Privacy
Privacy policy
This policy covers the QRRA public website and the QRRA Android app (application ID eu.qrra.app). QRRA is a QR content preview and risk-analysis tool. It scans QR codes on your device and can submit URLs to the QRRA backend for deeper analysis. Last updated 2026-09-03.
What the app processes on your device
Scanning, decoding, and the first-pass risk review happen locally on your device. Non-URL QR content (Wi-Fi, contacts, calendar, payment, OTP, plain text) is previewed locally, and sensitive fields such as OTP secrets, Wi-Fi passwords, and payment targets are masked in previews and in any copied or shared report.
What the app sends off your device
| Data | Why | Your control |
|---|---|---|
| Scanned URL and URLs extracted from a QR code | Submitted to the QRRA backend for phishing / risk analysis. | Controlled by the “auto-submit URL” setting; extracted URLs are confirmed before submission and are never auto-sent from SMS, email, calendar, or contact bodies. |
| A per-app identifier (hashed Google Play App Set ID, or a random per-install ID if unavailable) | To correlate scan submissions from the same install for rate limiting and abuse prevention. It is not an advertising identifier and is not used for ads. | Reset by clearing app data or reinstalling. |
| Technical context sent with a scan (Android platform and device model) | To operate the service and interpret results. | — |
| Google Play Integrity token and security verdict data | To verify the app, installation license, request binding, and device integrity before accepting a URL submission. | Required for Android URL submissions. The request hash does not contain the raw URL. |
| Google ML Kit diagnostic data (device/app information, performance metrics, and per-install identifiers) | Google may collect this data for diagnostics and usage analytics. QR images and decoded QR content remain on the device. | Used for on-device barcode scanning. |
| Feedback / dispute email content, if you choose to send it | Opened as a pre-filled email in your own mail app; sent only if you send it. | Optional; you compose and send it yourself. |
How submitted URLs are used and shared
Submitted URLs are analyzed by the QRRA backend, which may query third-party threat-intelligence and reputation services as part of the assessment. Data is transmitted over encrypted (HTTPS) connections. QRRA does not sell your data and does not use it for advertising.
Retention
Submitted URLs, their analysis results, processing logs, and the link to the per-app identifier are automatically deleted 90 days after submission. The per-app identifier profile may be retained longer for rate limiting and abuse prevention. To request deletion of data associated with your identifier, contact us below.
Analytics and tracking
QRRA does not use third-party advertising, general-purpose analytics SDKs, tag managers, tracking pixels, or marketing cookies. The Android app uses Google ML Kit for on-device barcode scanning and Google Play Integrity for security and abuse prevention. See Google's ML Kit data disclosure and Play Integrity data terms. The app requests Camera permission to scan QR codes and network access to submit URLs for analysis and perform these security checks.
Contact
Operated by QRRA.
Privacy / feedback: feedback@qrra.eu
Security: security@qrra.eu