Tap2QR is a Shopify app for creating QR codes and seeing how often they are scanned. This page explains what we collect when you use it, what we collect when someone scans one of your codes, and what we do with it. We don’t sell personal information and we don’t use it for advertising.
What we collect from merchants
When you install and use the app, we store:
- Store details from Shopify: shop name and domain, the shop owner’s name, the store and contact email addresses, and your Shopify plan.
- Access tokens that Shopify issues so the app can work with your store.
- Your QR codes: titles, destinations, designs, logos, tracking settings, passcodes if you set them, and the products or collections they point to.
- Messages you send us through the support form, and any answer or feedback you give when the app asks how it’s going.
If you turn on sales data in Analytics, the app reads order totals attributed to your QR codes from Shopify’s reports when you open the page. We don’t store them, and we don’t read customer names, emails or addresses.
What we collect when a code is scanned
Every scan passes through a short link before the shopper reaches the destination. At that point we record:
- the date and time of the scan;
- the browser’s user agent, and the device type, browser and operating system we read from it;
- the referring page, if the browser sends one;
- an approximate location: country, region, city and rough coordinates.
The location is worked out from the IP address on our own server and the IP address is then discarded. We don’t store it, we don’t set cookies on the shopper’s device, and we don’t collect names, emails or anything else that tells us who scanned the code.
How we use it
- To run the app: create and serve your QR codes, redirect scans and show your analytics.
- To reply to support requests and act on feedback.
- To find bugs and work out which parts of the app need improving.
- To contact you about the app, for example about a problem affecting your store.
Session recording in the app
Inside the Shopify admin, the app uses Microsoft Clarity and LogRocket to record how it is used: pages viewed, clicks, scrolling, and technical details such as errors and browser type. Recordings are labelled with your shop domain, and LogRocket also receives your shop name and email, so that we can find a session when you report a problem. Both services set their own cookies or use browser storage to do this.
These tools run only for merchants using the app. They never run on the pages your shoppers see when they scan a code.
Microsoft describes how it handles this data in the Microsoft Privacy Statement, and LogRocket in its privacy policy.
Shopify permissions
The app asks for these access scopes:
read_products, to let you pick the products and collections a code points to;write_files, to store logos you upload for your codes;write_online_store_navigation, to create the redirects that older scan links rely on;read_reports, only if you turn on sales data in Analytics.
How long we keep it
- While the app is installed, we keep your QR codes and scan history until you delete them. Deleting a code deletes its scans.
- When you uninstall, your access tokens are deleted straight away. About 48 hours later Shopify asks us to erase the shop’s data, and we delete your QR codes, scan history, feedback and personal details. Printed codes stop working at that point. We keep only the shop domain and the date the app was installed.
- Support messages stay in our team channel for as long as we need them to help you. Ask us and we’ll delete them.
- Session recordings are kept by Microsoft Clarity and LogRocket for the retention periods those services set.
Your rights
Depending on where you live, including under the GDPR in the EEA and UK and the CCPA in California, you can ask us to:
- give you a copy of the personal data we hold about you;
- correct it if it is wrong;
- delete it;
- stop or limit how we use it;
- send it to you in a format you can take elsewhere.
Email support@go2qr.app and we’ll respond within 30 days. We won’t treat you differently for asking. We don’t sell or share personal information, so there is nothing to opt out of.
If you are a shopper who scanned a code, the scan isn’t linked to your identity, so we usually can’t find it. The store that owns the code is the best place to start.
Changes to this policy
When we change how we handle data, we’ll update this page and the date at the top.
Contact
Questions about this policy or your data: support@go2qr.app.