Privacy Policy

Last updated 3 November 2026. This policy covers neoreader.com, including dynamic QR codes and the member area. Our browser extensions have their own policies, listed in section 17.

1. Who we are

In short: NeoReader runs neoreader.com from the United Kingdom and is responsible for the personal data described here.

NeoReader is the “controller” of your personal data under UK and EU data protection law, which means we decide why and how it is used. You can reach us at hello@neoreader.com or through the contact form.

2. The short version

In short: most of the site keeps nothing about you; accounts and dynamic QR codes keep only what they need.

• The QR code, barcode, scanner and most PDF and screenshot tools run in your browser. Your files, images and camera video stay on your device.
• PDF to Word and Word to PDF are the exception: those files are sent to our server and deleted after an hour at most (section 7).
• You only need an account for dynamic QR codes. There is no NeoReader password.
• People who scan a dynamic code are not tracked: we store no IP address, set no cookies and show no ads.
• Google Analytics sets cookies only if you press Accept.
• We do not sell personal data, and we do not use it for advertising.

3. What stays in your browser

In short: creating and scanning happens on your device, and we never see the result.

• QR codes and barcodes you create, including any logo you add, are generated in your browser.
• Images and camera video you scan are decoded in your browser and discarded. Video is never recorded.
• Your saved QR style and your cookie choice are kept in your browser's local storage.
• Content handed over from our extension travels in the part of the address after “#”, which browsers do not send to a server.

A static QR code contains exactly what you typed and never points at NeoReader, so we cannot see who scans it. Only dynamic codes (section 5) use our server.

4. What we collect, why, and for how long

In short: the table lists every kind of personal data we keep, the reason, our legal basis and when it goes.

“Legitimate interests” means running, securing and improving a free service in ways you would reasonably expect, with the data kept to a minimum.

What we do not collect: the contents of your QR codes, images, PDFs you handle in the browser, screenshots, or the camera feed. The visit statistics and scan records never contain an IP address or your full browser string.

How the daily code works: we mix a visitor's IP address and browser string with a random value that is made fresh each day and deleted within three days. After that, nobody, including us, can work out whose visit or scan it was or link it to the same person on another day. It only lets us count “unique today”.

5. Dynamic codes and the people who scan them

In short: a dynamic code sends the scanner straight to the owner's link. We count the scan but do not track the person.

A dynamic code prints a short address on neoreader.com. When someone scans it, our server looks up the destination the owner chose and sends the scanner there at once. No ads and no waiting page.

• No cookies are set on people who scan a code.
• No IP address or full browser string is stored. We record only the time, an approximate country, device type, operating system, browser name and the daily one-way code described above.
• Our hosting and Cloudflare handle the request like any website visit, so they briefly see the scanner's IP address as in section 4.
• A code's owner sees these scan figures in their account and in downloads of their data. They do not see who you are.

The owner chose the destination and is responsible for what is there, including any data that site collects from you. We do not control it, and its own privacy policy applies once you arrive. If an owner adds a password to a code, the scanner types it into a NeoReader page, and we use it only to check it.

If you are a code's owner and use the codes for a business or a campaign, you decide why and how you use the scan figures, and you must follow the law that applies to you. For the data we collect to run the codes, we are the controller.

6. Google sign-in and One Tap

In short: you can sign in with Google. We receive your name, email and picture link, never your Google password.

You can create an account or sign in with a one-time link we email you, or with your Google account. If you use Google, we ask Google only for your name, email address and profile picture link and store them with a Google account ID. Google handles that sign-in under its own privacy policy. We do not receive your Google password or other Google data.

If you have not signed in on this browser, public pages show Google's “Sign in with Google” prompt (called One Tap). To show it, your browser loads a script from Google, so Google can see that you visited a NeoReader page, and it may store its own small items on your device to remember that you dismissed the prompt. Nothing about you reaches us unless you choose to continue. Once you have signed in, we set a small cookie so the prompt stops appearing. The prompt is not shown on the sign-in page or on QR code landing pages.

7. PDF to Word and Word to PDF

In short: these two tools upload your file to our server and delete it within an hour.

Converting a document between PDF and Word needs more computing power than a browser has, so the file is uploaded to our server over an encrypted connection and converted there. We do not open or read your file. It is stored in a private folder under a random name, and it is deleted:

• as soon as you download the result, or
• when you press Delete on the page, or
• automatically when it is 60 minutes old, if you do neither.

The file's name is kept with the job only so your download has the right name. We do not copy, analyze or reuse your files, and they never leave our server. The other PDF tools (merge, split, compress, rotate and so on) run in your browser and send nothing.

8. Cookies and similar storage

In short: a visitor who is not signed in gets no cookies except the optional Google Analytics ones.

Browsing the public site, using the tools and scanning a code sets no cookie of ours. Cookies appear only if you sign in or accept analytics.

We use Google Analytics in Google's Consent Mode. Until you press Accept on the cookie bar, it sets no cookies and sends Google only basic signals, such as the page viewed, that cannot recognize you on a later visit. Advertising features, ad personalization and sharing data for ads stay off either way. If you press Accept and later change your mind, use “Cookie settings” at the bottom of any page, press Decline and delete the Google Analytics cookies in your browser settings. We never pass your codes, images, files or scan results to Google Analytics. The member area and our team's admin area use the strictly necessary cookies above.

9. Who we share data with

In short: only the companies that help us run the site, listed here. We do not sell data.

These organizations handle personal data for us or receive it from you. We keep this list current; if we change a provider, we will update it.

We may also disclose data if the law or a court requires it, or to protect people from serious harm, and to professional advisers under a duty of confidentiality. Someone who buys or takes over the service would inherit your data only on the terms of this policy.

10. International transfers

In short: some of the companies above are based in or process data in the United States, and we rely on the safeguards they offer.

We run NeoReader from the United Kingdom, but our hosting servers are in the United States, and Cloudflare and Google process data in many countries. When personal data leaves the UK or the European Economic Area, we rely on the safeguards our providers offer for these transfers, such as the UK Addendum to the EU Standard Contractual Clauses (the “International Data Transfer Addendum”), or the UK extension to the Data Privacy Framework where the provider is certified. You can ask us for details of the safeguard that applies to a particular provider.

11. Security

In short: we protect your data with reasonable measures, but nothing online is perfectly safe.

• The site and conversion uploads use an encrypted connection (HTTPS).
• Code passwords and API tokens are stored hashed, so we cannot read them back.
• Sign-in links work once and expire after 30 minutes. Our team's admin area needs two-step verification.
• Conversion files sit in a private folder and are deleted after an hour at most.
• Access to the database is limited to the people who need it to run the service.

If a breach put your rights at risk, we would tell you and the regulator as the law requires.

12. How long we keep things

In short: the table in section 4 gives the exact periods; this is the overview.

• Minutes to hours: sign-in links (30 minutes), sessions (2 hours idle), conversion files (60 minutes at most), rate-limit counters.
• Days: the daily random value behind the one-way codes (deleted within three days); individual visit events (90 days).
• Until you delete them: your account, dynamic codes, their scan records and API tokens. Deleting your account removes all of them straight away.
• As long as needed: contact messages, and records of admin actions and blocks.
• Longer: daily totals for the site, which contain no personal data. Our host may also keep routine backups for a limited time, after which deleted data is gone from them too.

13. Your rights

In short: you can see, fix, download or delete your data, and object to or limit how we use it.

Under UK and EU law you have the right to:

• Be informed about how we use your data (this page).
• Access the personal data we hold about you and get a copy.
• Correct anything that is wrong or incomplete.
• Delete your data (“the right to be forgotten”) in the cases the law sets out.
• Restrict how we use your data while a dispute is looked at.
• Object to uses based on our legitimate interests.
• Move your data: you can download a file of your account, codes and scans.
• Withdraw consent at any time, for example by pressing Decline under “Cookie settings”. Doing so does not affect what we did before.

Members can download their data or delete their account at any time under Account Settings. Deleting your account deletes your codes and their scan history straight away; codes you printed will then show a “can’t find this QR code” page. For anything else, contact us. We reply within one month. We may need to check who you are first, and we do not charge unless a request is clearly unfounded or excessive. The visit statistics and scan records cannot be traced back to one person, so we cannot look up “your” entries in them.

If you scanned someone's dynamic code, the best route for questions about where it sent you is the owner of that code, or us if it is about our own handling.

14. Complaints

In short: tell us first if you can, but you can always go to the regulator.

Please contact us first so we can put things right. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. If you live in the EU or EEA, you can complain to the data protection authority in your country. If you live in California, you can ask us what personal information we hold and to delete it; we do not sell or share personal information for advertising, and we will not treat you worse for asking.

15. Children

In short: accounts are for people aged 16 or over.

The public tools can be used by anyone. To have an account you must be at least 16. We do not knowingly collect account data from anyone younger. If you think a child has made an account, tell us and we will delete it.

16. Automated decisions and abuse handling

In short: a person decides whether to block a code or an account. Only simple rate limits are automatic.

We make no decisions about you by profiling or by computer alone that have legal or similarly significant effects. The only automatic step is rate limiting: if one address makes too many requests in a short time (for example many sign-in or password attempts), further requests are refused for a while. It is not stored against you and it expires on its own.

Stopping a scam, phishing page, malware or other abuse is done by a person on our team, using the reports we receive and what the destination page shows. We may switch off a dynamic code, or an account, and note the reason (see our terms). Where we can, we tell the owner and give a reason. If you think we made a mistake, tell us through the contact page; we review the decision again and reply. We keep the records of that decision as shown in section 4.

17. Changes and extension policies

In short: we update this page when things change, and each browser extension has its own policy.

If we change this policy, we change the date at the top. If a change matters to how we use your data, we say so clearly on this page.

Extension privacy policies

Each browser extension has its own policy: QR Code Generator & Scanner, Full Page Screenshot, Dark Mode, Reader Mode, Read Aloud, Screen Recorder and Video Screenshot.

Contact

NeoReader · hello@neoreader.com or the contact form

When you use the contact form or email us, we keep your name, email address and message (and, for the form, your IP address, used only to stop abuse) so we can answer you. We do not add you to any mailing list.

See also our Terms of Service.