Privacy Policy

1. Overview

This Privacy Policy explains how QR Spark Ltd ("QR Spark," "we," "us," or "our"), registered in Hong Kong and operating from Unit 2208, 22/F, Skyline Tower, 39 Wang Kwong Road, Kowloon Bay, Hong Kong, collects, uses, and protects information in connection with the QR Spark mobile application ("App") and website ("Site").

By downloading or using the App, or by accessing the Site, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use our services.

2. Information We Collect

Non-Personally Identifiable Information:

• Android Advertising ID: A non-persistent, resettable identifier of your device used for advertising and analytics purposes. You can reset or opt out of this ID in your device settings at any time.
• App Activity: Aggregated information about features used within the App (e.g. number of scans per session), used solely to improve performance. This data is not linked to your identity.
• App Info and Performance: Crash logs and performance metrics to help us fix bugs quickly.
• Device or Other IDs: Device type, operating system version, and app version, used for compatibility and diagnostics.

Website: When you visit our website, we collect standard server log data including your IP address (anonymised after 24 hours), browser type, pages visited, and referrer. This is used for security and to understand how our site is used.

Contact Forms: When you submit a contact form, we collect your name, email address, and message content. This information is used only to respond to your enquiry.

3. How We Use Your Information

• To operate, maintain, and improve the App and Site.
• To diagnose crashes and fix technical issues.
• To display relevant advertisements (Free plan only) through our advertising partners.
• To respond to support requests and enquiries.
• To send service-related communications (e.g. critical security updates). We do not send marketing emails without your explicit consent.
• To comply with legal obligations.

4. Third-Party Services

The App integrates the following third-party SDKs. Each has its own privacy policy, linked below. All use the Android Advertising ID under the purposes described in Section 2.

• Google Analytics for Firebase – Usage analytics
• Firebase Crashlytics – Crash reporting
• Google AdMob – Advertising (Free plan only)
• Facebook Audience Network – Advertising (Free plan only)

Pro and Enterprise plan users do not see third-party ads, and their advertising identifiers are not shared with AdMob or Facebook Audience Network.

5. Data We Access But Never Collect or Store

The following device features or data types may be accessed by the App to provide core functionality, but are never recorded, stored, or transmitted:

• Camera: Accessed only in real-time to scan QR codes. Camera feed is processed entirely on-device and is never uploaded.
• QR Code Contents: The contents of codes you scan remain on your device. We do not upload, log, or analyse your scan results on our servers.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data ("right to be forgotten").
• Object to or restrict certain processing.
• Data portability.
• Withdraw consent at any time where processing is consent-based.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

You can reset your Android Advertising ID or opt out of personalised ads at any time in your device settings under Google → Ads.

7. Data Retention

Crash logs and analytics data are retained for up to 13 months and then automatically deleted. Contact form submissions are retained for up to 24 months or until your request is resolved. IP logs from website visits are anonymised after 24 hours.

8. Security

All data transmitted between the App or Site and our servers is encrypted in transit using TLS 1.2 or higher. We implement industry-standard access controls, regular security audits, and employee training to safeguard your data. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. Children's Privacy

The App is rated for users aged 3 and above. We do not knowingly collect personally identifiable information from children under 13. If you believe a child has provided personal information to us, please contact us immediately and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated policy on this page at least 30 days before the changes take effect and update the "Last updated" date at the top. We encourage you to review this policy periodically.

11. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• Post: QR Spark Ltd, Unit 2208, 22/F, Skyline Tower, 39 Wang Kwong Road, Kowloon Bay, Hong Kong
• Phone: +852 3618 7720 (Mon–Fri, 9:00–18:00 HKT)