1. Who we are & what this covers
LumQR is provided by ITULIS TECHNOLOGY (Malaysia). This policy covers the LumQR website, the Android app and support communications. Contact our privacy team at support@lumqr.com.
LumQR is preparing for public release. Google Play and App Store downloads are not yet available. The Android test build includes advertising and consent technology; live advertising and store purchases are not enabled for public release. iOS is planned, and its data practices will be confirmed before release.
2. Scanning & your Library
Camera frames and images you select are processed on your device to decode supported QR codes and barcodes. We do not upload those images or decoded content to a LumQR server. Camera access is used to scan; the system photo picker gives the app access to images you choose. LumQR does not need microphone recording, contacts or precise location permission.
With scan history enabled, your device stores decoded contents, result types, titles, timestamps, favorites and source information in its local Library. This may include website addresses, text, contact information or Wi-Fi network details embedded in a code. There is no LumQR account or cloud Library sync.
Private scans are excluded from Library. Wi-Fi passwords remain session-only unless you explicitly choose to save them on the device. Saved passwords use platform-protected storage. The ordinary Library is a local database; this does not mean every Library entry is separately encrypted by LumQR.
LumQR does not include scan contents, image contents, website destinations, Wi-Fi credentials or Library records in advertising requests. A local warning is not a remote website reputation check.
3. Actions you choose
Opening a link sends a request through your browser to that website. Copying puts information on the device clipboard. Sharing or exporting sends a result or image to the app, person or storage location you select. These actions happen when you choose them, and the destination service has its own privacy practices. Other apps may be able to access clipboard or shared data under your device's rules.
Review a result before opening or sharing it. Wi-Fi codes can contain passwords: share them only with people you intend to give access to.
4. Advertising, consent & purchases
The Android build integrates Google Mobile Ads (AdMob) and Google's User Messaging Platform for ad privacy choices. When those services operate, Google may process IP addresses (which can indicate approximate location), device or app identifiers, ad and app interactions, performance diagnostics and consent choices for advertising, measurement and fraud prevention.
The current Android configuration requests non-personalized ads and removes Android advertising ID permission. Non-personalized ads can still involve data processing and device storage. Ads are gated by the consent response and app state. Where available, use Settings → Ad privacy choices to review or change your choices; core scanning remains available when ads cannot be requested.
Remove Ads is planned as an optional one-time store purchase. When available, Google Play handles Android checkout and payment details. LumQR checks purchase status and stores protected purchase verification information on the device so it can restore the ad-free entitlement. We do not receive your full payment card details. Removing ads does not erase provider records already collected.
Learn more in Google's Privacy Policy and its Mobile Ads data disclosure. We do not currently operate a separate LumQR analytics or crash-reporting service.
5. Website & support email
This website has no advertising scripts, analytics trackers, account system or marketing signup form. Fonts and illustrations are served with the site. We do not set tracking cookies or use browser storage to profile visitors.
Our public hosting provider, Cloudflare, processes technical request information such as IP address, browser details, requested URLs and security events to deliver and protect the website. See the Cloudflare Privacy Policy.
If you email support, we receive your email address, any name you provide, message, attachments and relevant correspondence. We use this information to answer your request, troubleshoot and prevent abuse. Incoming mail is routed through Cloudflare to our support inbox hosted by Google. Zoho CPaaS (formerly ZeptoMail) is configured for transactional outgoing mail. These providers may process email contents, headers, delivery events and security logs as needed to operate their services. See Zoho's Privacy Policy.
Please do not send passwords, private QR payloads, full payment card details or other information unnecessary for support. Redact screenshots before sharing them. Selecting an email link opens your email app; the website does not automatically send a message.
6. Retention & deletion
- Library: the default retention setting is 30 days. You can choose 90 days or keep records indefinitely. Favorites and codes you create are exempt from automatic expiry. Eligible records are removed when the app next processes Library data, not by a guaranteed background deletion timer.
- Your controls: delete individual records, clear Library or change history and retention in Settings. Removing the app removes its app-local data under Android's normal uninstall behavior. The Android build disables app backup and device-transfer backup. Copies you exported, shared or placed in another service remain under that service's controls.
- Support: we delete support messages and attachments from our managed support mailbox within 90 days after the issue is resolved, except records we must retain to meet legal obligations. This is our mailbox handling policy; providers may retain their own security logs or backup copies under their policies.
- Ads and purchases: provider-held information follows the relevant provider's retention rules. We cannot erase Google-held ad or transaction records by clearing your Library.
7. Your rights & safeguards
We process information to provide requested functionality and support, maintain security, meet legal obligations and, where required, obtain consent for advertising-related processing. Depending on where you live, you may have rights to access, correct, delete or obtain a copy of personal information we hold, restrict or object to processing, withdraw consent or complain to your local data protection authority. Withdrawal does not affect earlier lawful processing.
Email support@lumqr.com with your request. We may request proportionate information to verify that it is yours. We cannot remotely read or delete a Library stored only on your device; use the in-app controls for that data.
Our providers may process information outside Malaysia or your home country. We use provider security controls and applicable contractual safeguards for those services. No storage or transmission method is completely secure. Keep your device locked and updated.
8. Children & changes
LumQR is a general-purpose utility and is not specifically directed at children. We do not knowingly seek personal information from children through support. If you believe a child has provided personal information to us without appropriate permission, contact us so we can review and delete it where required. Parents and guardians should supervise use where local rules require it.
We will update this policy when our practices change and revise the date below. Material changes affecting choices or consent will be brought to users' attention through the website or app as appropriate.