TrustScan
Privacy

Privacy policy

The short version: what you scan and what you create stay on your device. This page covers the parts that do not.

This website

The QR code generator and the link checker run entirely in your browser using JavaScript. What you type into either one is never transmitted to us — there is no upload step, and closing the tab discards it. We do not set advertising cookies or run analytics scripts on this site.

The app

Stays on your phone

  • Everything you scan, and your scan history
  • Every code you create, and any logo you add
  • Scan sessions and their contents
  • All 21 link-safety checks — they run offline, so no link you scan is sent anywhere to be rated

Leaves your phone

  • Crash reports via Firebase Crashlytics — a stack trace and device model when something goes wrong. No scan contents.
  • Anonymous usage counts via Firebase Analytics — which screens are opened, not what they contain.
  • Purchases via RevenueCat, which validates your receipt with the store. We never see card details; the store handles payment.
  • Advertising on the free Android version, via Google AdMob. Serving an ad may involve your advertising ID, device type and approximate location from your IP. Pro removes ads entirely.

Permissions and why

  • Camera — to read codes. Nothing is recorded or uploaded.
  • Photos — to scan a code from a saved image, and to save the codes you create.
  • Biometrics — only if you turn on the history lock. Your device performs the check; the app never sees biometric data.

The browser extension

TrustScan for Chrome makes a QR code for the page you are on and checks where a link goes before you open it. Both jobs run inside your browser, on your own machine. The extension has no server to talk to, sends no network requests of any kind, and stores nothing about the pages you visit.

What it can see, and when

  • The page you are on — only at the moment you click the TrustScan icon or use one of its right-click menu items. This is Chrome's activeTab permission: it grants access to one tab, on your action, and it lapses again afterwards. The extension cannot read pages you have not pointed it at.
  • The address of every open tab — only if you switch on the toolbar badge in the extension's settings, and only after Chrome has asked you and you have agreed. Chrome describes this as “read your browsing history”. It is off when you install, the extension works without it, and switching it back off returns the permission to Chrome rather than merely ignoring it.
  • The site a shortened link points to — only if you press “Where does this go?” on a link, and only after Chrome has asked you and you have agreed. The extension then contacts that link’s own host to ask where it leads: the same host your browser would contact a second later if you simply opened the link. It requests the address only, never the page, and sends nothing to us. This access is not held at install, and you can withdraw it at any time from chrome://extensions.
  • Nothing else. Apart from that one action, which you start, the extension makes no network requests at all and cannot read page content, form fields, passwords or cookies on any site.

What it stores

Only your own settings: the module shape, corner style, colour and error correction level you last chose, and the two switches on the settings page. These sync through your Chrome profile if you have Chrome sync turned on, in which case Google carries them under its own privacy policy. No addresses, no page content, and no history are stored — not locally, not synced, not anywhere.

What it does not do

The extension shows no advertising, contains no analytics or tracking code, and does not sell, share or transfer any data to anyone. The safety checks are not a lookup against a remote blocklist; they are the same rules the app runs, applied to the address itself, here on your machine. That is why they work with no connection at all.

Your choices

History can be turned off entirely in Settings, and cleared at any time. On Android you can reset your advertising ID in system settings. Deleting the app removes everything it stored on your device.

Children

TrustScan is not directed at children under 13 and we do not knowingly collect data from them.

Contact

Questions about this policy: info@trustscanqr.com