Privacy & cookies

The short answer

Inkbeep is built to need as little of your data as possible. Barcodes and QR codes are generated without an account, and the QR designer runs entirely in your browser. Inkbeep sets no cookies of its own — with one exception: if you log in for dynamic QR codes, a strictly necessary session cookie keeps you logged in (see below). The only optional tracking is anonymous visitor statistics (Google Analytics), and it is loaded only after you explicitly accept it in the consent banner.

What stays in your browser

We use the browser’s localStorage for your own preferences — none of it leaves your device:

• inkbeep-lang — your language choice.
• inkbeep-cookie-consent — your answer to the consent banner.
• Scanner history and tool preferences, stored locally by the respective pages.

The contact form

If you use the contact form, we receive the name, email address and message you submit. We use them solely to reply to you, and they are emailed to our inbox via the email provider Resend. We do not add you to any mailing list.

Analytics (only with consent)

We would like to know roughly how many people use Inkbeep and which tools they use, via Google Analytics 4. The Google script is never loaded unless you click Accept in the banner — declining means no Google requests are made at all. You can change your mind at any time:

Cookie settings

Accounts & dynamic QR codes

Dynamic QR codes (inkbeep.com/account) are the one feature that needs an account. It is passwordless: you give us your email address, we send a one-time login link, and clicking it sets a session cookie (inkbeep-session, strictly necessary, 30 days, httpOnly) so you stay logged in on that device. We store your email address, the date the account was created, and the codes you make (their short slug, destination URL, label and status). Login emails are sent via Postmark. You can delete your codes at any time; to delete the account itself, use the contact form and we remove it.

What happens when someone scans a dynamic code. Their phone requests inkbeep.com/r/<slug>and is redirected to the destination the owner set. We count that visit for the owner’s statistics — without identifying the person scanning: we keep a hash of IP address + browser signature + date with a secret salt (so repeat scans from one device count once per day), the device type (phone/tablet/desktop and OS family) and the country derived from the IP by our host. The IP address itself is never stored, we set no cookie on the scanner, and the hash is useless after the day it was made. Link-preview bots and scripted requests are filtered out. The destination site sees an ordinary visit with no referrer from us.

Server logs & rate limiting

Like every website, our hosting provider (Vercel) keeps short-lived technical request logs. We also count requests per IP address to prevent abuse of the generator APIs and of login links — in server memory or, for login links, as a hashed short-lived counter (one hour) in our database.

What we never do

• No advertising or marketing tracking, ever.
• No selling or sharing of personal data.
• The data you encode into barcodes and QR codes is processed to generate your file and is not stored.

Your rights & contact

Under the GDPR you can ask what data we hold about you and have it corrected or deleted (for us, that is a contact-form message or, if you have an account, your email address and dynamic codes). Reach us through the contact form.