Privacy Policy for SafeScan QR
SafeScan QR ("we", "our", or "the app") is committed to protecting your privacy. This Privacy Policy outlines how our application handles permissions, features, and data when you use SafeScan QR.
1. Information Collection and Use
SafeScan QR is built on a Zero-Trust, Privacy-First Architecture. We do not collect, store, or sell personal data or personally identifiable information (PII), and we have no user accounts. Apart from the Pro Web Risk relay described in section 2, we run no server that receives your scans. There are zero advertising SDKs and zero analytics or tracking libraries in the application.
A. Camera Permission (android.permission.CAMERA)
- Purpose: The camera permission is used solely to scan and decode QR codes and barcodes in real time.
- Processing: Camera frames are analyzed entirely on-device using Google ML Kit Barcode Scanning APIs.
- No Storage or Remote Transmission: No photos, videos, or image buffers from the camera are ever saved to persistent storage or transmitted to any remote servers.
B. Internet Permission (android.permission.INTERNET & ACCESS_NETWORK_STATE)
- Purpose: Internet access is used strictly when requested to:
- Inspect and trace redirect chains for scanned web links to protect you from malicious redirects, cloaked destinations, or drive-by downloads.
- Query verified threat intelligence repositories (Google Web Risk, which for Pro users goes through a server we operate, and Quad9 Secure DNS) to evaluate whether a URL is associated with known phishing or malware.
- Open verified links in your chosen external browser or Chrome Custom Tabs.
- No User Tracking: We do not track your browsing habits, your identity, or your device identifiers. Apart from the Pro Web Risk relay described in section 2, network requests are performed directly from your device to the queried servers without passing through any intermediate proxy or collection backend. The only identifiers involved are the anonymous purchase identifier used to obtain the Pro Web Risk pass and the one-way hash used to count Pro Web Risk checks, both described in section 2.
C. Wi-Fi Privacy and Connection (android.permission.ACCESS_WIFI_STATE)
- Anti-Shoulder Surfing Protection: When scanning Wi-Fi QR codes, network passwords are intentionally never displayed in plaintext on screen, and copy actions copy only the network name (SSID) to prevent sensitive credentials from leaking to the system clipboard.
- Direct System Handshake: Connecting to a suggested Wi-Fi network utilizes the native Android system prompt (
ACTION_WIFI_ADD_NETWORKS). The connection handshake is handled directly by Android with user confirmation, requiring zero location permissions (ACCESS_FINE_LOCATION).
D. Local Scan History (On-Device Storage)
- Local-Only Retention: Scan history and repeat-scan statistics are stored strictly on your local device (in a private SQLite database).
- User Control: You retain full control over your scan records. You can search, edit titles, delete individual entries, or wipe the entire history at any time from the History screen. Scan records are never uploaded to any cloud storage or remote servers.
2. Third-Party Services and Threat Intelligence
When inspecting URLs, the app queries trusted industry-standard security services to protect you from cyber threats:
- Google ML Kit (On-Device): Recognized barcode data is processed locally. Details: Google Privacy & Terms.
- Our server and Google Web Risk API (Pro): To check a scanned address against Google's real-time index of suspected phishing, malware, and unwanted software, the app sends it to a server we operate (hosted by Cloudflare), which passes it to Google Web Risk and returns the answer. The server receives the address (without the part after
#and without any user name or password in it), the pass described below and the IP address of the connection. We do not store the address or your IP address, and we keep no request logs; we keep only anonymous counts of error types. To limit Pro Web Risk checks to 30 per subscription in 24 hours, the server counts them under a keyed, one-way hash of the anonymous code in your pass. That hash is held only in the server's memory (never written to storage or logs) for up to 24 hours and then discarded. When the app asks for a pass, a keyed, one-way hash of the connection's IP address is held the same way for at most 60 seconds, to block floods of requests. Above the limit, Web Risk is unavailable until those 24 hours end, and links are still checked with the lists on your device and encrypted DNS. The server keeps no database and no cache of results. Like any internet service, our hosting provider sees the IP address of the connection while it passes through. Users who are not Pro send nothing to our server. Details: Google Web Risk. - Google Play Integrity and RevenueCat (Pro): To let only Pro users use this server, the app asks Google Play (Play Integrity) to confirm that it is the genuine app on a genuine device, and our server asks our subscription provider (RevenueCat) whether your Pro purchase is active, using the anonymous purchase identifier the app already has. The app sends our server that anonymous identifier, the app's package name and the Play Integrity confirmation, never together with a web address. If both checks pass, the server gives the app a short-lived pass (about 24 hours) that is kept on your device. The pass contains an anonymous code derived from the identifier, not the identifier itself. We do not store the identifier.
- When Web Risk starts: After you become Pro, or after the pass has expired, Web Risk checks may start a few seconds to a few minutes later, and longer if the connection fails (the app retries a few times a day). In the meantime every link is still checked with the lists on your device and encrypted DNS. Devices that Google Play does not confirm (for example rooted devices or unofficial builds) do not receive a pass and use those checks only. If you turn off Google Threat Intelligence in Settings, the pass is deleted and no request is made to our server.
- Other lookups and contacts: Domain age (all users): the registered domain name (for example example.com, never the full address) is sent to the registry that runs its top-level domain, over an encrypted connection; for .ru, .it, .jp, .cn, .edu and .il the request is not encrypted. DNS provider: the host name of each address in the chain goes to Quad9 or, if you select it in Settings, to Cloudflare. VirusTotal (Pro, only if you enter your own key): the address is sent to VirusTotal without the part after # and without tracking parameters; an address that looks like it contains a password, key, token or sign-in code is not sent. The link itself: the the app visits the link and each page it redirects to directly from your device, so the site can see your device's IP address and the time of the visit and can set cookies, which are kept only in memory until the check ends. To avoid repeating lookups, the app keeps a list of recently checked domain names with their registration dates on your device for up to 7 days (no full addresses). An address you check can itself contain personal details (for example an e-mail address inside a link); they are not removed and are part of what the services above receive.
- Built-in Threat Lists (On-Device): The app includes lists of known phishing and malware-distribution websites, compiled from public sources and bundled with the app. Scanned links are matched against them entirely on your device and nothing is sent anywhere for this check. The notices are available in Settings > Open-source licenses.
- Quad9 Encrypted DNS (DNS-over-HTTPS): Used as an encrypted threat-blocking DNS resolver (
9.9.9.9/dns-query) to detect domain-level malicious activity. Quad9 is a Swiss non-profit foundation that does not log your IP address or store personal data, adhering strictly to Swiss and European GDPR privacy standards. Details: Quad9 Privacy Policy. If you choose to turn on the optional, off-by-default advanced decoding setting and agree to its notice, Quad9 also receives the names of the websites that the page being checked connects to, together with your device's IP address, and the device's built-in browser component may send short hash prefixes of the addresses it loads to Google (Google Safe Browsing). No name, account or advertising identifier is sent.
3. Data Retention and Security
- Zero Remote Server Storage: SafeScan QR operates without remote user databases. Our server for Pro Web Risk checks keeps no database and does not store the addresses it receives, as described in section 2.
- Local Data Security: All settings and scan records remain in the application's sandboxed local storage on your device.
- Sensitive Settings: The optional VirusTotal API key that you enter and your Pro purchase status are stored in encrypted storage protected by Android on your device. If your device cannot provide such protected storage, the Application does not write them in readable form: they are kept only for the current session, and the Application tells you when a change could not be saved. Nothing is sent to us in either case. The Web Risk pass described in section 2 is also kept in encrypted storage on your device.
- Memory Protection: Transitory data parsed during an active scan session is cleared from memory when the scan dialog is dismissed.
4. Children’s Privacy
SafeScan QR does not knowingly collect or solicit any personal information from children under the age of 13.
5. Security Disclaimer and Limitation of Liability
SafeScan QR provides automated heuristic analysis, scheme gating, redirect resolution, and multi-tier threat intelligence as an informational and assistive cybersecurity utility. However, no automated scanning tool can guarantee 100% detection of all cyber threats, zero-day vulnerabilities, or targeted phishing campaigns.
- No Endorsement: A "Destination Confirmed" or verified security badge verifies that the URL resolution chain reached a structurally valid web resource and did not trigger known threat blacklists at the time of the scan. It does not constitute an endorsement or absolute guarantee of the destination website’s ultimate safety, intent, or content.
- User Responsibility: Users remain solely responsible for exercising caution, inspecting URLs before submitting sensitive passwords or financial credentials, and deciding whether to interact with external sites.
- Limitation of Liability: To the maximum extent permitted by applicable law, the developers and publishers of SafeScan QR shall not be held liable for any damages, losses, malware infections, unauthorized data disclosure, or phishing scams arising from opening or interacting with external links or downloaded files.
6. This Website and the QR Code Generator
The website beforeopen.app sets no cookies, uses no analytics and loads nothing from other companies. The QR code generator on this website runs entirely in your browser: the code is generated on your device, and nothing is sent or stored. What you type, including a Wi-Fi password, is never sent to us or to anyone else, and the generator does not save it. Like any website, our hosting provider (Cloudflare) sees the IP address of your connection while it delivers the pages.
7. Changes to This Privacy Policy
We may update our Privacy Policy periodically. Any updates will be published with a revised "Last Updated" date.
8. Contact Us
If you have any questions or feedback regarding this Privacy Policy, please contact us at:
Email: privacy@beforeopen.si