Scan analytics without storing IP addresses
Most QR platforms collect the IP address of every scan and explain it away in a privacy policy. There is another option, which is not to collect it. That is the one we took, and this page explains exactly what it means.
What is recorded, and what is not
| Recorded | Not recorded |
|---|---|
| Country, region, city Device type Operating system Browser Referring hostname |
The IP address |
The geography comes from the network edge as the request passes through, and the address itself is discarded rather than written down. You get the analytics; nobody ends up holding the identifier.
How repeat visitors are counted without one
Counting unique scans usually means keeping something that identifies a person. We use a keyed hash of the IP, user agent and the current day: a one-way code that cannot be turned back into the address.
In practice: the same person scanning your code twice on Tuesday is counted once. The same person scanning again on Wednesday cannot be connected to Tuesday, because the day is part of what is hashed, and the hash cannot be reversed. You get an honest unique-scan number for a day. Nobody — including us — gets a way to follow somebody across weeks.
This is a real trade. Cross-day unique visitor counts are not available, because producing them would require keeping the thing we decided not to keep. We think that is the right way round for a code printed on a product somebody buys.
No third-party CDN sees your visitors
A detail most privacy pages miss. Sites that load fonts or scripts from a third-party CDN hand that provider a request from every visitor, including their address, whatever the site's own policy says. Our fonts are served from our own origin. The redirect a scan passes through touches nobody else.
Who operates it
My QR Code is a service of DDR Solutions Inc., incorporated in Ontario, Canada, handling personal data under Canadian privacy law. For Canadian buyers with a procurement checklist, that is a shorter conversation than a platform operating elsewhere.
The data processing agreement and the privacy policy are published in full. Send them to your legal team before spending anyone's time on a call.
What to ask your current provider
- Do you store the IP address of a scan? Not "do you process it" — do you write it down, and for how long.
- How are unique visitors counted? If the answer is an IP address or a persistent identifier, that is a record of people rather than of scans.
- What third parties see a scan? Analytics scripts, CDNs, tag managers. Each one is a party you did not choose but your customers meet.
- Where is the data processing agreement? It should be a link, not a request form.
One thing we do not claim: GDPR compliance. We would rather say so than imply a standard we have not completed the work for.
Questions
Do you store IP addresses?
No. The IP address of a scan is never written to storage. Country, region, city, device type, operating system, browser and referring hostname are recorded; the address itself is not.
How do you count repeat visitors without an IP address?
A keyed HMAC over the IP address, user agent and the current day. The same visitor scanning twice in one day is counted once; tomorrow cannot be linked to today, because the day is part of what is hashed and the hash cannot be reversed.
Who operates the service and under what law?
DDR Solutions Inc., a company incorporated in Ontario, Canada, handling personal data under Canadian privacy law. The data processing agreement and privacy policy are both published.
My QR Code makes dynamic QR codes for print. Fourteen days free, two codes, no card required.
Start free