Privacy policy
Last updated:
QR Quishing Detector reads QR codes and similar codes and checks any web address in them for signs of phishing. The developer collects nothing: there is no account, no analytics, no advertising and no tracking. The contents of a code the app analyses are shown on your screen by the app itself, on your device, with characters that can hide or disguise text, such as control and invisible characters, replaced by visible markers; showing them sends nothing anywhere.
The camera is used only to read QR codes and similar codes. Camera images are not stored and are not sent anywhere.
An image you pick from your device is read on the device, from a copy the app makes for that read. The app deletes its copy once the scan has completely finished with it. If that delete fails, or the app is closed before it happens, the app tries again the next time it starts. The original image stays where your device keeps it: the app does not delete it, and does not change it.
The app keeps no history of what you scan.
The app itself never contacts the address in a code it reads.
Only if you choose "Open this address" is the address handed to another app, such as your browser. That app's own privacy policy then applies.
Only if you choose "Share…" is the scanned text handed to another app, such as a messaging app. That app's own privacy policy then applies.
The domain age lookup is off unless you turn it on in the settings. When it is on, the following applies.
When this is on, the app looks up how long a scanned domain has been registered. To do that it sends the domain name, for example attacker.co.uk, over HTTPS to the RDAP registry for that domain's top-level domain, run by that domain ending's registry, such as Verisign for .com or Nominet for .uk. Some endings, including .es, have no registry lookup service; their domains are never sent anywhere.
Only the domain name is sent. Never the full address, the path, the query or anything else the code contained.
The request reveals you to that operator. Like any internet request, it discloses your IP address, your approximate location and network, and the time of the request, to the RDAP operator and to anyone able to observe the connection. They learn that someone at your address looked up that domain.
It does not change the risk score. It is shown as extra information only.
Your settings are stored on your device and are not sent to the developer. They may be included in your device's own backups, such as Android backup or iCloud, which the developer never receives.
Sounds are short cues played on your device, following its sound settings, and are on unless you turn them off. The app does not use the microphone.
If this policy changes, the new version is shown here and on the website, with a new date.
Privacy questions
For questions about privacy, email: privacy (at) magentron (dot) com.
Problems and suggestions go to the public issue tracker on GitHub. What you post there is public, and GitHub's own privacy policy applies, so do not post personal data.
This website
This website keeps two things in your browser's local storage, on your device: the colour theme you choose with the button at the top right, and the language you choose with the language selector, so that the next page or visit can use them. They are not sent anywhere, there are no cookies, and clearing your browser's site data removes them. Separately, the English start page reads your browser's language setting to send you to the Spanish or Dutch page, and does not store it; a language is stored only when you click a link of the language selector.