How QR Studio handles your content

• QR codes are generated by code that runs in your browser. Your links, Wi-Fi passwords, contact details and messages are never sent to a QR service.
• Images you add are read with your browser's File API and kept in memory as temporary local links (object URLs), which are released when you remove an image or start over.
• Editing — every move, resize and style change — happens in the page's memory.
• Exports (PNG, SVG, PDF) are rendered by your browser and saved straight to your downloads.
• Project files are written and read locally. Imported files are validated, and they can only contain embedded images — never links to outside websites.

• No accounts, sign-in or cookies.
• No database, cloud storage or server-side processing of designs.
• No auto-saving — not even to your browser's local storage, session storage or IndexedDB. Refreshing the page clears your design, so download a project file to keep it.
• No analytics, session recording, advertising pixels or third-party scripts.
• No dynamic or redirecting QR codes and no scan tracking. Your codes contain the actual destination.
• No external fonts or icon services — fonts and icons ship with the app.

To show you the website at all, your browser downloads QR Studio's own files — its HTML, JavaScript, styles and fonts — from our hosting provider. As with any website, the host can see those requests, including your IP address and browser type. Those requests never contain your QR content, images or designs.

When someone scans one of your codes, their phone opens whatever the code contains (for example your website). That happens between their phone and that destination — QR Studio isn't involved.

“Report a bug” opens your own email app with a draft addressed to us. It includes the page you were on, your browser and screen size, but never your design. You can edit or delete anything, and nothing is sent until you press send in your email app.

• The site is built as a static export: there are no API routes or server functions to send data to.
• A Content Security Policy tells your browser to refuse network connections to any other website, so even a bug couldn't quietly send your work elsewhere.
• The page sends no referrer when you follow links out of it.
• Automated tests watch every network request while a test design is created and exported, and fail if anything other than the site's own files is requested — or if anything is written to browser storage.
• An automated audit scans the source code for network and storage APIs before every release.

Anything inside a QR code can be read by anyone who scans it — including Wi-Fi passwords and contact details. Only put information in a code that you're happy for people to see. Project files you download contain your design and images; share them only with people you trust.