Skip to main content

sniffQR for Android is out now on Google Play. Get it

Privacy Policy

Effective Date: March 21, 2026. Last Updated: October 24, 2026

Apogaeum Labs, LLC ("we," "us," "our") built sniffQR ("the App") as a Freemium application. sniffQR ships as an Android app and a browser extension, with an iOS app to follow; this Privacy Policy covers all three, and platform-specific details are called out where they differ. This Privacy Policy explains what data the App handles, how it is used, and your rights.

The short version: We don't spy on you. sniffQR processes everything on your device. We have no app servers, no analytics, no tracking, and no way to see your data. If you enable an online scanning service with your own key, it receives only what's described below. For VirusTotal that's just a fingerprint of the URL (its SHA-256 hash), never the URL itself; VirusTotal can tell which link you checked only if it already knows that link. sniffQR contacts a scanned link's own website only when you ask: tap or click 'Check where this goes', tap 'Preview Safely in App' in the apps, or turn on 'Check links automatically'. Apple or Google may send us anonymous crash data if you've opted into that on your device. If you email us, we see your name and email address. If you export or share your scan history, it goes wherever you send it. That's it. The legalese below says the same thing with more words.

1. Data We Collect

We do not collect, transmit, or store any personal data on our servers. Apogaeum Labs does not operate any backend servers for this App. We have no analytics, telemetry, advertising SDKs, or tracking of any kind.

The data the App processes stays on your device, with the exceptions described in Section 4: checking where a link goes, or previewing it with 'Preview Safely in App', contacts that link's own web host, which the App does only when you ask it to; and scan content reaches a threat-intelligence service only if you explicitly configure one. Your platform's crash reporting is separate and is controlled by your device settings (see Section 2).

When you email us, including a bug report or a suggestion, we receive your name and email address as your email shows them, and whatever you write. A bug report or suggestion sent from the App also carries the app version, device model and OS version it fills in. We use this only to answer you, and we delete it if you ask.

Buying sniffQR Pro is handled entirely by Google Play or the App Store, and we never see your payment details. The store gives us only its standard order or sales records, which we use for accounting, tax and refunds.

2. Crash Data (Apple and Google)

Crash reporting is controlled entirely by your device settings and is operated by Apple or Google, not by us. We operate no crash-reporting service of our own.

On iOS: if you have opted in to share analytics with app developers (Settings > Privacy & Security > Analytics & Improvements > Share with App Developers), Apple may collect and provide us with anonymized crash logs and performance diagnostics through App Store Connect.

On Android: if you have opted in to send usage and diagnostics data (Settings > Google > Usage & diagnostics), Google may provide us with anonymized crash reports and performance data through the Google Play Console (Android vitals).

On either platform this data may include:

  • Crash stack traces and exception information
  • Device model and operating system version
  • General app performance metrics

This data does not include your QR scan content, API keys, personal information, or any identifiable data. You can opt out at any time through your device settings.

See Apple's privacy policy and Google's privacy policy.

In the apps, Report Issue and Submit Suggestion open a form on sniffqr.com. To help us reproduce problems, the link includes only your app version, device model, and OS version. In the extension they open an email to support@sniffqr.com.

3. Data Stored Locally on Your Device

The App stores the following data locally on your device only:

  • Scan history: QR code content you scan (which may include URLs, text, contact information, WiFi credentials, cryptocurrency addresses, or 2FA setup codes), scan timestamps, and threat verdicts
  • API keys: credentials you enter for third-party scanning services. On the apps these are held in your device's secure storage: the Keychain on iOS, and encrypted preferences (AES-256-GCM) keyed by the Android Keystore on Android. In the browser extension there is no OS keychain to use: your key is held in browser extension storage, managed by your browser profile, and is never synced. See section 14.
  • App preferences: settings and configuration choices
  • Rating ask counters (apps only): two small counters for the rating ask: how many scans succeeded, and which version last asked. They are never sent to us or to anyone else. On Android they are not backed up. On iPhone, like your other settings, they are part of your own iPhone backup if you back up your iPhone.

This stored data never leaves your device unless you choose to export or share it using the App's built-in share function, or configure a third-party scanning service. Exported files are not encrypted, so anyone you send them to can read them. sniffQR will never ask you to send us your scan history. Separately, when you tap or click 'Check where this goes', or turn on 'Check links automatically', the App requests the scanned link from its own web host, so the URL reaches that host. This never happens by default. Opening a link with 'Preview Safely in App' in the apps contacts that host the same way. See Section 4.

On iPhone, your settings, but not your scan history or your API keys, are also part of your own iPhone backup if you back up your iPhone, the same as any app's settings.

You can delete all scan history at any time from within the App.

4. Third-Party Services

No scan content is sent to any threat-intelligence service unless you turn one on: Google Web Risk or VirusTotal with your own key, or a custom feed you set up. sniffQR contacts a link's own web host only when you tap or click 'Check where this goes', tap 'Preview Safely in App' in the apps, or after you turn on 'Check links automatically' in 'Settings > Redirect Analysis'. That setting is off by default.

When configured by you:

  • Google Web Risk (online): scanned URLs, and, once you check where a link goes, the addresses it leads to, including a 'Blocked hop', are sent to Google for threat analysis. Google's privacy policy
  • Google Web Risk (Offline) (Pro, apps only): the App keeps Google's threat list on your device and checks links there. If a possible match is checked with Google, only a short piece of the link's fingerprint is sent, never the link itself. That happens when you tap to check, or on its own if you set 'Confirm offline matches' to 'Automatically'. You start the first list download. After that, the App updates the list itself when an update is due, but only while it is open and online. Updates send Google your API key, never your scans.
  • VirusTotal (optional, requires your own key): only a fingerprint (a SHA-256 hash) of the URL is checked against VirusTotal's database. The URL itself is never sent, and nothing is ever submitted. VirusTotal can tell which link you checked only if it already knows that link. VirusTotal's privacy policy
  • Custom Threat Feed: if you configure a custom threat feed, QR code content is sent to whatever server you specify. You are responsible for understanding that server's data practices.

Google Web Risk and VirusTotal receive only what is described above and protect it under their published privacy policies, linked above, which provide the same or equal protection as this policy. A custom threat feed is a server you choose, so its data practices are part of that choice.

Like any internet request, each service you turn on, and the web host of a link you ask sniffQR to check, sees your device's IP address when sniffQR contacts it. Google Web Risk and VirusTotal also receive the API key you entered, which identifies your account with them. 'Verify API Key' sends Google one small test request with your key, never a scan.

If you rate sniffQR, your rating and any review go to the app store you use, under its terms. The app never sees them. We can read a review only where the store shows it to us. Once per major version at most, sniffQR may ask the store app on your device to show its rating card; the store decides whether it appears.

On Android, 'Preview Safely in App' opens a link only when you tap it. sniffQR opens it in Chrome's ephemeral tab, which keeps none of your Chrome cookies, logins or history, or, when Chrome cannot provide one or the link's address cannot be checked first, in sniffQR's own in-app browser, which deletes everything the page stored when the preview closes, or at the latest when the next one opens. Either way the link's website, and anything that page loads, is contacted and sees your IP address, as in any browser. sniffQR's own in-app browser also tells each site that the page was opened from sniffQR, because Android adds the app's ID to every request it makes, and Android's built-in Safe Browsing checks the pages it loads with Google. In Chrome's tab, your Chrome settings apply.

On iPhone, 'Preview Safely in App' opens a link only when you tap it, in Apple's in-app Safari view, which keeps its data separate from Safari. The link's website, and anything that page loads, is contacted and sees your IP address, as in any browser, and Safari's own settings, such as Fraudulent Website Warning, apply.

The browser extension has no in-app preview: 'Open in...' opens the link in a normal new tab.

5. Information We Do NOT Collect

We do not collect, access, or process:

  • Names, email addresses, or phone numbers, except in email you send us (see Section 1)
  • Device identifiers (such as UDID, IDFA, IDFV, Android ID, or advertising IDs)
  • IP addresses, except in our website host's standard server logs (see below)
  • Location data (the App does not request location permissions)
  • Usage analytics or behavioral data
  • Advertising identifiers
  • Photos or camera data (camera input is processed in real-time for QR code detection and is never stored or transmitted)
  • Cookies or web tracking technologies

Note: Apple or Google may share anonymized crash data with us if you have opted in through your device settings. See Section 2.

Our website, sniffqr.com, is a static site with no cookies or analytics. Like any web host, its hosting provider keeps standard server logs (IP address, browser, and the page requested, including the app version, device model and OS version a 'Report Issue' or 'Submit Suggestion' link carries) for security and operations, temporarily.

6. Artificial Intelligence and Machine Learning

QR code detection runs entirely on your device. On Android it uses an on-device machine-learning model (Google ML Kit) bundled with the App. On iPhone it uses Apple's built-in on-device detector. Camera frames and photos are analyzed locally and are never uploaded, stored, or transmitted.

Beyond that detection, the App does not use artificial intelligence or automated decision-making to profile you, make decisions about you, or process your personal data. No scan content is used to train any model, ours or anyone else's.

7. Children's Privacy

The App is not directed at children under 13 (or under 16 in the EU/EEA). We do not knowingly collect personal information from children. Because the App collects no personal data from any user, there is no children's data to identify or delete. If you believe a child is using the App inappropriately, contact us at the address below.

8. Your Rights

All users:

  • Delete all scan history from within the App at any time
  • Disable any third-party service at any time by toggling it off in Settings
  • Opt out of Apple or Google crash reporting through your device settings
  • Uninstall the App to remove all locally stored data

European Economic Area, United Kingdom, and Switzerland (GDPR/UK GDPR):

  • Right to access, rectify, erase, restrict, and port your data
  • Right to object to processing
  • Right to withdraw consent at any time
  • Right to lodge a complaint with your local data protection authority
  • Legal basis for processing: legitimate interest (you chose to scan a QR code) and consent (you choose to enable third-party services)

Because all data is stored locally on your device and we have no access to it, apart from email you send us, the store's standard order or sales records if you buy sniffQR Pro, and our website host's standard server logs when you open a sniffqr.com link, you exercise these rights directly through the App (deleting history, disabling services) or by uninstalling, or, for the email, order records and host logs, by contacting us.

California (CCPA/CPRA):

  • We do not sell or share your personal information as defined by the CCPA/CPRA
  • We do not use or disclose sensitive personal information for purposes beyond what is needed to provide the App
  • We do not engage in cross-context behavioral advertising
  • You have the right to know, delete, correct, and opt out of the sale or sharing of personal information; however, because we collect no personal information on our servers, these rights are satisfied by default for the data on your device; for the email, order records and host logs, contact us at the address below
  • You will not be discriminated against for exercising your privacy rights
  • Categories of personal information collected in the preceding 12 months: identifiers (name and email address), only from people who emailed us; commercial information (store order records), only from people who bought Pro; internet activity (our website host's standard server logs: IP address, browser, page requested)
  • Categories of personal information sold or shared in the preceding 12 months: None

Canada (PIPEDA):

  • You have the right to access and challenge the accuracy of your personal information held by us
  • We hold no personal information apart from email you send us, the store's standard order or sales records if you buy sniffQR Pro, and our website host's standard server logs when you open a sniffqr.com link (see Sections 1 and 5); to access or correct that, contact us at the address below

Brazil (LGPD):

  • You have the right to confirmation of processing, access, correction, anonymization, portability, deletion, and information about sharing
  • Because we process no personal data on our servers, these rights are satisfied by default for the data on your device; for email you send us, the store's standard order or sales records if you buy sniffQR Pro, and our website host's standard server logs when you open a sniffqr.com link (see Sections 1 and 5), contact us at the address below

South Africa (POPIA):

  • You have the right to access, correct, and delete your personal information
  • We collect no personal information apart from email you send us, the store's standard order or sales records if you buy sniffQR Pro, and our website host's standard server logs when you open a sniffqr.com link (see Sections 1 and 5); to access, correct or delete that, except order records we must keep for tax and accounting, contact us at the address below

9. Data Security

  • On the apps, API keys are stored in your device's secure storage, protected by hardware-backed encryption: the Keychain on iOS, and encrypted preferences (AES-256-GCM) keyed by the Android Keystore on Android. The browser extension cannot reach either of those (see section 14 for what it does instead)
  • Scan history is stored in an on-device database. The content of each scan and its results are stored with AES-256-GCM encryption on both platforms. The date, code type, verdict and warning flags are stored unencrypted so history can be sorted and filtered. On iOS the encryption key is held in the Keychain with iOS Data Protection applied on top, and on Android the history key is protected by a key in the Android Keystore. On both platforms the database is excluded from cloud backup and device transfer
  • All network connections to third-party services use HTTPS. In the apps the built-in services (Google Web Risk, VirusTotal) are additionally protected by TLS certificate pinning. The only connections that can be plain HTTP are to the web addresses of a link you check or open: an http:// link you scanned and any http:// address it redirects to, the one insecure redirect you follow with 'Follow anyway', and, in the apps, an http:// page you open with 'Preview Safely in App'. The browser extension is not certificate-pinned. An MV3 extension cannot pin; it relies on the browser's own TLS validation. See section 14
  • No data is stored on or transmitted to our servers
  • When you share or export scan data, it leaves sniffQR's encrypted storage. Exported files may contain sensitive information such as passwords, 2FA secrets, and private URLs. You are responsible for protecting this data once it is outside the App.

10. Data Retention and Deletion

All data is stored locally on your device. We retain nothing on our servers. You control retention entirely:

  • Delete individual or all scan records from the App at any time
  • Uninstall the App to remove all stored data
  • API keys can be removed from Settings at any time

To delete your sniffQR data: open History and swipe a scan to delete it, or use 'Clear All' in History to delete everything; remove API keys in Settings; uninstalling the App deletes everything it stored, including history, keys and preferences. Apogaeum Labs holds no copy of any of it, so there is nothing on our side to delete and no retention period. If you still want to ask us, email support@sniffqr.com and we will confirm in writing.

Apple or Google may retain crash data in accordance with their own retention policies if you have opted in to share diagnostics on your device.

11. International Data Transfers

We do not collect or store your data on our servers, so no international transfers occur through us; the email you send us, the store's order records and our website host's logs are handled where those providers operate. If you enable Google Web Risk or a custom threat feed, what it receives (your scanned URLs for Google Web Risk; the QR code content, not only its URLs, for a custom threat feed) may be processed by those services in countries outside your own, in accordance with their respective privacy policies and data transfer mechanisms. VirusTotal receives only a SHA-256 fingerprint, never the URL itself.

12. Do Not Track

The App does not track you and therefore does not respond to Do Not Track signals. There is nothing to track.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted within the App and the "Last Updated" date will be revised. Continued use of the App after changes constitutes acceptance of the updated policy.

14. The Browser Extension

The extension runs the same detection engine as the apps and reaches the same verdicts, but it runs inside a browser rather than on an operating system, and a browser does not offer everything an OS does. Where that changes what happens to your data, it is set out here rather than left to the reader to infer from the app sections above.

  • Where your settings and API key live. The extension has no access to the iOS Keychain or the Android Keystore. Your settings and your Google Web Risk API key are stored in browser extension storage, which is managed by your browser profile and protected by whatever protections that profile has. They are stored locally and never synced between your devices by us. Removing the extension removes them.
  • Your Web Risk key never leaves the browser except to Google. It is sent only to Google's Web Risk endpoint, to authenticate the lookup you asked for. It is never sent to us, because we have no server to send it to, and never to any other party.
  • No VirusTotal, no custom threat feeds, no offline database. The extension does not offer them, so it never sends anything to VirusTotal or to any endpoint of yours. The first two are a product decision; the offline database is an MV3 platform limit, since an extension cannot hold or background-sync one.
  • Transport security is the browser's. Requests to Google Web Risk are HTTPS, and TLS is validated by the browser itself. Checking where a link goes contacts that link's own address and the addresses it redirects to, over plain HTTP for any http:// address among them. The browser follows the redirects itself, so an insecure redirect that the result marks as a 'Blocked hop' has already been contacted; 'Follow anyway' then checks where it leads. The extension does not pin certificates, because MV3 provides no mechanism for an extension to do so. Where the apps add pinning on top of TLS for the built-in services, the extension relies on the browser's validation alone. We would rather say that than let the apps' pinning claim be read as covering the extension too.
  • Checking where a link goes is off by default. It runs only when you click 'Check where this goes', or turn on 'Check links automatically' in the extension's options. Firefox asks for your permission the first time.
  • No history is kept. The extension writes a single verdict to local extension storage only long enough to show it, then deletes it when the result opens. If the window cannot open, it waits there for your retry. There is no scan history to encrypt, export or delete.
  • No analytics, telemetry, advertising SDKs or accounts, the same as the apps, and the same as the rest of this policy.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise any of your rights, contact us at:

Apogaeum Labs, LLC
Email: support@sniffqr.com