Privacy for Abundera QR Check
This page says what the QR safety checker processes, what it keeps and for how long. The Abundera privacy policy covers accounts, billing and the rest of the family; the data processing agreement and the sub-processor list live at abundera.ai/legal/.
What we process when you scan
Your browser decodes the QR code. Only the decoded text (the URL or payload) is sent to our analyzer. Our edge derives a coarse location cell and a device class from the request for the scan-pattern signal described below; the image stays in your browser.
If you press the optional AI vision button, that single captured image is uploaded to our vision worker and read by a vision model running on Cloudflare Workers AI. The image is used for that one request and is not stored.
What we keep, and for how long
Verdict cache: the classification of a payload, keyed by a salted hash of the payload, for 30 minutes to 24 hours depending on the verdict class. The payload text itself is not stored in the cache.
Scan-pattern counters: anonymous counts per hashed payload, 15-minute time bucket and coarse location cell, kept for 48 hours. Nothing derived from them is shown until at least 5 distinct scanners have contributed.
Rate-limit counters: a salted hash of your IP address, kept for the length of the limit window plus one minute.
Scan history: kept in your browser's local storage only. It is never sent to us and you can clear it at any time.
Mutation alerts: if you subscribe, your email address and the hashed payload are kept for up to one year after you confirm; unconfirmed requests expire after 7 days. Every message carries a one-click unsubscribe link.
Billing: paid tiers are billed by Stripe through your Abundera account. We never see or store card details.
Reputation services
To classify a destination we query Google Safe Browsing, URLhaus (abuse.ch) and Chainabuse with the URL or a hash of it. They receive the URL, never your identity or address. Each is listed with its role in the sub-processor list.
Cookies and analytics
The scanner sets no cookies and loads no advertising or tracking scripts. Cloudflare's anonymous performance beacon measures page timing without identifying you.
Your rights and how to reach us
Ask for an export or deletion of anything tied to you, including a mutation-alert subscription, at hello@abundera.ai. The full rights section (GDPR, CCPA, do-not-sell) is in the Abundera privacy policy.
Changes
Every change to this page is dated below. Changes to the family policy or the sub-processor list are announced with 30 days' notice at abundera.ai/legal/.
Last updated 2026-09-06.