Privacy Policy

A. Introduction

OpenQR Studio is an open-source web application designed with a privacy-conscious architecture. Because QR codes frequently contain personal or sensitive details—such as vCard contact cards, Wi-Fi network passwords, phone numbers, or private links—the application is engineered to perform QR payload generation, visual styling, logo embedding, and file export operations directly within your web browser rather than on an application backend server.

This policy describes what information the application processes in your browser, how uploaded logos and browser storage mechanisms are handled, and the distinction between client-side application logic and standard web hosting infrastructure.

Depending on which QR code type and design options you choose, you may enter or select the following categories of information in the OpenQR Studio interface:

• QR Payload Content: Website URLs and multiline plain text in any UTF-8 language.
• vCard Contact Information: Names, organization, job title, phone numbers, email address, website, physical address, and notes.
• Wi-Fi Network Details: Network SSID, encryption type (WPA, WEP, or Open), Wi-Fi password, and hidden network status.
• Email, Phone & SMS Data: Recipient email addresses, subjects, telephone numbers, WhatsApp numbers, and pre-filled message bodies.
• Location & Calendar Data: Geographic coordinates (latitude, longitude, location label) and iCalendar event titles, dates, times, locations, and descriptions.
• Social, Custom & Logo Inputs: Social media profile handles/URLs, raw custom payload strings, and uploaded logo image files.

In the verified application code, all of the information listed above is held in active in-memory React component state (React.useState) while you interact with the page so the application can validate your input, render the live QR preview, and generate your requested export files.

The following operations execute client-side inside your web browser:

• QR Payload Generation & Validation: Formatting your input into URL, vCard 3.0, Wi-Fi, mailto, tel, sms, geo, WhatsApp, social, iCalendar, or custom strings and checking field validity.
• Live Rendering & Design Customization: Applying module patterns, solid colours, linear and radial gradients, corner finder styles, quiet-zone margins, and error correction levels via client-side SVG DOM generation.
• Scanability Analysis: Calculating relative luminance contrast ratios, quiet-zone compliance, and estimated QR version capacity.
• Export & Clipboard Generation: Serializing standalone SVG vector files, rasterizing PNG and JPEG images via the browser's HTML5 <canvas> API, and copying PNG blobs or payload strings to your system clipboard when you click the copy buttons.

Important Scope Clarification: Client-side processing applies to how OpenQR Studio generates and exports QR codes in your browser. It does not govern the external websites, platforms (such as WhatsApp, Google Maps, or social networks), or mail/phone services that a user's device connects to after scanning a QR code you have created.

When you select a logo image (PNG, JPEG, WebP, or SVG up to 2 MB) in the Logo tab:

• The file is read locally in browser memory using the browser FileReader API (readAsText for SVG files; readAsDataURL for raster images).
• Uploaded SVG files are parsed and sanitized locally in your browser, then encoded as an in-memory base64 data:image/svg+xml;base64,... URI. Raster images are held as in-memory base64 data:image/...;base64,... URIs.
• Uploaded logo files are not uploaded or transmitted to an OpenQR Studio server.
• The in-memory logo data URI is retained only for the duration of your active page session and is discarded immediately when you click Remove Logo, click Reset Design, refresh the page, or close the browser tab.

Based on inspection of the OpenQR Studio codebase and runtime dependencies, browser storage mechanisms are used as follows:

• • localStorage: OpenQR Studio does not save your QR payloads, form inputs, design customizations, or uploaded logos in localStorage. The application uses the next-themes provider solely to store your interface appearance preference ("light", "dark", or "system") under the theme key in localStorage.
• • sessionStorage: Not used by the application code.
• • IndexedDB: Not used by the application code.
• • Cookies: OpenQR Studio's application code does not set or read cookies.
• • Cache Storage & Service Workers: OpenQR Studio does not register a service worker or write user payloads to the browser Cache Storage API.

Browser & System Note: Your web browser, operating system, browser extensions, autofill features, download history, or system clipboard (when you explicitly use Copy QR Image or Copy Payload) operate independently of OpenQR Studio and may cache assets or retain data according to your device and browser settings.

To provide an accurate technical picture, this policy distinguishes between three separate layers of operation:

OpenQR Studio does not maintain a backend database and does not retain your QR payloads or uploaded logo files after your browser session ends:

• Temporary In-Memory State: Entered form values and logo data URIs exist only in browser memory while the tab is open and are cleared when you reset the form, refresh the page, or close the tab.
• Temporary Download Blobs & Canvas Buffers: When you download a PNG, JPEG, or SVG file, the application creates a temporary local Blob object URL (URL.createObjectURL) and revokes it automatically (URL.revokeObjectURL after 250 milliseconds). Temporary offscreen HTML5 <canvas> elements used during raster export have their dimensions reset to 0×0 immediately upon completion.
• Downloaded Files & Clipboard: Any PNG, JPEG, or SVG files you download to your device and any images or text you copy to your clipboard remain stored locally on your device until you delete or overwrite them.

OpenQR Studio implements defensive client-side security controls in its codebase:

• SVG Logo Sanitization: Uploaded SVG files are checked for XML entity declarations (<!ENTITY / <!DOCTYPE), parsed via DOMParser("image/svg+xml"), inspected to reject forbidden elements (<script>, <foreignObject>, <iframe>, SMIL animation tags), inline on* event handlers, external URLs, and unsafe CSS rules, sanitized with DOMPurify, and encoded as a base64 data URI so raw uploaded SVG markup is never injected directly into the page DOM.
• Scheme & Input Validation: Website and social URL fields validate protocols and block executable schemes such as javascript: and data:.
• Export Verification: Generated PNG, JPEG, and SVG files are inspected before download to verify binary headers, pixel dimensions, and absence of unsafe script or external URL constructs.

Responsible Use Reminder: No software or browser environment can guarantee absolute security. Because static QR codes can be read by anyone with a camera, avoid placing QR codes that contain sensitive passwords or private personal data in public areas, and ensure your own device and browser extensions are trustworthy.

OpenQR Studio is a general-audience utility tool that does not offer user accounts, community profiles, or data collection forms, and does not knowingly collect or store personal information from anyone, including children.

This Privacy Policy may be updated if the functionality or technical behaviour of OpenQR Studio changes. Any updates will be published on this page and committed to the public source repository with an updated revision date.

OpenQR Studio is an open-source project maintained on GitHub. If you have questions about this Privacy Policy, wish to inspect the source code, or want to report a technical or privacy issue, please visit the official GitHub repository: