, city, postal code and country. Only you and the admins see them.
• Feedback sent from the app: your message and, if you leave "Include page details" ticked, the page address, its title, the window and screen size, the color theme, the browser languages, the time zone, the connection type, errors that happened on the page, the browser name and version, plus your plan and app language. You see exactly what will be sent before sending. We use it only to fix problems and improve Qwirl.
• Your review (optional, Account > Your review): your two ratings (ease of use, design), your words if you write any, your name as first name and last initial, and whether you allow us to show it. We show a review on the website only if you allowed it and we picked it; changing it or unticking the permission takes it off. It's deleted with your account.

If you scan a QR code (no account)

• We don't keep your IP address. To count unique visitors, we keep an irreversible code calculated from the IP address, the browser and the day's date. The code changes every day, so you can't be followed from one day to the next and we can't tell from it who you are.
• What the scan showed: the item, video, live stream, prize or No win screen, plus the time of the scan, the rarity tier and whether the scan was a prize try (so the next try waits 2 hours). On a prize try we also keep an irreversible 12-hour visitor code (made from your IP address and browser with a secret that changes every 12 hours; the IP isn't stored), so an "every Nth scan" prize counts each device once every 12 hours and a winner waits 12 hours before trying again on the same owner's codes.
• If you won a prize: which prize, the code you received, the time of the win and that day's irreversible visitor code, so reloading the page shows you the same prize instead of a new try. We don't ask for your name, email or phone number for prizes.
• If you unlock a password-protected QR code: a cookie that remembers the unlock (see Cookies). To limit password guessing, we count wrong tries for a few minutes, only in the server's memory.
• If you report a QR code: the reason, the details you write, your email if you give it, and an irreversible code of your IP address, to limit abusive reports.

Site statistics (Umami), without cookies

On the website and in the app (not on QR code scan pages) we count visits with Umami, which runs on our own server in Germany, so no one else receives this data. It records the pages visited, a few steps of using Qwirl (creating an account, creating a QR code, adding an item, downloading a code), where the visit came from (the previous site), the site language, device type, browser, operating system, screen size and approximate country and city. It sets no cookies and stores nothing on your device. Your IP address is only used at the moment of the visit, to find the approximate location and to make an anonymous visitor code that changes every month; the IP address itself isn't stored. We don't link this data to your account, we leave out the part of addresses after "?" (which can hold sign-in links) and we don't count browsers that send Do Not Track.

For a small share of visits, Umami also records how the page was used: mouse movements, clicks and scrolling, shown back to us as a replay and as heatmaps (where people click and how far they scroll). All text on the page is hidden in these recordings and nothing typed into forms is recorded, so they show the layout, not your content. They aren't made on QR code scan pages or on pages opened from a link in one of our emails.

Site analytics (Google Analytics), only with your consent

On the website and in the app (not on QR code scan pages) we use Google Analytics 4, only if you choose "Accept analytics" in the cookie notice. It shows us how Qwirl is used: pages visited, where visitors come from, device and browser type, approximate country and city. Google Analytics 4 doesn't keep full IP addresses. We don't link this data to your account and don't use it for advertising.

If you choose "Only necessary", Google Analytics doesn't load at all. You can withdraw your consent at any time from Cookie settings (in the site footer or in Account); the Google Analytics cookies are then deleted.

Anti-robot check

The public forms (sign-in, sign-up, password reset, reporting, unlocking) use ALTCHA, a check hosted on our own servers: your browser solves a small calculation. No data is sent to third parties and no cookies are used for it.

3. Why we use it (legal basis)

• To provide the service you asked for: account, QR codes, scan pages, prizes, integrations, stats, export and import (performance of a contract, Art. 6(1)(b) GDPR).
• To keep the service safe and lawful: content moderation, reports, strikes, abuse limits, the activity log, protection against robots (legitimate interest, Art. 6(1)(f)).
• To send you service emails: sign-in links, confirmations, email changes, moderation decisions (performance of a contract).
• To understand how the site is used (Umami, without cookies): our legitimate interest in improving Qwirl (Art. 6(1)(f)); you can object at any time, for example by turning on Do Not Track in your browser.
• To understand how the site is used (Google Analytics): only with your consent (Art. 6(1)(a)), which you can withdraw at any time.
• To meet legal obligations, for example requests from authorities or accounting obligations (Art. 6(1)(c)).

We don't sell personal data, don't show ads and don't use your data to train artificial intelligence models.

4. Automatic content checks

Texts, links and images added to QR codes (including prize texts and the No win screen) are checked automatically against the content rules, with word and domain lists.

If the admin has turned on AI checks, texts and images may be sent to the moderation service or services the admin chose: OpenAI (moderation), Anthropic (Claude), Google (Gemini) or Mistral. They only classify the content; the decision is Qwirl's.

A flagged QR code goes to review: it stays active, but scans show "being reviewed" until a person decides. No strike is ever given on an automated decision alone.

5. Google, YouTube and Twitch

• Qwirl uses YouTube API Services. By connecting a YouTube channel, you also agree to the YouTube Terms of Service. How Google processes data is described in the Google Privacy Policy.
• We only read public YouTube data. We refresh it regularly and delete it when you disconnect the channel or delete your account.
• Qwirl's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
• You can remove Qwirl's access to your Google account at any time in your Google security settings.
• Connecting Twitch uses Twitch sign-in without permissions: we only learn which account is yours. You can disconnect in Qwirl or in your Twitch connections.
• The YouTube and Twitch players on scan pages are loaded from those platforms and follow their own rules and cookie policies.

6. Who processes data for us

For everyone who uses Qwirl

• Hosting and file storage: Hetzner Online GmbH, Germany (servers and storage in the EU).
• Site analytics, only with your consent: Google Ireland Limited (Google Analytics).
• Sending service emails: Amazon Web Services EMEA SARL (Amazon SES), in an EU region.
• Google and Twitch, only when you choose to sign in or connect accounts with them.

Tools used by the platform's admins

• AI moderation, only the services the admin turned on: OpenAI, L.L.C., Anthropic PBC, Google LLC (Gemini) or Mistral AI SAS. They receive the texts and images to check.
• Notifications for admins: Pushover, LLC, which receives the QR code's name and the reason for a report or review.

Some providers are outside the EU or belong to groups outside the EU. These transfers are covered by the EU Standard Contractual Clauses or by the EU-US Data Privacy Framework.

7. How long we keep data

• Account and content: until you delete them or delete your account. Deleting the account deletes the QR codes, items, prizes, images, stats and connected accounts.
• Activity log: 180 days, then it's deleted automatically.
• Scans and wins: as long as the QR code exists (you delete them with the code or with the account).
• Reports and appeals: 2 years from creation, then they're deleted automatically (open ones stay until they're resolved), so repeated abuse can be recognized.
• Umami statistics: 14 months, on our own server, then they're deleted automatically.
• Umami replays: 30 days, then they're deleted automatically (heatmaps are kept like the statistics).
• Google Analytics data: 14 months, at Google (only if you accepted analytics).
• Backups: up to 30 days after deletion.

8. Cookies

Strictly necessary cookies (we don't ask for consent for them, because the service doesn't work without them):

• payload-token: keeps you signed in.
• qwirl-locale: remembers your language (1 year).
• qwirl-unlock-…: remembers that you unlocked a password-protected QR code (12 hours).
• qwirl-prize-…: on a QR code with prizes, remembers when you last tried for a prize and whether you won, so tries are 2 hours apart and you win only once on that code (1 year). It holds only a time and yes/no.
• qwirl-google-…, qwirl-twitch-state: protect signing in with Google or Twitch (deleted after sign-in).
• qwirl-sidebar: remembers whether you collapsed the app's sidebar.
• qwirl-cookies: remembers your choice in the cookie notice (1 year).

Analytics cookies (only if you choose "Accept analytics"; not on scan pages):

• _ga, _ga_…: Google Analytics, to tell visitors and sessions apart (up to 2 years).

Your browser also keeps a few display choices on your device only (light or dark, the sign-in tab you used, the size when downloading a QR code); they're never sent to us. Umami, our site statistics, uses no cookies.

We don't use advertising cookies. You can change your choice at any time from Cookie settings.

9. Your rights

Under the GDPR, you have the right to: access your data, rectification, erasure, restriction of processing, portability (a copy in an easy-to-use format) and to object to processing based on legitimate interest.

You can do much of this yourself in your account: change your name, email, password and country, download all your QR codes in one file, change your cookie choice and delete your account. For anything else, write to us at app@qwirl.io. We reply within one month at most.

If you consented to analytics, you can withdraw your consent at any time, without affecting what was processed before.

You can lodge a complaint with the Romanian data protection authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro, or with the authority in the country where you live.

10. Children

Qwirl is not meant for children under 16. We don't knowingly collect their data. If you learn that a child has given us data, write to us and we'll delete it.

11. Security

Account and QR code passwords are kept only as hashes. Access keys for outside services are encrypted. Connections use HTTPS. Admin access is limited and every action is recorded in the log.

12. Changes

If we change this policy in an important way, we tell account holders by email before the change applies. The date of the last update is at the top.

Romanian is the original version of this policy; this translation is for your convenience. If the two differ, the Romanian version applies.