Skip to content
QRSong! Logo

Privacy Policy of QRSong!

Last updated: November 1, 2026

Introduction

Welcome to QRSong! (https://www.qrsong.io). We are committed to protecting your privacy. This policy covers our website and the QRSong! app for iPhone and Android, and details the information we collect, how it is used and shared, and your rights regarding your data. You can reach us at info@qrsong.io.

Information We Collect

  • Order Details: When you place an order, on our website or in the app, we collect your name and email address, and for printed cards your delivery address. We use them to make your cards, deliver them, and email you about your order, such as its confirmation and the download link of a PDF.
  • Your Playlist and Designs: The playlist you choose and the designs you make: colours, texts, fonts and the photos or logos you add to your cards or gift box. Photos you upload are stored on our servers so we can print them.
  • Payments: We never see or store your card or bank details. Payments on our website, and for printed cards in the app, are handled by Mollie. A PDF bought in the app is paid through the App Store or Google Play: Apple or Google handles the payment, and we only receive proof of the purchase (the product, a transaction number and the order it belongs to) so we can deliver your PDF.

Usage Data and Order Tracking

We collect and process the following data related to your order:

  • Order Identification: Each card set is assigned a unique batch number linked to your purchase for order management, quality assurance, customer support, and fraud prevention.
  • Usage Statistics: We track how many cards from your set have been scanned and when they were used. For the most recent scans we also keep the IP address and the approximate location (city and country) we look up from it in our own database. This helps us provide service improvements, customer support, and detect unauthorized redistribution.

Legal Basis: Contract performance (to fulfill your order and provide support) and legitimate interest (to prevent fraud and unauthorized resale of our products).

The QRSong! App

The app needs no account. This is what it does with your data:

  • Camera: The camera is only used to read the QR codes on your cards, on your phone. No pictures or video leave your device.
  • Scanning a Card: When the app reads a card, it asks our server which song belongs to it. That request carries your IP address and the app version, and counts as a scan as described under Usage Data and Order Tracking.
  • Music Services: To play a song, the app hands it to Spotify, Apple Music or the other music service you chose, through that service's app or player on your phone. The permission you give that service stays on your phone: we do not receive your music account details or what you listen to. The music service's own privacy policy applies to what happens there.
  • Kept on Your Phone: Your settings, your music service and a deck you have not finished yet are stored on your phone only.
  • Notifications: If you allow notifications, the app sends us a device token, which Google's Firebase Cloud Messaging uses to deliver our messages about QRSong! to your phone. You can turn notifications off at any time in your phone's settings.
  • Sharing a Playlist to the App: A playlist you share to QRSong! from your music app is only used to start a new deck with it.
  • No Tracking or Advertising: The app contains no analytics, advertising or tracking tools, does not follow you across other apps or websites, and sends nothing to Meta or other advertisers. The cookies, analytics and session recordings described below are about our website only.
  • Removing Your Data: Removing the app deletes everything it kept on your phone. To have the data of your orders deleted, email us (see Your Rights).

Sharing Your Information

  • Data Hosting and Storage: Your data is stored on Amazon Web Services (AWS) in Frankfurt, Germany, which also sends our emails.
  • Printing and Delivery: For printed cards, our printing partner Print en Bind in the Netherlands receives your name, email address and delivery address to print and send your order, and the delivery company (such as PostNL) receives what it needs to deliver your parcel.
  • Payments: Mollie processes payments on our website and for printed cards in the app; Apple and Google process purchases made through the App Store and Google Play.

We do not sell your data, and we share it with no one else, except for the analytics, error reports and advertising measurement on our website described under Cookies, Analytics and Session Recordings, or when the law requires it.

Cookies, Analytics and Session Recordings (Website)

When you first visit our website, a cookie banner asks which cookies you accept. Cookies the website needs to work are always on. The analytics described below only start after you accept the Performance category, the advertising measurement only after you accept the Advertising category, and each stops as soon as you withdraw that choice with the cookie settings button that stays on every page.

  • Product Analytics and Session Recordings (PostHog): With your consent we use PostHog to see how visitors use our website: which pages they open, what they click, and where they get stuck or leave. We also record visits (page changes, clicks, scrolling and what the page showed) so we can replay them and find what does not work. Everything you type into a form is hidden in these recordings, and so are your name, email address and address wherever the website displays them. PostHog uses your IP address to determine your country and city. We use this data only to improve our website, never for advertising, and we do not sell it.
  • Error Reports: When something breaks on our website, a technical error report (the error, the page, and your browser and device type) is sent to PostHog so we can fix it. This also happens without your consent, based on our legitimate interest in a website that works, and it does not set cookies.
  • Processor and Retention: PostHog Inc. processes this data on our behalf on servers in the United States, under a data processing agreement that includes the EU Standard Contractual Clauses. Session recordings are deleted after 30 days. Other analytics data is kept only as long as we need it to improve our website.
  • Advertising Measurement (Meta): We advertise on Facebook and Instagram. If you accept the Advertising category, Meta can measure which of our ads led to a purchase. When you then place an order, our server also sends Meta the order number and amount, your IP address and browser type, Meta's cookie on our website, and your email address, name, city, postcode and country in hashed form: a code that Meta can only compare with the details of its own users, to recognise who saw an ad. Meta uses this to count the purchases our ads bring and to show our ads to people who are likely to be interested. Without your consent we send Meta nothing. How Meta handles this data is described in Meta's own privacy policy.

Data Security

We take the security of your data seriously. Your personal information is stored securely on AWS, protected with industry-standard encryption protocols both in transit and at rest. We implement stringent security measures to prevent unauthorized access, alteration, and misuse of your data.

Data Retention

Personal information (name, address, email) is retained for as long as necessary to fulfill our contractual obligations and comply with legal requirements, typically 7 years for tax and accounting purposes. Usage data and order tracking information is retained for up to 3 years from purchase for fraud prevention and customer support purposes. You may request deletion of your data at any time, subject to our legal retention obligations.

Service Communications

We may send you transactional emails related to your purchase, including order confirmations, shipping updates, and product-related notifications. If you have opted in to receive marketing communications, we may also send you review requests and promotional emails. You can opt out of marketing communications at any time by clicking the unsubscribe link in our emails or by contacting us.

Your Rights

  • Access, Correction, and Deletion: You have the right to access, correct, or request the deletion of your personal data at any time. To request deletion, use our contact form or email us at info@qrsong.io.
  • Data Portability: You have the right to request a copy of the data we hold about you in a structured, commonly used, and machine-readable format.
  • Right to Object: You have the right to object to this processing if you feel it impacts your personal rights and freedoms. You can exercise this right by emailing us at info@qrsong.io.

International Data Transfers

Your data is stored by AWS in Frankfurt, Germany. Analytics data and error reports from our website are processed by PostHog in the United States, under the EU Standard Contractual Clauses. Purchases and notifications in the app go through Apple and Google, which may process them outside the European Union under their own privacy policies.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of any significant changes by posting the new privacy policy on this page and updating the "last updated" date at the top of this policy.

Contact Us

If you have any questions or concerns about our privacy practices or your personal data, email us at info@qrsong.io or use our contact form.