Your data, in plain words.
Last updated 29 October 2026
Short version: we collect what we need to run your codes and nothing for advertising. People who scan your codes don't need an account and aren't tracked with cookies. You can delete your account and everything in it from the app at any time.
Who we are
Qrunto is an app and website for making QR codes for menus, Wi-Fi, links and WhatsApp. It's run by Muhammad Zubair, an individual based in Pakistan, who is responsible for your personal data ("we", "us"). Contact us at support@qrunto.com.
This policy covers the Qrunto app, this website (qrunto.com) and the pages people see when they scan a Qrunto code (qrts.app).
If you use Qrunto for your business
What we collect
- Your account. When you open the app we create an anonymous account so you can try it. If you create an account or sign in, we store your email address. We don't use passwords; we email you a one-time code.
- Your business profile. Business name, type, brand colour, logo, and if you add them, phone number, WhatsApp number, address and opening hours. Your profile appears on your menu pages and printed codes.
- Your codes. What each code is called and what it opens: a link, a WhatsApp number and message, or a Wi-Fi network name and password.
- Your menus and price lists. Sections, items, prices and changes to them. If you photograph a printed menu, we keep the photo only while the app reads it, then delete it.
- Scan counts. How many times your editable codes are scanned (see below).
- Your plan. Whether you're on the free plan or Pro. When paid plans launch, payments go through the App Store or Google Play. We learn whether you have Pro, not your card details.
- Messages you send us, for example to support@qrunto.com.
The app asks for camera access to scan codes and photograph your menu, and photo access if you pick a menu photo or logo from your library. You can refuse either and still use the rest of the app. Photos are re-encoded before upload, which removes location data stored in the file.
Why we use it
- To run the service you asked for: create, show and print your codes and menus, and keep your account working. (Under UK GDPR, this is to perform our contract with you.)
- To keep people safe: check links against Google's list of unsafe sites, stop codes that point somewhere harmful, and handle reports of fake or misleading stickers. (Our legitimate interest, and our customers' safety.)
- To show you scan statistics, and to fix problems and improve the app. (Our legitimate interest in running a useful service.)
- To email you sign-in codes and reply when you contact us.
We don't sell your data, and we don't use it for advertising.
If you scan a Qrunto code
You don't need an account or the app. When you scan an editable Qrunto code, we record:
- the time of the scan and which code was scanned,
- your country, worked out by our hosting provider Cloudflare from your connection (not your exact location), and
- the type of device: iPhone, Android or other.
We don't store your IP address with scans, and we don't use cookies, ad trackers or analytics tools on code pages. The business that owns the code sees the totals, not anything that identifies you. Static codes, such as most Wi-Fi codes, don't contact us at all when you scan them.
If you report a code, we store the reason, anything you write, and your email address if you choose to give it. To stop the report form being misused, we briefly use your IP address to limit how many reports can be sent from one connection.
If you join the waitlist
When you join the early-access waitlist on qrunto.com, we store your email address, the type of business you chose, which page of the website you signed up on, and your country (worked out by Cloudflare from your connection). We use them to email you when Qrunto launches and, now and then, about early access. We don't share your email with anyone else. Every email has a way to unsubscribe, or email support@qrunto.com and we'll remove you. (Under UK GDPR, this is based on your consent, which you can withdraw at any time.) To stop the form being misused, we briefly use your IP address to limit sign-ups from one connection.
If you use our free tools
The QR code generators on qrunto.com run entirely in your browser: what you type, including Wi-Fi passwords, isn't sent to us. The QR code checker reads your photo on your device and never uploads it. It sends only the link from the code to our server, which asks Google Web Risk whether the link is on its list of dangerous sites. We don't log the links you check. The answer for each link is cached for up to an hour, with nothing that identifies you, and we briefly use your IP address to limit how many checks one connection can make.
Who we share data with
We use a few providers to run Qrunto. They only process data on our instructions.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, file storage and sign-in | United States |
| Cloudflare | Code pages, this website, domains and forwarding email to us | Worldwide network |
| Resend | Sending sign-in code emails | United States |
| OpenAI | Reading the dishes and prices from menu photos you upload | United States |
| Google (Web Risk) | Checking the links in your codes, and links you check with our QR code checker, for malware and phishing | United States |
| Apple and Google (app stores) | Downloading the app and, when available, paying for Pro | Worldwide |
Menu photos are sent to OpenAI only when you ask Qrunto to read a menu. We use OpenAI's API, whose terms say business data sent through it isn't used to train their models by default.
We may also share data if the law requires it, or to protect people from fraud or harm, for example when a code is used for a scam.
Where your data is stored
Your data is stored in the United States, and we work from Pakistan. When we move data from the UK or EU to other countries, we rely on our providers' standard contractual clauses or similar safeguards.
How long we keep it
- Account, business, logo, codes, menus and scan counts: until you delete them or your account.
- Menu photos: deleted as soon as the menu has been read (usually within a minute), whether or not reading worked.
- Waitlist sign-ups: until you unsubscribe, or until we've told you about the launch and you haven't created an account within a year.
- Reports about codes: as long as we need them to deal with the report and prevent abuse. If you delete your account, reports about your codes are kept without a link to your account.
- Emails to support: as long as needed to help you, then deleted.
- Backups: deleted data can stay in our providers' backups for a short time before they're overwritten.
Deleting your account
In the app, go to Account and tap Delete account. This immediately deletes your account, business profile, codes, menus, logo, menu photos and scan counts. Editable codes you printed stop working. Static codes keep working, because their content is inside the code itself. You can also ask us to delete it by email.
Your rights
You can ask us to show you, correct, export or delete your personal data, or to stop or limit how we use it. Email support@qrunto.com and we'll reply within one month.
- UK users: you can also complain to the Information Commissioner's Office (ico.org.uk).
- US users: depending on your state, you may have similar rights, such as to know, delete and correct your data. We don't sell or share personal information for advertising.
Children
Qrunto is for businesses. It isn't meant for children under 16, and we don't knowingly collect their data. If you think a child has given us data, contact us and we'll delete it.
Security
Data is encrypted in transit, and each business can only reach its own data. Only our server can change safety decisions about codes. No system is perfectly secure, so if you think something is wrong, tell us straight away.
Changes
If we change this policy, we'll update the date at the top. For important changes, we'll tell you in the app or by email first.