Privacy policy

Who controls your data

Silk Creative Labs LLC, a California limited liability company, is the data controller for Scanlightand for the personal data described below. Scanlight is a brand of Silk Creative Labs LLC, not a separate company. Our mailing address is 2108 N St #14571, Sacramento, CA 95816, and you can reach us at support@scanlight.org. Where this policy says “we”, it means Silk Creative Labs LLC.

What we collect

When you make a static QR code

Nothing about its contents. Static codes are generated entirely in your browser: the network name, password, contact details or URL you enter never leave your device. We record an anonymous count that a code was generated, and nothing about what was in it.

When you check artwork or a code

Preflight and the QR code checker open your files inside your browser. The artwork, photos and PDFs you check are never uploaded, and we never see them. We record an anonymous count that a check ran, with the number of pages and codes, and nothing about what was in them.

Two optional actions send something to us, and only when you press the button:

• Creating a shareable record sends a small image of that one code, cut out of the page, so our server can measure it again. The record keeps the measurements and the host the code points to, never your file or its name.
• Saving a Preflight report (Pro and Business) keeps the findings in your account: the file names, what each code reads, its measured size and the issues found. Never the artwork. Only you can read your reports, and you can delete any of them at any time.

When someone scans a dynamic code

The scan is recorded, in deliberately coarse terms:

• Which code, and when
• A device class: mobile, tablet, desktop or unknown
• An operating system family, with no version
• A two-letter country code, never finer
• The referring site’s host, never the full URL
• Any UTM parameters on the short link

We do not record the IP address, the user agent string, a cookie, or any fingerprint. There is no identifier that would let anyone, whether us or the code’s owner, recognise the same person scanning twice.

When you have an account

• Your email address
• Your codes, their destinations, and the history of destination changes
• Campaign names and any optional context you add
• Subscription status and a Stripe customer identifier. Card details are handled entirely by Stripe and never reach our servers

What we do not collect

• The contents of any static code you generate
• The artwork files and photos you check with Preflight or the checker
• The IP address of anyone who scans a code
• Browser fingerprints or cross-site tracking identifiers
• Location finer than a country
• Anything that would let a repeat scanner be recognised

Why we collect it

To make your codes and send people who scan a dynamic code to the destination you chose, to run the code and artwork checks you ask for, to check that the pages behind your codes are working and safe, to email you about your codes (for example a first scan, a page that has gone down, a destination change or an expiring security certificate), to enforce plan limits, prevent abuse, bill you, and understand which parts of the product are useful. The lawful basis is performance of the contract for account data, and legitimate interests for abuse prevention and product analytics.

How long we keep it

• Individual scan events: the retention window on your plan, 30 to 730 days
• Daily scan totals: retained longer, so historical charts survive
• Rate limiting hashes: 2 days
• Risk and safety events: 365 days
• Usage and billing records: up to 400 days, as required for accounting
• Saved Preflight reports: until you delete them or your account
• When a paid plan ends: your codes, their destinations and your daily scan totals are kept for 365 days, so resubscribing restores everything. Individual scan events follow the Free plan’s 30-day window from then on
• Account data: until you delete your account

These are enforced by a scheduled job, not by policy alone.

Who we share it with

We use a small number of processors, and no others:

• Supabase: database and authentication
• Vercel: application hosting
• Stripe: payments
• Resend: transactional email
• Sentry: error monitoring for our servers. Error reports are sent without request bodies, headers or cookies

We do not sell personal data and do not share it for advertising. Any aggregate statistics we publish are derived only where the sample is large enough that no individual code, account or customer is identifiable.

Your rights

You may access, correct, export or delete your data. Deletion is self-service in your account settings and removes your profile, campaigns and scan analytics. Your dynamic codes are not deleted. They are printed in the world, and disabling them abruptly would strand the people who scan them, so they display a neutral notice instead. For anything else, email privacy@scanlight.org.

Cookies

We set a session cookie when you sign in, and a first-party analytics identifier that distinguishes visits without identifying you. There are no third-party advertising or tracking cookies, which is why there is no consent banner to click through.

Security

Data is encrypted in transit and at rest. Tenant isolation is enforced by row-level security in the database rather than by application code alone, so a bug in a route handler cannot expose another account’s data. To report a security problem, email security@scanlight.org.

Contact

Privacy requests go to privacy@scanlight.org, or by post to Silk Creative Labs LLC, 2108 N St #14571, Sacramento, CA 95816. We answer data requests within 30 days.