The QR code generator runs in your browser, and what you type into it (a link, your Wi-Fi password, a contact) never reaches us. This policy explains, in plain language, the little data the site does handle, what it is for, how long we keep it, and how you can exercise your rights under Brazil's General Data Protection Law (LGPD, Law 13,709/2018).
- What you type into the generator stays on your device: we don't receive it, store it or see it.
- We count visits and clicks in the simplest way possible: no cookies, no stored IP addresses, and no identifying anyone.
- Your name and email only reach us if you create the free account, join the Pro waitlist or write to us through the contact page.
- People with an account occasionally get tips about it; news only goes to those who ask for it. Every email has an unsubscribe link, and one click is enough.
- The logo you put on your QR code stays on your device only: it is never sent or stored.
- Today the site uses no advertising cookies. If it ever shows Google ads, you will be able to choose whether to accept personalized ones.
Who is responsible for your data?
The website qrcodegratuito.com.br, QR Code Free Forever, is run by GROWA Serviços e Treinamentos Ltda., CNPJ 64.778.625/0001-61, headquartered in São Luís (MA), Brazil. GROWA is responsible for the data handled here (the “controller,” in LGPD terms). For any privacy matter, including exercising your rights, the channel is our contact page.
What data do we handle, and why?
What you type into the generator: nothing reaches us
The fixed QR code is created in your own browser. What you type (a link, your Wi-Fi password, a contact's details) becomes the QR code design right there, on your device, and is not sent to our server. That is why we have no copy of your QR codes or of what they contain.
Free account
The free account can be created in two ways. If you sign in with Google, Google sends us your name, your email and a code that identifies your Google account (your Google password never goes through us). If you sign up with email and password, we receive the name and email you enter; the password is never stored: all we keep is a scrambled version of it (PBKDF2) that cannot be reversed. We also keep the date the account was created, the last access and your email choices (account tips and news). To confirm your email, set a new password and welcome you, we send emails through Cloudflare's email service; the links in those emails are valid for a short time (24 hours or 1 hour) and only work once. They exist to keep your account running and unlock its features: the logo in the middle of the QR code and, when they arrive, trackable QR codes. Your session lives in a cookie with a random code; in our database we only keep a scrambled version (hash) of that code.
The logo you put on your QR code is processed only in your browser. It is not sent to our server or stored, not even for an instant, and it disappears when you close or reload the page.
Account tips and news by email
People with a free account and a confirmed email occasionally receive emails about their own account: tips for getting more out of the generator and notices about new account features, such as trackable QR codes when they arrive. We do this based on legitimate interest, because these emails help you make the most of the account you created, and you can turn them off whenever you like: in the "Receive usage tips and account notices by email" box, in My account, or through the "I don't want to receive these anymore" link in any email.
News in general only goes to those who asked for it: in the free account, the "I want to receive news by email" box starts unchecked, and people on the Pro waitlist only get what relates to Pro. The emails are sent from our own sending system, which runs on Cloudflare, with no email marketing company in between. For each email we keep who it went to, when, and whether it was delivered; this is so we don't send the same email twice and can show that we honored an unsubscribe request. We don't add an open-tracking pixel and we don't track who clicked: links to the site carry only the campaign name (utm), which our cookie-free count shows as a total number of visits.
Every tips or news email has the "I don't want to receive these anymore" link, and many email apps also show an unsubscribe button. One click is enough: we turn off tips and news for your account, remove you from the waitlist and keep only a scrambled version (hash) of your email, to make sure no future email includes you. Emails you request yourself, such as a new password, keep arriving. To start receiving them again, just check the box again in My account.
Audience measurement, without cookies
To find out which pages and tools are useful, the site counts a few events: the page viewed, the site you came from (only the site address, such as google.com), the type of device (phone, tablet or computer), the country, clicks on the Generate button, downloads (the QR type, format and size, never the content), which generator options were used (for example, whether the QR code was customized, never the data you typed), whether the QR code was made after reading a blog post, and clicks on post cards. This count uses no cookies, does not store the IP address and creates no identifier for you, so a visit cannot be tied to a person. The numbers are used only to improve the site.
Scans of the App Store QR Code
The App Store QR Code is the only type of QR code that goes through our server. The code carries only the app's identifier in the stores (the App Store number and the Google Play package name), never an arbitrary address. When someone scans that QR code, the server checks whether the phone is an iPhone or an Android, opens the right store and records an anonymous count: the operating system, the approximate city and the time of the scan. The city is estimated from the connection at the moment of the scan, and the IP address is not stored. None of this identifies who scanned.
Pro waitlist
If you join the Pro waitlist, we keep your email, your name (if you provide it) and the features you marked as interesting. We use this data to let you know when Pro opens and to decide what to build first. You join the list by your own choice, with your consent, and you can leave whenever you want.
Contact form
When you write through the contact page, we receive your name, your email, the subject and your message. We use this data only to reply and to resolve what you asked for.
Technical logs and abuse protection
The site runs on Cloudflare's infrastructure, which delivers the pages and protects the site against attacks. As with any website, every visit generates technical logs, such as IP address, browser type, date, time and page accessed. To prevent mass submissions in the forms and in the measurement, the IP address is also used briefly to limit repeated requests, without being written to our database.
Services your browser accesses
To build the pages, your browser fetches fonts from Google Fonts and some libraries and images from the cdnjs and jsDelivr services, such as the images in the WhatsApp emoji picker. In the App Store tool, the browser itself asks Apple for the app's name, to check the App Store link. These services receive the technical data of any connection (such as IP and browser type), but not what you typed into the generator.
Cookies and preferences in your browser
Today the site stores no advertising or tracking cookies. Some preferences are kept only in your browser, such as the emojis you used most recently and the control that keeps house notices from showing up all the time. The details, including what changes if the site starts showing Google AdSense ads, are in the cookie policy.
On what basis, and for how long?
The LGPD only allows personal data to be processed when there is a legal basis, one of the justifications listed in Article 7. Here is each case:
| Data | Purpose | Legal basis | How long |
|---|---|---|---|
| What you type into the generator | Creating the QR code on your device | Not applicable: this data never reaches us | We don't store it |
| Audience measurement (no cookies and no IP) | Knowing which pages and tools are useful | Legitimate interest (Art. 7, IX) | Up to 25 months |
| App Store QR code scans | Opening the right store and counting scans | Legitimate interest (Art. 7, IX) | Only the anonymous count remains, with no IP |
| Name, email, scrambled password or Google account code (free account) | Keeping your account and unlocking its features | Performance of a contract (Art. 7, V) | As long as the account exists; when you delete it, we erase the data immediately |
| Usage tips and account notices by email (free account with confirmed email) | Helping you make the most of the account and telling you about its new features | Legitimate interest (Art. 7, IX) | As long as the account exists, until you turn it off in My account or click "I don't want to receive these anymore" |
| News by email (free account) | Sending site news | Consent (Art. 7, I) | Until you uncheck it in My account or click "I don't want to receive these anymore" |
| Log of each tips or news email (to whom, when and the result) | Not repeating sends and proving that an unsubscribe was honored | Legitimate interest (Art. 7, IX) | Up to 24 months |
| Hash of the email of anyone who unsubscribed | Never sending tips or news again to anyone who asked to opt out | Legitimate interest (Art. 7, IX), to honor your request | Until you ask for the emails again in My account |
| Waitlist email, name and interests | Letting you know when Pro opens and setting priorities | Consent (Art. 7, I) | Until you leave the list or until the waitlist ends |
| Contact name, email and message | Replying and resolving your request | Legitimate interest (Art. 7, IX) | Up to 12 months after the last reply |
| Technical logs (IP, browser, date and time) | Delivering the site and protecting it against attacks and abuse | Legitimate interest (Art. 7, IX) | The period Cloudflare uses for security, or whatever the law requires |
| Preferences in your browser | Remembering emojis and spacing out the house notices | Not applicable: they stay only in your browser | Until you clear the site's data in your browser |
When data is no longer needed, it is erased or anonymized. If the law requires us to keep a record for longer, it is kept only for the mandatory period.
Who do we share it with?
We don't sell or rent personal data. It only passes through those who help the site work:
- Cloudflare: hosting, network, security, the site's database (accounts, waitlist, messages and counts) and the sending of account emails, tips and news.
- Google: the free account sign-in (done on Google itself), Google Fonts fonts and, if ads are turned on, Google AdSense. Google handles this data under its own privacy policy.
- cdnjs and jsDelivr: delivery of the generator's libraries and of the emoji images.
- Apple: lookup of the app's name in the App Store tool, done by your browser.
- Authorities: only when the law or a court order requires it.
Because these services operate worldwide, some data may be processed on servers outside Brazil. This international transfer takes place in the cases allowed by the LGPD (Article 33).
What are your rights?
Under the LGPD (Article 18), you can at any time:
- confirm whether we handle any of your data and have access to it;
- correct incomplete, wrong or outdated data;
- request the anonymization, blocking or deletion of unnecessary or excessive data, or data handled in violation of the law;
- request the portability of your data to another provider;
- request the deletion of data handled with your consent, such as the waitlist email;
- delete your free account yourself, at any time, in My account: your name, email and sessions are erased immediately;
- find out who we share your data with;
- know that you may refuse to give consent and what happens in that case (without an email, for example, you can't join the waitlist);
- revoke your consent whenever you want;
- stop the account tips emails whenever you want, in My account or through the link in any email, without having to explain why;
- object to processing carried out without consent, if it violates the law;
- file a complaint with Brazil's National Data Protection Authority (ANPD).
How do I make a request?
- Go to the contact page and choose the subject “Privacy (LGPD).”
- Say which right you want to exercise and give the email you used with us (on the waitlist or in the contact form).
- If we need to confirm that the request is really yours, we will ask for that at the same email.
- We reply within the deadlines set by the LGPD.
Since what you type into the generator never reaches us, and the measurement identifies no one, there is nothing of that kind to access, correct or erase. If you think your request was not properly handled, you can file a complaint with the ANPD at gov.br/anpd.
How do we protect the data?
The site uses a secure connection (HTTPS) and Cloudflare's protection against attacks. The little data we keep, such as the waitlist and contact messages, can only be accessed by the people who run the site, with a password. No system is proof against everything: if a security incident happens that could bring you significant risk or harm, we will notify you and the ANPD, as the LGPD requires.
Children and teenagers
Anyone can use the generator, which asks for no data. The waitlist and the contact form, however, are not designed for children. If we find out that we received a child's data without the consent of a parent or guardian, we erase that data.
Can this policy change?
It can, whenever the site changes, for example when the free account and Pro arrive or if Google ads are turned on. The date of the latest update is at the bottom of this page, and important changes will be announced prominently on the site. See also our terms of use and the cookie policy.
Last updated: October 1, 2026.