Privacy Policy

eG Codes · Version 1.0 · Effective 10/29/2026

1. Who we are

eG Codes is a service of EG insight Design (Eddie Gibson), Atchison, Kansas, United States. In this policy “we”, “us” and “our” mean EG insight Design, and “eG Codes” or “the service” means the QR code design, short-link and analytics service at this website. You can reach us at eddie@eg-id.com.

2. The short version

• We collect what we need to run your account, show you your codes and scan statistics, and bill you. We do not sell personal information and we do not run advertising.
• Your card number never reaches us. It is typed into a form hosted by our payment processor, NMI, and kept only there.
• When someone scans one of your dynamic codes we count the scan (date, hour, device type, operating system, country if known, and the website they came from). We do not store the scanner’s IP address or their full browser string.
• We do not set advertising or analytics cookies. The browser storage we use is needed to keep you signed in.
• You can ask us to export or delete your data at any time by emailing eddie@eg-id.com.
• The service is not for children under 13.

3. What we collect

3.1 Your account

• Email address and, if you give one, your name.
• Sign-in. Sign-in is handled by Firebase Authentication (Google). If you use a password, Google stores it in hashed form and we never see it. If you use “Continue with Google”, Google tells us your email address and name.
• Account activity: when the account was created, when you last signed in, how many times, your role (customer or administrator), and counters we use for plan limits (number of codes, dynamic codes, scans this month).
• Agreement records: the version of the Terms shown when you created the account and, when you subscribe, the exact renewal agreement you accepted, with the time and your IP address (see 3.5).

3.2 Your codes and what you put in them

Each code’s name, destination web address, type (static or dynamic), design (colors, and a logo if you upload one), short link, the domain it uses, who created it and when it was changed. For a code you publish as an email-ready image we also store that PNG image, which is reachable by anyone who has its web address, because a code image on a web page or email has to be. Please do not put anything confidential in a destination address.

3.3 Team members and custom domains

If you add people to your account we store their email address, role (Owner, Editor or Viewer) and who added them. A person you add is shown the account’s codes and statistics once they sign in with that verified email. If you connect your own domain, we store the hostname, its status and the DNS records you need to create.

3.4 Scan statistics

See the next section: this is data about the people who scan your codes.

3.5 Billing

• Card details are entered into a form hosted by NMI (our payment gateway) inside our page. They go from your browser straight to NMI. We never receive, see or store the card number or security code.
• NMI keeps the card in its secure “customer vault”. We store only a reference to the vault record, the card brand, the last four digits and the expiry date, so we can show you which card is on file and charge it on renewal.
• We store your plan, billing interval, renewal date, each payment attempt (amount, date, result, NMI transaction number, card brand and last four digits), and any refund.
• Your billing email address is placed in a reference note field on the NMI transaction so that we can match it to you. We have turned off NMI’s own receipt emails; receipts come from us.
• When you agree to auto-renewal we record the exact wording you agreed to, the version of the Terms and Refund Policy, the time, your IP address and the account it applies to. We keep this so we can show what you authorized if a payment is questioned.

3.6 Emails we send you

Transactional email only, sent through SendGrid: payment receipts, reminders that your trial is ending, notices of a failed payment, and notices that a plan has ended. We do not send marketing email. We switch off SendGrid’s open and click tracking, so our emails contain no tracking pixels or rewritten links.

3.7 Technical and security records

• Audit log. A record of important actions: sign-ups, code creation and changes, domain changes, team changes, plan and billing events, and administrator actions on an account, each with the account, the person who did it and the time.
• Hosting and function logs. Our hosting runs on Google Cloud (Firebase). Google’s request logs include the IP address, browser string, the page requested and the time for every request to our site, including scans of a dynamic code. We use them to keep the service running and to investigate abuse.
• Abuse protection. For payments we keep short-lived counters of attempts per account and per IP address to slow down card testing.

3.8 Messages to us

If you email us we keep the messages and what is needed to answer them.

4. People who scan a code (data about your audience)

This section is for the customer who owns a code, and for the person who scanned it.

What happens when a dynamic code is scanned. A dynamic code points to a short link on our servers (or on a domain you connected). When someone scans or taps it, our server looks up the destination and sends their browser there. At the same moment we add one to some counters:

• the date and the hour (UTC) of the scan;
• the device type (mobile, tablet or desktop) and operating system, worked out from the browser string, which we do not keep;
• the website the visitor came from (the host name only, or “direct”);
• the country, if our hosting network supplies it (often it does not);
• whether it was a scan or a tap on a linked image;
• a running total, and the time of the most recent scan;
• on the code itself, a shortened one-way fingerprint (a hash) of the most recent scanner’s IP address. It is overwritten by the next scan and is used only to look into abuse. We do not store the IP address itself in our database.

Requests from obvious automated programs (link previews, crawlers, uptime checkers) are not counted. Counts are kept as daily totals, not as a list of individual people. We cannot tell the code’s owner who scanned it, and we do not offer that.

The same Google Cloud request logs described in 3.7 (which include the IP address and browser string) cover these requests too.

Static codes contain the destination itself. Scanning one never contacts us.

Your responsibility as a customer. You decide where a code sends people and why you want to count scans. For the people who scan your codes, you are responsible for telling them what you do with the statistics, and for the website or content your destination leads to. We process scan data on your behalf to give you the statistics, and for no other purpose of our own except security and keeping the service running.

If you scanned a code and have a question about it, the best contact is the business or person who printed or published it. You can also write to us at eddie@eg-id.com; we can tell you what we hold about a code if you give us its short link, and we can help you with a deletion request, although as above we do not hold information that identifies an individual scanner.

5. Why we use it

• To create and run your account, codes, short links and custom domains (this is the service you asked for).
• To show you scan statistics and enforce the limits of your plan.
• To take payment, renew subscriptions, send receipts and notices, and keep financial records.
• To keep the service secure, prevent abuse (including codes that point to phishing or malware), investigate problems and give support. An administrator at EG insight Design can open an account to help you; those actions are recorded.
• To meet legal, tax and accounting obligations and to handle disputes.

We do not sell personal information, we do not share it for advertising, and we do not make decisions about you by automated profiling.

6. Cookies and browser storage

We do not use advertising, analytics or other non-essential cookies, pixels or trackers on this site, so there is no cookie banner. What does exist:

Separately, our pages load the Inter typeface from Google Fonts and our sign-in library from Google’s servers. When a page loads, your browser contacts Google, which therefore receives your IP address and browser details under Google’s own privacy policy. Scanning a QR code on its own does not load those files.

7. Who we share it with

We use these service providers (“processors”) to run eG Codes. They may use the data only to provide their service to us, and they have their own privacy terms.

We may also share information: with the other people on your account (they see its codes and statistics); when the law requires it or to protect rights, safety or the service; and if EG insight Design is sold or reorganized, with the new owner, who must honor this policy.

Our servers are in the United States (Google Cloud, region us-central1). If you use the service from outside the United States, your information will be processed there.

8. How long we keep it

Copies in backups or provider systems can remain for a short time after deletion before they are overwritten.

9. Your rights and how to use them

Whatever state or country you live in, you can ask us to:

• tell you what personal information we hold about you and give you a copy (we provide an export of your account, codes and billing history in a common file format);
• correct anything that is wrong;
• delete your account and personal information, subject to the records we must keep (section 8);
• stop using your information for something you object to.

How: email eddie@eg-id.com from the address on the account (so we know it is you), say what you want, and we will answer within 30 days. There is no fee for a reasonable request. Before deleting an account we will remind you which printed codes will stop working. You can also delete individual codes yourself in the app; that removes the code, its short link, its image and its scan history.

Residents of California, Colorado, Virginia and other states with privacy laws have the rights those laws give, which are covered by the list above. We do not sell personal information or share it for cross-context advertising. You will not be treated differently for using these rights. If we cannot resolve your concern you may contact your state attorney general.

10. Children

eG Codes is not directed to children under 13 and you must be at least 13 to use it. We do not knowingly collect personal information from anyone under 13. If you believe a child has given us information, tell us at eddie@eg-id.com and we will delete it. Paying for a plan requires you to be an adult able to enter a contract.

11. Security

All traffic uses HTTPS. Sign-in is handled by Google’s authentication service. Our database can only be written by our own server code, which checks who you are and your role in the account on every request; people can read only their own account’s information. Card data never touches our servers. We limit and log administrator access, and we rate-limit payment attempts. No system is perfectly secure; if a breach affects your personal information we will tell you as the law requires.

12. Changes to this policy

We will post changes here with a new version number and effective date. For a material change we will also tell account owners by email or in the app before it takes effect. Previous versions are available on request.

13. Contact

EG insight Design (Eddie Gibson)
Atchison, Kansas, United States
eddie@eg-id.com