Privacy

What the service records, why, and what it never keeps. Last updated 18 September 2026.

Short version: every scan is recorded — counting them is the point, and the counts are what an operator sees. What the record does not contain is a cookie or an IP address: the address is hashed with a secret and cannot be recovered from it. The only email VRQR sends is a confirmation link and a password reset, both because someone asked for them. Nothing is sold, shared or used for advertising.

When a code is scanned

Every request for a code is recorded, including ones that match nothing. For each we keep:

the code that was asked for, and whether it matched anything;
whether the request came from a headset, a phone or a desktop browser;
the browser's user-agent string, and whether it looks like a crawler;
a one-way hash of the IP address, salted with a secret held on the server — the address itself is never written down, and the hash cannot be turned back into one;
the time.

Two reasons, both operational. Counting scans tells an operator whether a printed code is being used. Counting the failures is the only way to discover that a card has been damaged, misprinted, or is being mistyped the same way by everybody.

No cookie is set. There is no third-party analytics, no advertising network, no tracking pixel, and no social media button on any page a scan can reach.

If you have an account

An account in the admin holds:

your email address;
your password as a bcrypt hash — never the password itself, and it cannot be read back or recovered, only replaced;
the IP address recorded when the account was created, kept so that abuse can be investigated;
a log of what was changed in the admin, by whom, and when.

One cookie, set only on admin.vrqr.ca, which keeps you signed in. It is HttpOnly, Secure and SameSite, it carries nothing but a session identifier, and it is not used for tracking of any kind.

Email

VRQR sends exactly two messages, and only in response to something you did:

Confirm your email address — when you create an account.
Reset your password — when you ask for a reset. The link lasts one hour and works once.

There is no newsletter, no product announcement, no mailing list to be added to and none to unsubscribe from. Mail is delivered through Amazon SES, which handles it on our behalf; your address is not given to anyone else.

Videos and images

Files uploaded by an account holder are stored on Amazon S3 and served to headsets that open that account's menus. A headset may keep a copy so a menu plays without a network; removing the menu from the headset removes it.

How long things are kept

Scan records are kept while they are useful for the counts above. Account records are kept while the account exists. Ask us to delete an account and what it holds, and we will.

Who runs this, and how to ask

VRQR.CA is operated by QuickTurnVR.com. For a copy of what is held about you, a correction, or a deletion, write to QuickTurnVR@gmail.com and say which account or which code you mean.