MakeQRArt privacy

MakeQRArt is live at makeqr.art.

This service is operated by llab08, Hong Kong, and these terms are governed by the laws of Hong Kong. The section below explains this product’s data handling and current availability.

Account

You sign in through our authentication server (GoTrue on the studio VM at supabase.llab08.com) with e-mail, Google or Apple. We keep the account id, the e-mail address (which may be an Apple Hide My Email relay address) and, when Google or Apple supplies one, a display name. Apple supplies the name only on the first authorisation. For e-mail sign-in we store a password hash, not the password; we store no password for Google or Apple sign-in. The signed-in session is kept in a session cookie in your browser.

Saved codes

QR codes you save, and their destination URLs, are stored with your account so you can reopen and edit them.

Scans

When someone scans a dynamic code, we record the code, time, country, region and city supplied by Vercel request headers, device type, operating system, browser, language and referring URL. Location is inferred from the network request, not GPS. The scan code uses a daily salted hash of the IP address and browser user agent in server memory to estimate unique scans; the stored scan record contains the resulting unique-scan flag, not the raw IP address or hash. Hosting access logs are separate from these scan records.

Purchases and credits

Paid plans and credits are processed by Stripe. Card details are entered on Stripe’s checkout page and never reach us. We keep the Stripe customer and subscription identifiers and a credit ledger on the signed-in account so that plan status and remaining credits can be shown in the app.

AI generation

AI art is switched on for signed-in accounts, at one credit per generation. When you choose Generate, our server sends your prompt, the wording of the style preset you picked (if any) and the text the code is to carry, which is either the makeqr.art short link of a dynamic code you pick or the URL or other text you type into the AI studio itself (nothing you entered in the code editor is sent), together with image settings such as a seed, to the public Hugging Face Space huggingface-projects/QR-code-AI-art-generator, which draws the image on Hugging Face’s servers. The request is made with our own Hugging Face access token and carries neither your e-mail address nor your account id; Hugging Face processes it under its own terms. Our server then decodes the returned image to check that it scans; if it does not, the same prompt and text may be sent once more.

For each generation request we keep, with your account, the prompt you typed, the preset, the text the code carries, the image returned, the scan-check result, the status, the credit it cost, any error message and the time. Spending a credit, and the automatic refund when a generation fails or does not scan reliably, are entries in the credit ledger. A prompt containing a blocked term is refused before anything is sent and is not kept; it adds a strike to the account, and after three strikes AI generation is switched off for that account. These records stay until you delete your MakeQRArt data as described below.

Processors

Vercel hosts the app and supplies the approximate scan location. Cloudflare handles requests to studio services, and authentication runs on our own server at supabase.llab08.com. Google and Apple process sign-in when you choose those options. Stripe processes purchases. Google Safe Browsing receives destination URLs for safety checks only when that integration is configured. Hugging Face runs AI image generation as described above. The app can also hand a generation to Replicate as a backup, but that is not switched on; this notice will be updated before it is.

Deleting your account

You can delete your MakeQRArt data in the app: saved codes, scan records, AI art records, any blocked-prompt strikes, the credit ledger, purchases and the subscription identifiers we keep. Dynamic codes stop working immediately. Only MakeQRArt data is deleted: your shared llab08 sign-in identity and data in other llab08 products remain, and those products keep working. If MakeQRArt is the only llab08 product you use, you must still write to hello@llab08.com to erase this remaining shared sign-in. If you signed in with Apple, you must confirm with Apple first and we ask Apple to revoke MakeQRArt’s access to your Apple ID before anything is deleted; if that fails, nothing is deleted, and you can try again later or write to hello@llab08.com. After a deletion, a new MakeQRArt account cannot be created with the same llab08 sign-in, Apple or Google account, or e-mail address for two years, so that free sign-up credits cannot be claimed again by deleting and re-registering. For this block record we keep only keyed hashes (HMAC-SHA256) of the account id, the Apple and Google account identifiers and the normalised e-mail address, not the values themselves, and erase them automatically after two years. The block applies to MakeQRArt only; other llab08 products are unaffected. An active Stripe subscription is cancelled before deletion. App Store and Google Play subscriptions must be cancelled through the store; deleting your MakeQRArt data does not cancel them. Stripe and the stores may retain their own payment records under their policies. To ask about the block, request erasure of the shared llab08 sign-in across products, or get help if you can no longer sign in, write to hello@llab08.com.

Without the app. You do not need the iPhone or Android app to delete: sign in at makeqr.art, open Settings and choose “Delete my account”, which runs the same deletion. You can also write to hello@llab08.com, say that you want your MakeQRArt account deleted and give the e-mail address on the account (the relay address if you used Apple’s Hide My Email); we confirm the request with that address, then delete the same MakeQRArt data, and the same two-year block applies. If you used Hide My Email and our confirmation does not reach you, use “Delete my account” in Settings instead; it needs no e-mail. An e-mail request cannot revoke Apple’s access for you; to do that, stop using Sign in with Apple for MakeQRArt in your Apple account settings.

Hosting and retention

The web app runs on Vercel. Hosts may keep short access logs; we do not use them to identify anyone. MakeQRArt data stays until you delete it as above, and the hashed identifiers that block a new MakeQRArt account are erased two years after a deletion; the company-wide notice explains shared sign-in retention and erasure.

Contact: hello@llab08.com · Updated 15 October 2026 · All privacy notices