Privacy Policy

1. Introduction

Ikasud Media Inc. ("Company", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use the iQR Platform ("Service").

2. Information We Collect

We collect information that you provide directly to us:

• Account Information: Name, email address, phone number
• QR Code Data: Item descriptions, photos, contact information for alerts
• Communications: Messages sent through our chat system

We also automatically collect certain information:

• Usage Data: QR code scans, timestamps, features used
• Device Information: Browser type, operating system, IP address
• Location Data: Approximate location when QR codes are scanned (with permission)

3. How We Use Your Information

We use the collected information to:

• Provide and maintain the Service
• Send notifications when your QR codes are scanned
• Enable communication between finders and item owners
• Improve and personalize your experience
• Send service-related communications
• Comply with legal obligations

4. SMS Communications

By providing a mobile phone number and checking the SMS consent box when adding alert contacts, you consent to receive SMS text messages from iQR. These messages include:

• Scan Alerts: Notifications when your QR codes are scanned by someone
• Verification Messages: One-time codes to verify your phone number

Message Frequency: You will receive SMS alerts each time one of your QR codes is scanned. This could vary from occasional to frequent depending on your QR code usage.

Message & Data Rates: Standard message and data rates may apply depending on your mobile carrier plan.

How to Opt Out: You can stop receiving SMS alerts at any time by:

• Replying STOP to any SMS message from us
• Removing or unlinking the contact from your QR codes in your dashboard
• Deleting the alert contact from your account

No Marketing: We do not send promotional or marketing SMS messages. All SMS communications are transactional alerts related to your QR code activity.

5. The iQR Alerts App

iQR Alerts (Android and iOS, application id to.iqr.app) is the mobile app for iQR owners and for people who find an item with an iQR label. It uses the same account as iqr.to. This section describes what the app handles in addition to the rest of this policy.

What the app collects and why

• Sign-in: your phone number (we text a one-time code through Twilio), or your name and email from Sign in with Google or Sign in with Apple. Used only to create and secure your account.
• Push notifications: your device's push token (Firebase Cloud Messaging on Android; Apple Push Notification service and PushKit on iOS), device model, OS and app version. Used only to deliver scan alerts, messages and incoming calls to your phone.
• Chats: the messages you and a finder exchange about an item. Kept with the label while your account exists.
• Voice and video calls: calls between a finder and an owner are carried live by our own media server (LiveKit, hosted by us on Amazon Web Services). Live calls are not recorded. We keep call records (who called which label, when, how long, answered or missed) with the chat.
• Call messages: when a call is missed, the finder can leave a short video or voice message, recorded in the finder's web browser on the iQR scan page; the app only plays it. It is stored encrypted in Amazon S3 and deleted automatically 30 days after it is received unless the owner saves it; the owner can delete it at any time. Deleted media is purged from storage within 45 days at the latest.
• Camera and microphone: used by the app only while you are in a voice or video call, and only after you grant the permission. (Call messages are recorded on the web, in the finder's browser, not in the app.) The app does not access the camera or microphone in the background.
• Finder mode: when someone who found an item opens it in the app without an account, we create a guest finder profile: a random identifier, the name they choose to show (optional), their device's push token and a link to the item's chat. A guest profile with no activity for 90 days is deleted automatically, with its links and devices. A finder can remove found items, block an owner, or delete their Finder mode data in the app at any time.
• App Lock: if you turn it on, your phone's own Face ID, fingerprint or passcode check unlocks the app. Biometric data never leaves your device and we never receive it.
• Service logs: our servers record technical events (for example, that a push was sent or a call connected) to keep alerts and calls working. They are tied to your account, kept for operations and security, and never used for advertising.

What the app does not do

• No advertising, and no advertising or analytics SDKs.
• No tracking across other companies' apps or websites, and no selling or sharing of personal data for advertising.
• No access to your contacts, photos, files or precise location.

Service providers the app relies on

Amazon Web Services (hosting, database, file storage, our LiveKit media server), Twilio (SMS codes and alerts), SendGrid (email), Google Firebase Cloud Messaging and Apple Push Notification service (notifications), Google and Apple (sign-in, if you choose them). They process data only to provide their service to us.

Reporting and blocking

Either side of a chat can report the other or block them in the app. A report sends us the reason and the recent messages of that chat; we review reports within 24 hours and may remove content, block a device or close an account. The reported person is not told who reported them. Reports are kept for up to one year.

Deleting your account

In the app: Settings → Delete account. On the web, including accounts that sign in with a phone number: iqr.to/account/delete. Deletion is immediate and removes your profile, labels, contacts, chats, call history, call messages and push registrations. Records of purchases that the law requires us to keep are retained for that period only.

6. Wi-Fi Codes and the Guest Page

An iQR Wi-Fi code opens a small page on iqr.to that shows the network name and password its owner entered. This page counts visits so the owner can see how many devices joined. No names or contact details are collected.

• What is recorded for each visit: the time; the kind of device, its operating system and version, browser and (where the browser shares it) model; screen size, language and time zone; an approximate country, region and city looked up from the IP address, which is then discarded and never stored; and whether the visitor copied the password or opened the large view.
• Counting devices: a random identifier is stored in a first-party cookie that is only sent to that one code's page (it cannot link visits to different owners' codes) and lasts up to 400 days. It contains nothing about you. Clearing your cookies resets it.
• Who sees it: only the code's owner, as totals and a list of recent visits (time, device, city). We do not use it for advertising and do not share it.
• Owners: the Wi-Fi password is stored encrypted. A code made without an account is a 48-hour preview: after 48 hours its network details and visit records are deleted, and only the code itself is kept for 90 days so it is never given to anyone else.

7. iQR Codes for Canva

iQR Codes is our app inside the Canva editor. It works with Canva, but Canva does not make or endorse it, and Canva's own privacy policy covers what Canva does. This section explains what we receive and keep when you use the app, or when you use Design in Canva on iqr.to. The rest of this policy applies too.

• What we receive from Canva: each time the app talks to iqr.to, Canva gives it a signed token holding an ID for your Canva user and an ID for your Canva team. These IDs are specific to our app and mean nothing outside it. Canva does not give us your name, email address or any other profile details. When you add a code to a design or select one, we also receive that design's ID and, when the app can see it, the design's title.
• Your iQR account: the first time you open the app we create an iQR account for you, keyed to those two IDs. It has no email address or password unless you add one. If you later link it to an iQR account you already have (once we offer linking), the codes you made in Canva move into that account.
• What we store: the codes you make and what they open (links, contact details, Wi-Fi network names, and Wi-Fi passwords, which are stored encrypted), each code's style and color, scan records as described in sections 2 and 6, and, for each code, the IDs and titles of the Canva designs it is used in so we can list them for you. Brand kit and design colors are read in your browser only to show you color choices; we store only the color you pick for a code. We do not read the rest of your design. A “Scan to connect” Wi-Fi code is different: it holds the network name and password in the QR code itself, so they are also in your Canva design, unencrypted, in the code and its settings, and anyone who can see or scan the code, in the design or in print, can read them.
• Files you upload: a file you add in the app, such as a menu PDF or a photo for a contact card, is stored only to be shown as the content of the code you attached it to. It is checked for safety and kept as long as that code exists.
• Design in Canva: when you connect Canva on iqr.to, Canva asks your permission and gives us access tokens. We use them only to create a new design you chose with your code already placed, and to show you the designs your codes are in. We never read or change your other designs. To create it, we send Canva a one-page PDF of that size with your code on it; if that doesn't work, we upload your code's image to your Canva uploads and create the design from it. We store your Canva user and team IDs, the tokens (encrypted), and, for each design we create, its ID, title, edit link, format and date, and the ID of any image we uploaded.
• No ads, no selling: there are no ads in the app. We do not use anything we receive from Canva for advertising, ad targeting or marketing, and we do not sell, rent or share it, except with the service providers that run iqr.to for us (for example, our hosting provider) and where the law requires it.
• How long we keep it: for as long as your iQR account exists. Removing (uninstalling) iQR Codes from your Canva apps does not delete your iQR account or its data: deleting it would stop every code you have printed, so we only delete it when you ask, as described next. Design records are deleted with their code.
• Deleting your data: in the app, click Open iQR (it signs you in to iqr.to), then delete your account at iqr.to/account/delete. Deletion is immediate and permanent: your codes stop working, and the link to your Canva account, your design records and your Design in Canva connection, including our copy of its access tokens, are deleted with it. Designs already in your Canva account stay there, but the codes in them stop working. You can also email support@iqr.to from any address with a code's link (for example, iqr.to/s/…); once we have confirmed the request comes from the code's owner, we delete the account within 30 days.
• Children: the app is not for children under 13, and we do not knowingly collect information from them. If you believe a child under 13 has used it, contact us and we will delete the account.
• Where it is stored: on our servers in the United States (Amazon Web Services), protected as described in section 9.

8. Information Sharing

We do not sell your personal information. We may share your information in the following circumstances:

• With Your Consent: When you choose to share information through our Service
• QR Code Scans: Basic item information is shown to people who scan your QR codes
• Service Providers: Third parties who help us operate the Service (e.g., SMS, email providers)
• Legal Requirements: When required by law or to protect our rights

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

10. Data Retention

We retain your personal data only for as long as necessary to provide the Service and fulfill the purposes outlined in this policy. You can request deletion of your account and associated data at any time.

11. Your Rights

Depending on your location, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Object to processing of your data
• Request data portability

12. Children's Privacy

Our Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

14. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Ikasud Media Inc.
52-8438 207A St
Langley, BC V2Y 0N8, Canada
Email: support@iqr.to
Website: iqr.to