QR privacy and retention

Effective 1 October 2026 (previous version 29 September 2026). Jitura Technologies operates Jitura.

Content and creator control

Link QR records contain the destination URL, random slug, creation and qualifying activity times, lifecycle status, recovery deadlines and a legacy key hash. QR codes linked to a verified account also retain the owner ID and verified email address in Google Firestore. Avoid confidential or token-bearing URLs. Input is not saved in local storage by default.

Active free hosted links have no fixed expiry date, subject to service availability. After 365 consecutive days without qualifying activity, links become inactive and stop opening their destination. Jitura can reactivate a link at the verified owner’s request within 30 days of inactivity. Anonymous links cannot be recovered and receive no email notice. An email notice is sent to linked verified owners when the recovery period begins. After the recovery period, the record becomes eligible for deletion by a scheduled job. Destinations cannot be edited. A scan during inactivity never reactivates a link. Qualifying scan activity requires a successful server-verified Cloudflare Turnstile check for this QR. Page loads, unverified requests and failed checks do not extend its life. Cloudflare processes the verification under its privacy policy. You can continue to an active destination even if verification is unavailable. Suspensions for abuse cannot be reversed through ordinary recovery.

Cloudflare Email Service processes the verified owner email address, QR identifier and recovery deadline to deliver recovery notices. The notice does not contain your destination URL.

Links are deleted by Jitura administrators, on request or for abuse. Deletion removes the destination and owner data immediately. A minimum tombstone containing the slug, deleted status and deletion time is retained to prevent the slug being reused for another destination. Keep your downloaded PNG or SVG. Images are generated on demand, and permanent image storage is not promised.

Measurement and abuse prevention

We retain daily aggregate counts of creation, downloads, sharing, intermediary views, continuation and promotional clicks for 90 days. These site-wide totals contain no QR content, URL, slug, IP, country or device class. Request counts are not unique people or proof of physical scans.

From 1 October 2026 we also keep daily counts for each link, stored with its slug for up to 12 months: views of the intermediary page, continuations to the destination, clicks on each Jitura promotion, and Jitura sign-ups that follow a promotion click. Views are grouped by country (as reported by Cloudflare), a device class (phone, computer, tablet or automated preview) and the hour of the day in Malaysia time; clicks are grouped by country. We do not store IP addresses, user agents, referrers or any identifier of the person scanning, and these counts are only visible to Jitura administrators. When you click a Jitura promotion on the intermediary page, a first-party cookie holding that link’s slug is kept for 30 days. If you create a Jitura account in that time, the account records that it came from that link and the link’s sign-up count increases by one.

Rate limiting temporarily processes IP addresses into salted digests rotated each time window. Records expire within two windows, up to two hours. Per-minute limits on scanner pages are counted in Cloudflare’s rate limiter using the same digest. QR functions do not store full IP addresses. Cloudflare and Google may process network information and infrastructure logs under their own policies, including outside Malaysia.

Abuse reports contain a slug, category, time and status for 30 days, without reporter information or free text. Admins can disable or delete harmful links. Validation is not an endorsement of safety. Do not enter passwords or financial information on an untrusted destination.

Contact and your rights

For access, correction, deletion or privacy questions, contact hello@jitura.com. Include the QR link so we can find the record.

Data protection principles — Department of Personal Data Protection. Providers — Cloudflare and Google Cloud.