Privacy Policy

Who we are

ScanSurprise ("we", "us") is a free web product that lets you create personalized QR codes that reveal photos, videos, messages, or links. If you have questions about this policy, contact us via our feedback form.

Information we collect

Account information

When you sign up, we collect your email address and authentication data through our provider (Supabase Auth). If you use Google sign-in, we receive the profile details Google shares for that login (typically name and email).

Surprise content you create

Content you upload or generate — photos, videos, text messages, titles, themes, recipient names, and links — is stored so recipients can open your surprise when they scan the QR code. Media files are hosted on cloud storage (Vercel Blob).

Scan and usage data

When someone opens a surprise link, we may record that a scan happened, along with basic technical details such as browser or device type (from the user agent), referrer, and timestamps. We use this to power your scan analytics. We do not sell personal information.

Feedback and support

If you submit feedback, we store the message and optional contact email so we can respond and improve the product.

Cookies and similar technology

We use cookies and similar storage for authentication sessions, optional referral/UTM attribution, and essential site function. Analytics tools (such as Vercel Analytics) may collect aggregated usage metrics.

How we use information

• To provide, secure, and improve ScanSurprise
• To show you your surprises and scan statistics
• To deliver AI-generated media when you choose AI Magic features
• To communicate about your account or respond to feedback
• To prevent abuse and enforce our Terms

Who can see your surprises

Anyone with the surprise link (or printed QR code) can open that surprise — the same as sharing a private link. Do not put secrets in a surprise you would not want a finder of the code to see. Account dashboards and analytics are visible only to you when signed in.

Third-party services

We rely on processors to run the product, including:

• Supabase — authentication and database
• Vercel — hosting, analytics, and media storage
• xAI — optional AI image/video generation when you use AI Magic
• Email delivery providers for account and feedback messages, when configured

These providers process data only as needed to provide their services under their own privacy policies.

Retention

We keep account and surprise data while your account and content remain active. If you delete a surprise or your account content, it will no longer be available via the QR link. Backups and logs may persist for a limited operational period.

Your choices

• Update or delete surprises from your dashboard
• Request account or data deletion via the feedback form
• Stop using the service at any time

Children

ScanSurprise is not directed at children under 13. If you believe a child has provided us personal information, contact us and we will take appropriate steps.

Changes

We may update this policy from time to time. We will post the revised version on this page with an updated date. Continued use after changes means you accept the updated policy.

Contact

Questions? Reach us through Feedback or see our FAQ and Terms of Service.