Privacy Policy
Last updated: 2026-10-22
Password2QR is built so that we cannot see your secrets. This policy describes what the website and apps actually process, what stays on your device, and the few cases where anything leaves it.
What never leaves your device
Your phrase, generated and restored passwords, unlock phrases and any second part (such as a PIN) are processed in memory on your device. They are never put in URLs, logs, analytics, error messages or storage we can read, and we never ask for them — by message, email or any form.
No accounts, no tracking
There are no accounts or logins. Our pages set no cookies and load no third-party analytics or advertising scripts.
Hosting
The website and web app are served by a hosting provider (currently Vercel). Like any web host, it processes standard request data — such as your IP address and browser identification — in server logs for operation, security and abuse prevention, under its own policies. We do not use this data to identify you.
What the apps store on your device
The installed web app caches its own program files so it can work offline, and the card designer remembers your chosen template in session storage. None of this contains passwords, and none of it is sent to us. Clearing site data or uninstalling removes it.
Phone-to-computer transfer
The optional phone-to-computer transfer uses a relay server. The content travels end-to-end encrypted: the relay handles only ciphertext and short-lived pairing data it cannot read, and sessions expire automatically within minutes. We cannot read what you transfer.
Card orders
If you order a plastic card, then — only after your explicit confirmation — the two card images and the quantity are sent to the W2QR Card Service. Only partial-password cards can be ordered, so the service never receives a complete password and never your second part. Your shipping address and payment details are collected on the card service’s own site under its privacy policy; Password2QR pages never collect them.
The desktop app and update checks
The desktop app works fully offline. It connects only when you use the phone-to-computer transfer, and to check for a newer version: when connected, it fetches a small static version file from password2qr.com (at start and when you choose “Check for Updates”). That is an ordinary web request with no added identifiers, and it tells us nothing about how you use the app. The app never installs anything on its own. If you choose “Upgrade”, it downloads the installer from our public releases page on GitHub — GitHub then sees a standard download request under its own privacy policy — verifies the installer’s SHA-256 checksum against the value published on password2qr.com, and runs it.
Your data, your control
We hold no account data about you, so there is nothing for us to export or delete. Data connected with a card order is handled by the card service, which answers requests about it. Everything else lives on your device and is yours to keep or clear.
Changes to this policy
If what the software sends or stores ever changes, this policy changes with it; the date above states the current version.