Privacy Policy

The short version

• Everything you save stays on your phone, encrypted.
• We do not run servers for the app. The app has no internet permission, so it cannot send anything anywhere on its own.
• We do not collect, receive, sell or share any personal data.
• No account, no ads, no analytics, no tracking, no crash reporting.

What the app stores on your device

When you use QRPatch, the following is saved on your phone only:

• The contents of QR codes and barcodes you scan, import or create (the raw text or number, exactly as scanned).
• Labels, notes and folder names you type.
• Card details you enter for loyalty and gift cards: card number, optional PIN, balance and expiry date.
• Expiry dates and reminder choices.
• Settings such as theme, lock frequency and whether to ask before opening links.
• Recent scans: codes you scanned but did not save are kept for up to 24 hours, then deleted automatically. You can clear them sooner.
• Trash: a code you delete stays in Trash for 30 days so you can undo it, then it is deleted for good.
• How often you open each code, so the codes you use most can be shown first. This stays inside the encrypted data on your phone.

This data is encrypted with a key held in the Android Keystore, protected by your fingerprint or screen lock. If you turn the app lock off in Settings, the app opens without asking.

Quick access, widgets and shortcuts. If you mark a code as Quick access, or add a widget, quick-settings tile or shortcut for it, QRPatch keeps a small encrypted copy of that code's label and code text (never its PIN, balance or notes) in a separate file. That file uses its own Android Keystore key that does not need your fingerprint, so the widget, tile and shortcuts can work from the home screen without opening the app. Only codes you choose are copied there. Removing a code from Quick access, or deleting the widget, removes it. For a code marked as sensitive, a widget shows only the label you gave it.

Android's own app backup and device-transfer features are turned off for the app's data, so it is not copied to Google Drive or another phone automatically.

Permissions the app asks for

• Camera: to scan codes. Images from the camera are processed on your phone and are not saved or sent anywhere.
• Notifications: to show expiry reminders you ask for. Reminder text is generic and does not show your labels on the lock screen.
• Biometrics / screen lock: the app uses Android's system prompt. We never see or store your fingerprint or face data; Android handles it.

The app does not ask for internet, contacts, storage, location or microphone access. Choosing an image from your gallery uses the Android photo picker, which gives the app only the image you pick.

When data leaves your phone

Only when you start the action yourself:

• Backup file: you can export an encrypted backup file protected by a passphrase you choose, and save or share it using Android's share sheet. If you lose the passphrase, we cannot recover it for you.
• CSV export: you can export your codes as a CSV spreadsheet file. This file is not encrypted. Gift-card PINs are never written to it, and codes marked sensitive are left out unless you choose to include them. Keep it somewhere safe and delete it when you are done.
• Sharing a code as a picture: you can share or save a code as an image. The picture contains only the code, with no label, note, PIN or balance. A temporary copy is kept in the app's private cache while you share it and is cleared afterwards.
• Opening a link, a UPI payment app, a contact entry or a Wi-Fi network: the app hands the code to the relevant app or Android screen after you tap. What that app does with it is covered by its own policy.
• Copy: copied items go to your clipboard. Wi-Fi passwords and password-like text are cleared from the clipboard after 60 seconds.

QRPatch cannot see or control anything after you share data this way.

The other direction works too: you can share an image or text from another app into QRPatch. Nothing is shown until the app is unlocked, and no permission is needed to receive a share.

Recovery passphrase

If you set an optional recovery passphrase, it is used only on your phone to protect a second copy of your encryption key. We never receive it. If you forget it and the main key is lost, the only way back is a backup file. After 5 wrong passphrase tries the app erases its saved data.

Screenshots

Screens that show your codes block screenshots and screen recording, and are hidden in the recent-apps view.

Children

QRPatch is not directed at children under 13, and we do not knowingly collect any information from anyone, since the app collects none.

Deleting your data

Delete a code or folder inside the app. A deleted code stays in Trash for 30 days and is then deleted for good; you can empty Trash yourself at any time. Recent scans are deleted after 24 hours, and you can clear them sooner. Uninstalling the app removes everything it stored on your phone. Because nothing is stored by us, there is nothing else to delete. Backup files and CSV files you exported are your own files; delete them yourself.

Changes to this policy

If the app ever changes how it handles data (for example, if optional cloud features are added in the future), we will update this page and the Play Store listing before that version is released, and the effective date above will change.

Contact

Questions: support@patchsized.com