Privacy Policy

Last updated: March 2026

Tuxxin QR Track is a self-hosted, open-source QR code management system. This policy explains what data is collected when visitors scan QR codes managed through this service, and how that data is used.

What We Collect

Scan Logs

Every time a QR code is scanned, the following information is recorded:

• IP address — used to identify approximate geo-location and detect duplicate scans.
• User agent — the browser or OS string reported by the scanning device, used to detect device type.
• Geo-location (city, region, country, ISP) — derived from the IP address via ip-api.com. Geo-data is cached in the database after the first lookup for a given IP to avoid repeated external requests.
• Timestamp — the date and time of the scan.
• Scan status — whether the scan was successful or blocked (e.g., if the QR code was disabled).

This data is stored in a SQLite database on the server hosting QR Track. It is used exclusively to provide scan analytics to the QR code owner and is not shared with third parties.

IP-API.com

QR Track uses ip-api.com to resolve IP addresses to geo-location data (city, region, country, ISP). Each unique IP is only looked up once; results are cached locally. The ip-api.com privacy and legal page governs how they handle IP lookups.

What We Do Not Collect

• We do not collect names, email addresses, or any personally identifiable information beyond an IP address.
• We do not use tracking cookies on scan redirect pages.
• We do not share scan data with advertisers or analytics platforms.
• WiFi QR codes do not route through the server and generate no scan logs.

Cloudflare & Proxy Handling

If QR Track is deployed behind Cloudflare or a similar reverse proxy, it may be configured to read the real visitor IP from X-Forwarded-For or CF-Connecting-IP headers. Cloudflare’s own privacy policy governs any data they process at the network level.

QR Track also recognises Apple iCloud Private Relay IPs and logs them as masked with no geo-lookup attempted.

Data Retention

Scan logs are retained in the SQLite database for as long as the QR Track instance is operated. There is no automatic purge schedule. The administrator of the self-hosted installation is responsible for managing data retention and deleting records as appropriate for their use case and applicable data protection laws.

This Website (qr-track.tuxxin.com)

The marketing website at qr-track.tuxxin.com uses the following third-party services:

• Google Analytics 4 — to measure page views and general visitor traffic. Google’s privacy policy applies.
• Google AdSense — to display advertisements. Google’s privacy policy and ad policy apply.

No personal data beyond standard server logs is collected by this marketing site itself.

Contact

Questions about this privacy policy or how scan data is handled by a specific QR Track installation should be directed to the administrator of that installation. For questions about the QR Track software itself, open an issue on GitHub or visit tuxxin.com.