Glyphico privacy information
This policy covers glyphi.co accounts and the website, and managed QR links at qrhop.cc. Scanning a code requires neither an account nor acceptance of the service terms.
Following a QR link
We process IP addresses and browser information to deliver and protect redirects and derive approximate country, region and city. This is a network estimate, not precise location.
Scan analytics keeps counts by code, time, result, approximate location, broad device/browser type and whether a request looks automated, plus estimated daily visitor totals. We retain no scanner IP addresses, raw browser strings or individual visitor records, use no analytics cookies and do not follow people across days or connect scans to accounts. Daily estimation data is removed within three days after that day; only totals remain. A group may contain a single scan.
Code owners receive these statistics. Totals remain for the lifetime of the code's data and are erased with it; counts for nonexistent codes are deleted within a week.
Our basis is legitimate interests in reliable redirects, proportionate statistics and preventing abuse, balanced against scanners' rights, including children's rights. Scanning is not consent; processing that requires consent must wait for it. Providers also process requests for delivery and security as described below.
Using an account
We receive data from you, your browser, use of the service and payment notifications. Optional Google sign-in supplies your identifier, email and verification status. Accounts are for adults under the Terms.
| Data and purpose | Retention |
|---|---|
| Account/workspace details, email, sign-in credentials and identity, preferences and agreed terms: to provide access. Email and a sign-in method are required for an account; other inputs are needed only for the requested feature. | Until closure; shared records while needed by remaining workspace members. |
| Uploaded pictures, generated designs, destinations and settings, invitations and optional access codes, and transfer records: to create and manage codes and gifts. | Drafts until deletion; saved content until erasure or workspace closure. Deleted codes remain recoverable for 30 days. Live invitations/access codes are removed on acceptance, cancellation or expiry; transfer records remain with the code. Retired link identifiers remain to prevent reassignment. |
| Account activity, sign-in history and associated diagnostics, including actions, times, account/workspace/code identifiers, event details, browser information (User-Agent), approximate country/region and rotating usage identifiers: to reconstruct history, troubleshoot and improve the service. IP addresses on account-access and security-sensitive events, including purchase confirmations and transfers: to protect accounts and prevent fraud and abuse. Ordinary feature usage does not retain IP addresses. | Up to 400 days after an event or after a sign-in session or verification/recovery link ends; account-linked records are deleted earlier at closure. IP addresses are restricted to authorised operators and excluded from customer scan statistics. |
| Orders, payment/subscription references, agreed terms, renewal choices, refunds and disputes, and limited payment-method details supplied by the payment provider: to fulfil purchases, keep financial records and resolve claims. We never receive full card numbers or security codes. | While the account is open, then only for statutory recordkeeping or unresolved claims, with restricted use; afterwards erased or anonymised. Detailed payment notifications: one year and 30 days after processing. |
| Support correspondence, including relevant account and diagnostic information automatically attached to requests; service checks and notifications: to answer requests and report destination problems. | Support: up to 12 months after resolution. Check/notification logs: two days; latest results while used and up to two days afterwards. Preferences remain with the account or code. |
Accounts, codes, transfers, purchases and requested support rely on performance of our agreement or steps you request before it. Troubleshooting, security, fraud prevention and service improvement rely on legitimate interests. This includes internal use of uploaded pictures to improve preparation and code generation. Statutory financial recordkeeping relies on legal obligations; resolving claims relies on legitimate interests.
We use necessary sign-in cookies for up to 30 days and short-lived external-sign-in cookies, with no advertising or analytics cookies. Checkout has its provider's cookies and privacy notice.
General service logs last up to two weeks and operational metrics 30 days, separately from account history. Deleted data may remain in restricted backups for up to 14 days; recovery must preserve deletion requests.
Sharing and international processing
We use hosting/storage, network delivery/security and email providers. They process requests and submitted content as needed to provide and protect their services, including IP addresses, browser information and requested addresses. Provider service/security logs are governed by their processing terms; our scan-statistics limits do not cover all such logs.
Current service providers
| Provider | Role and privacy contacts |
|---|---|
| Hostinger | Hosting; processor. |
| Cloudflare | Network and storage services; processor. |
| Resend | Email; processor. |
| Paddle | Reseller and Merchant of Record; independent controller for checkout, taxes and refunds. |
| Optional sign-in; independent controller for its part of that interaction. |
The links include each provider's privacy contacts.
Authorised workspace members and gift recipients receive content needed for the access or transfer you request. We disclose data to authorities where legally required. We do not sell personal data.
Processing may take place outside Georgia, including in the United States and through worldwide networks. We use applicable lawful transfer grounds and required safeguards, including authorisation where required. Processing agreements restrict providers' use and require data protection. Ask us for current destinations and safeguards.
Your rights
Subject to applicable law, you may request processing information, access and a copy, correction, erasure or termination, blocking/restriction and portability; object where applicable; and withdraw consent for processing based on it. You may complain to the State Audit Office of Georgia, a court or another competent authority.
Write to support@glyphi.co to exercise rights or close an account. We ask only for necessary verification, require no scanner account and respond within applicable legal deadlines, explaining any lawful extension. Without visitor identifiers we cannot locate a particular person's scans.
Closure stops renewals and removes account-linked activity and content held only for that account. Shared/transferred content remains with authorised members or recipients; financial records, security events not linked to an account and backups follow the periods above. Destination websites have their own privacy practices.
Changes
We update this policy and its date when processing changes, and notify account holders of material changes as required by law.
Who is responsible
The controller is Individual Entrepreneur Anton Kravchenko, Georgia, identification number 105527412. Registered address: Georgia, Tbilisi, 3 Ponichala settlement, building 5, entrance 2, floor 4. Contact: support@glyphi.co.
Last updated 28 October 2026.