Privacy policy
We count scans. We never track scanners. Here is everything else we collect, and who handles it.
Draft
Effective [FOUNDER TO CONFIRM: effective date]
The short version
- When someone scans a code, we add 1 to a daily count for that product, country and device type. We don't store who scanned.
- When you have an account, we store what you put in it and the details we need to sign you in and bill you.
- Analytics cookies and ad reporting are off unless you say yes, and you can change your mind from the footer of any page.
- You can download your data or delete your account yourself, without asking us.
Who is responsible for your data
[FOUNDER TO CONFIRM: legal entity name], [FOUNDER TO CONFIRM: registered address]. Data protection contact or representative, if one is required: [FOUNDER TO CONFIRM: DPO or EU/UK representative]. To reach us about your data, email hello@codestamp.io.
When someone scans a code
This is the part we designed to hold almost nothing. For each scan we record one thing: a count, added to a daily total for the product (and batch, if you use batches), the scanner's country, and whether the device was a phone or a computer. That is the whole record. There are no per-scan rows, no cookies on the scan path, no fingerprinting and no analytics tools.
To get those two labels, we read the country from a header our hosting adds to the request and the device type from the browser's user-agent text, keep only the label, and throw the rest away. To slow down abuse, the scan service keeps a short-lived count per IP address in memory. It is never written to our database and it expires when it goes idle. [FOUNDER TO CONFIRM: whether our hosting provider's own request logs keep IP addresses, and for how long]
Product pages that a code can lead to send back anonymous page-speed numbers (the page path, the measurement, its value and a rating), with no visitor identifier, to our analytics provider.
Your account
- Sign-in details. Your email address. If you use Google, also the name and profile picture Google gives us. We keep a sign-in session for 30 days. A magic link works once and expires after 10 minutes.
- Two-step sign-in, if you turn it on. An authenticator secret, which we store encrypted, and recovery codes.
- What you put in Codestamp. Your business name, products and GTINs, where each code points, landing page content, batches, your custom domain, and API tokens. We only ever store a hash of an API token, so nobody can read the original, including us.
- Uploads. Product images and logos, up to 5 MB each, as JPEG, PNG, WebP or SVG. We re-encode each image before storing it, and turn an SVG into a PNG. Images shown on a product page are served from a public web address, so treat them as public.
- Billing. Stripe collects your card and billing details. We keep your Stripe customer and subscription references, and your plan and billing status. We never see or store your card number.
Cookies and similar storage
| Name | What it does | How long |
|---|---|---|
| Session cookie | Keeps you signed in. Essential, so it is always on. | 30 days |
| codestamp-analytics-consent | Remembers whether you said yes or no to analytics. | 1 year |
| cs_attr | Only if you said yes. Remembers the ad or campaign that brought you here (campaign tags, ad click ID, referring page) so we know which ads work. | 30 days |
| Analytics identifier | Only if you said yes. Lets our analytics tool recognise you between visits, using cookie and local storage. | Set by the analytics tool |
Until you choose, our analytics tool runs in a memory-only mode that stores nothing on your device. If you decline, we don't load it at all. You can change your choice any time with “Manage privacy settings” in the site footer, or under Settings when you're signed in.
Analytics and ad reporting
- Product analytics. We use PostHog, hosted in the EU, to see which pages and features get used. We choose each event we send. We don't use automatic click-tracking, and we keep names and email addresses out of events. Events from our servers, such as “a magic link was sent”, carry an internal account ID instead.
- Ad reporting. If you say yes and arrived from an ad, we may tell that ad platform (Google Ads, Meta or Reddit) that a signup happened, using the ad click ID from your visit. We don't send your email address. We never sell this data and we don't use it to track you across other sites. [FOUNDER TO CONFIRM: whether ad reporting is live at launch]
- Campaign details on your account. If you said yes, we save the campaign details from your first visit with your account.
Emails we send
We send transactional email only, through Resend: sign-in links, new sign-in alerts, domain verified notices, billing and payment notices, grace period warnings, link suspension and destination change notices, and account deletion notices. We don't send marketing email.
Checking destination links for safety
When you save a link, and again once a day, we send its destination web address to Google Web Risk to check whether it is flagged as unsafe. Only the address is sent, not who you are.
Error reports
When something breaks, the error is reported to Sentry so we can fix it. Error reporting is not tied to your analytics choice. We strip cookies, authorization headers, request bodies, email addresses and sign-in link tokens before an error leaves our servers, and keep only an internal account ID so we can tell which account was affected. [FOUNDER TO CONFIRM: Sentry data region]
Why we use your data
To run the service you asked for (sign-in, codes, billing, notices), to keep it safe (abuse checks, security alerts), to fix and improve it (error reports, and analytics if you agree) and to meet legal obligations. [FOUNDER TO CONFIRM: the legal basis for each use, if GDPR or UK GDPR applies to you]
Who else handles your data
These companies process data for us. We list each one so you can see who touches what.
| Provider | What they do for us | Data involved | Where |
|---|---|---|---|
| Railway | Hosts the app and database, runs our scheduled jobs, and connects custom domains. | Everything in your account, daily scan counts, and custom domain names. | [FOUNDER TO CONFIRM: hosting region] |
| Cloudflare (R2 storage) | Stores the images and logos you upload. | Uploaded images and logos, served from a public address. | [FOUNDER TO CONFIRM: storage region] |
| Stripe | Takes payments and manages subscriptions and invoices. | Your card and billing details, billing email, and subscription history. | Set by Stripe |
| Resend | Sends our transactional email. | Your email address and the content of each message. | [FOUNDER TO CONFIRM: sending region] |
| PostHog | Product analytics, and anonymous page-speed numbers for product pages. | Events and page views we choose to send, and an analytics identifier if you said yes. | EU (PostHog Cloud EU) |
| Sentry | Error monitoring. | Scrubbed error reports, browser and page details, and an internal account ID. | [FOUNDER TO CONFIRM: Sentry data region] |
| Web Risk safety checks on destination links, and Google sign-in. | Destination web addresses. For sign-in, your Google email, name and picture. | Set by Google | |
| Google Ads, Meta, Reddit | Ad conversion reporting, only if you said yes and came from their ad. | The ad click ID, the event name (such as signup) and its time. | Set by each platform |
Some of these providers are outside your country. [FOUNDER TO CONFIRM: how international transfers are covered, for example standard contractual clauses]
How long we keep things
- Your account data and daily scan counts stay while your account exists, including during a grace period after you cancel.
- When you delete your account, nothing is removed for 30 days, so you can change your mind. After that we delete your account, products, links, landing pages, scan counts, sign-in records and API tokens, and ask PostHog to delete your analytics profile and events. Codes you already printed stop working.
- What stays after deletion. Stripe keeps invoices and payment records, as the law requires of it. If you had a custom domain, we keep the domain name alone (no other data) on a blocked list for 18 months, so nobody else can claim a name your printed codes may still point at.
- Backups. Deleted data can remain in database backups until they expire. [FOUNDER TO CONFIRM: backup retention period]
- Analytics and error reports. [FOUNDER TO CONFIRM: retention period at PostHog and Sentry]
Your choices and rights
- Download your data. Settings, then Your data. You get every product, link, landing page, batch, domain setting and daily scan total, on any plan.
- Delete your account. Same page, on any plan.
- Analytics and ad reporting. Change your choice any time from the site footer.
- Anything else. To ask us to correct, restrict or hand over your data, or to object to how we use it, email hello@codestamp.io. [FOUNDER TO CONFIRM: how quickly we reply, and which regional privacy laws apply to you]
Changes to this policy
[FOUNDER TO CONFIRM: how we announce changes and how much notice we give] See also our terms of service.