Privacy Policy

When you sign up and use the service, we collect:

• Account data: your email address (required to sign in)
• Profile data: any contact info you choose to save (name, phone, Instagram, Facebook, TikTok, etc.). This data is shown publicly when your QR sticker is scanned.
• Sticker data:which sticker codes you've claimed, when you claimed them, and their status (active, lost).
• Order data:if you purchase through our store, your shipping address and payment details (handled by Shopify and Stripe — we don't see your card details).
• Scan logs:we record when your stickers are scanned (timestamp only — not the scanner's identity).

• To run the core service (showing your profile when a sticker is scanned)
• To send order confirmations and shipping notifications
• To respond to support requests
• To improve the service (in aggregate, never identifying individuals)

We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes.

We use a small number of trusted service providers to operate the service. Each receives only the data necessary for its specific function:

• Supabase — our database and authentication provider (stores your account and profile)
• Vercel — hosts the website
• Shopify — handles purchases and order fulfillment
• Stripe — processes payments (we never see your card details)
• Google — only if you sign in with Google (we receive your email and name, nothing more)
• Israel Post or chosen courier — for shipping your physical stickers

The data you put in your profile (name, phone, Instagram, etc.) is publicly visible at the URL findqr.app/s/[your-code]— that's the entire point of the product. You control exactly which fields you fill in, and you can update or remove any field at any time. Anyone scanning your sticker (or visiting that URL directly) sees only the fields you chose to fill.

Under Israeli privacy law (`חוק הגנת הפרטיות`) and standard international practice, you have the right to:

• Access the data we hold about you
• Correct any inaccurate data (your profile is editable in your dashboard)
• Delete your account and all associated data
• Export your data in a portable format

To exercise any of these, email udicaspi@gmail.com and we'll respond within 14 days.

We retain your account data as long as your account is active. If you delete your account, we permanently remove your profile data within 30 days. Order records are retained for 7 years for legal and accounting purposes.

We use minimal cookies — only those necessary for sign-in (session cookies) and the Shopify checkout process. We don't use tracking or advertising cookies.

If we change this policy materially, we'll update the date above and notify active users by email.

For any privacy questions or requests, email udicaspi@gmail.com.