QR Workshop

Privacy policy

Last updated: 14 November 2026 · Deutsche Version

Controller

Dominik Peuscher
c/o MDC#1496
Welserstraße 3
87463 Dietmannsried
Germany
Email: business@dpeuscher.de

What stays on your device

Camera image

Scanning happens on your device. Camera images are neither stored nor sent.

Photos, screenshots and PDFs

A picture or PDF you choose to scan, or share to the app, is read on your device and not kept. The password of a protected PDF is only used for that; it is neither saved nor sent.

History

Content, code format and time of each scanned and each created code, for created codes also the form fields (for Wi-Fi including the password), stored as a file in the app’s own storage with iOS data protection. Without iCloud sync it never leaves the device through the app. If you turn on iCloud sync in History (off by default), the full history including Wi-Fi passwords is stored in the app’s iCloud key-value storage of your Apple Account and appears on your other devices with sync turned on; deletions are synced too. Apple stores it under its iCloud terms; we have no access and no own server. Turning sync off keeps the copies in iCloud and on other devices; delete entries while sync is on to remove them everywhere. Like other app data it can be part of your device backup (iCloud or computer) if you have backups switched on. Delete single entries or the whole history in the app; deleting the app removes it completely. In QR Workshop, the free version, the app saves no new entries after the trial without a purchase; existing ones are kept.

Current location

Only when you tap “Use current location” while creating a location code does the app ask the operating system for your location once, in the foreground. There is no continuous or background location tracking. Depending on permission and available accuracy, approximate or precise coordinates fill the latitude and longitude fields; you can check and change them. The location request does not create a separate location history. However, the coordinates become part of the created code and can be saved in the history with its form fields (see above). On iPhone and iPad they are then synced with the history if iCloud sync is on; this sync is not available on Android. If you share or export the code, recipients can read its coordinates. The provider does not receive the requested location. The operating system’s settings and privacy information apply to how it determines your location.

Codes and 3D models you create

Generated on your device. Created codes are kept in the history (see above). They leave the device only when you share or save them yourself.

Settings and suggestions

Your PayPal.Me default recipient and the last invoice number used for a GiroCode are kept in the app’s settings on your device. They are not synced or uploaded by the app. A PayPal code only contains a paypal.me link; the payment itself happens at PayPal when someone scans it.

Trial and purchase status (QR Workshop only)

The start of the seven-day trial, the latest time seen and whether the full version has been purchased. On iPhone and iPad the two times are kept in the device’s keychain. This way the trial does not start over after reinstalling and cannot be extended by setting the clock back. They are not synced via iCloud Keychain. On Android the two times are kept in the app’s private data and can be part of the Android backup and transfer to a new device. The purchase status remembered on Android is excluded from this backup and transfer. No server and no user account are involved, and the provider does not receive this information. QR Workshop Full stores none of this.

Resolving short links, only with your consent

If a scanned link points to a known short link service, you can have the real destination determined. Before anything is sent, the app asks for your consent. The consent applies to that one operation only and is asked for again next time.

• The app sends HEAD requests (no page content is downloaded) to the short link service and to each redirect target, at most five, with a time limit of eight seconds.
• These providers receive your IP address and the requested address, as with any web request. Which providers these are depends on the link; the provider of QR Workshop is not one of them and receives nothing.
• The destination is not opened. The app checks it again on your device and shows it to you. Opening it is a separate decision.

If you do not agree, no request is made and the local preview stays available. Apart from this, the optional iCloud sync of the history and, in QR Workshop, purchasing and restoring through the store, the app makes no network connections of its own.

Trial and in-app purchase (QR Workshop only)

QR Workshop is free. After a seven-day trial, the one-time in-app purchase “Full version” unlocks all functions. QR Workshop Full is paid on download and has no purchase inside the app; this section does not apply to it.

• Purchase, payment and restoring are handled exclusively by Apple (StoreKit) with your Apple Account or, on Android, by Google Play (Google Play Billing) with your Google account. For this and to show the price, the app connects to the App Store or Google Play through the operating system.
• The provider processes no credit card or other payment data, does not handle any payment itself and collects no personal data with the purchase. The app only learns from the operating system whether the full version has been purchased and remembers this on the device.
• The app counts the trial on the device only (see above). It needs neither a server nor a user account.
• Apple provides the provider with aggregated sales and billing reports through App Store Connect; they do not show who made a purchase. For purchases via Google Play, Google provides reports on orders, sales and payouts through the Google Play Console. The provider uses them only for billing and accounting and does not link them to the use of the app.
• Withdrawal and refunds are handled by Apple or Google Play. The privacy information of Apple or Google applies to the processing of personal data during the purchase.

When data leaves your device because you choose to

• Opening a link passes it to your browser or the app in question. From then on their privacy policies apply.
• Sharing a code, PDF or 3D model goes to the destination you pick in the share sheet.
• Joining a Wi-Fi network, saving a contact, adding an event or saving to Photos hands the data to iOS, only when you tap the button. iOS asks for the matching permission first.

Permissions

• Location (while using the app) – only for a single location request when creating a location code. Approximate location is sufficient. If you want precise location while only approximate access is allowed, you can also tap “Use precise location”; on iPhone and iPad the app then asks for temporary access to precise location. Without location permission you can enter latitude and longitude yourself. You can change or withdraw permission in system settings.
• Camera – to scan codes. Images never leave your device.
• Contacts – only to save a contact from a scanned code when you tap Save.
• Calendar (add only) – only to add an event from a scanned code when you tap Add.
• Add to Photos – only to save a generated code when you choose to.

Every permission is optional. Without it, only the matching function is unavailable.

No third parties

The app contains no analytics tools, no advertising networks and no third-party crash reporters. There is no tracking in the sense of Apple’s App Tracking Transparency framework. On iPhone and iPad the app contains no third-party libraries. On Android, where only QR Workshop is available, it contains open-source libraries for reading and creating codes (ZXing, zxing-cpp) and for opening protected PDFs (Pdfium), as well as standard libraries from Google (Android Jetpack) and JetBrains (Kotlin). They work on the device only and send no data. For the purchase, the Android app also contains Google’s Google Play Billing library. It may send its own diagnostic data to Google.

What Apple and Google collect

Downloads from the App Store and TestFlight go through Apple, and so does the in-app purchase in QR Workshop. Which data Apple processes is determined by Apple; Apple’s privacy policy applies. If you agree to share analytics in your device settings, the provider can see aggregated, non-personal figures about installations and crashes from Apple. They do not allow conclusions about individual people. For downloads from Google Play, the same applies to Google and Google’s privacy policy.

This website

This website sets no tracking cookies and loads nothing from other servers. If you pick a language from the menu, it remembers that choice in a cookie called lang for one year. To deliver the pages, the web server processes your IP address and the requested page; this is technically necessary (Art. 6(1)(f) GDPR).

Your rights

The GDPR gives you rights of access, rectification, erasure, restriction, data portability and objection. Since the provider processes and stores no personal data through this app, there is nothing to provide information about or to delete. Your data is on your device and disappears completely when you delete the app. The only exception is QR Workshop on iPhone and iPad: the two trial times stay in the keychain so that the trial does not start over. They are deleted when the device is reset.

For questions or complaints, contact the controller at the address above. You also have the right to lodge a complaint with a data protection supervisory authority.

Changes

If something changes in the app that affects this policy, it will be updated here. The date at the top shows the current version.