Privacy policy

If you have an account

• Your email address. Google gives us this when you sign in. We use it to identify your account. We don't receive your Google password.
• Your codes. Each code's destination, name, design, status, and its past destinations.
• A sign-in cookie. It keeps you signed in for up to 30 days. We store only a scrambled version of it.

If you scan a code

You don't need an account, and we don't try to identify you. When you scan a code made with StillScans, we record:

• The time, and which code was scanned
• Approximate location: city, region and country
• Device type and operating system
• A one-way value made from your IP address, browser details, the date and the code, used to estimate distinct visitors

We don't store your IP address with this data. The one-way value changes daily and differs for each code, which stops it being used to follow you across days or codes. The code's owner sees totals and approximate places and devices, and a list of recent scans showing place, device and time. They never see the one-way value.

Automated traffic that identifies itself as a bot, and link previews, are forwarded without being recorded.

If you use the checker

Photos you upload are read in your browser and aren't sent to us. We receive the link or text inside the code and follow its redirects, and we keep the result so you can reopen it. Results are private behind a random link and are deleted after 30 days. If a code uses a redirect service we don't recognize, we keep a count of that domain, with no link to you.

If you contact us or join a waitlist

If you send a report, we keep your message and, if you give one, your email address. If you join a waitlist, we keep your email address, the plan you chose and the page you signed up from, to tell you when it launches.

Cookies and browser storage

We use a sign-in cookie, a short-lived cookie that protects Google sign-in, and storage in your browser that remembers your signed-in state, an unfinished code, and the small preview of a checked code. We don't use advertising cookies or third-party analytics.

Who else handles data

• Cloudflare hosts the site and forwards scans. It sees IP addresses to deliver requests and supplies the approximate location.
• Neon hosts our database.
• Google provides sign-in, and serves the fonts on this site, so your browser connects to Google when pages load.

We don't sell personal data.

How long we keep data

• Check results: 30 days
• Sign-in sessions: 30 days
• Accounts and codes: while your account is open, or until you ask us to delete them
• Scan records: 24 months
• Reports and waitlist emails: as long as we need them for that purpose, or until you ask us to delete them

Your choices and rights

You can export your codes from your dashboard at any time.

To see or delete your data, email r.sharma@millstreetlabs.com. There's no self-serve deletion yet. If we delete your account, the short link itself stays reserved so it's never given to anyone else.