Reviewed 20 September 2026
Who is responsible for this website
QR Generator AU is operated by Star Shop com in Melbourne, Victoria, Australia, ABN 83 443 122 821. Contact [email protected] for privacy questions. This page describes the public tools available on this website as reviewed on 20 September 2026.
Information processed on your device
The static tools generate static QR codes and barcodes locally. The details you enter, including WiFi passwords and contact fields, and files selected for logo use, scanning or batch generation are processed in your browser. The tools do not upload those contents to us. Downloaded QR images can contain the original information, so share them only with people who should have it.
Website delivery and security
Cloudflare delivers and protects this website. Like any web host, it handles connection information such as your IP address, requested URL, browser information and request time for delivery, security and operational purposes. Cloudflare uses a global network. Australian operation of this site is not a promise that hosting or connection data stays exclusively in Australia.
Account security checks
Cloudflare Turnstile checks username account creation, password sign-in, recovery and email-link requests for automated abuse. It receives connection and browser information under Cloudflare’s privacy terms. These security checks are necessary for dynamic accounts and operate independently of optional analytics. We temporarily store keyed hashes of rate-limit identifiers and attempt counts. Expired sign-in links, session and rate-limit records are periodically removed when account actions occur.
Google and email sign-in
Google sign-in provides a stable Google account identifier and verified email address. We use these details only to authenticate and manage your QR workspace; we do not request access to Gmail, Drive or other Google account content, or use Google account data for advertising. If you choose email sign-in, Resend processes your email address and the sign-in message to deliver a private link. Link and open tracking are not enabled for these emails, and delivery requires an encrypted connection. Google and Resend may process information outside Australia. Their own privacy policies apply to their services. Sign-in links expire after 15 minutes and can be used once. We store a hash of each email sign-in token and use a temporary security cookie to recognise the browser that requested it. A different browser requires email confirmation. Existing workspaces are linked only through Account settings; matching email addresses do not automatically merge accounts.
Optional Google Analytics
Analytics is off until you choose Allow analytics. If enabled, Google Analytics 4 receives usage information such as pages viewed, browser and device information. We do not deliberately send QR form values or selected file contents as analytics events. Advertising signals and ad personalisation signals are disabled in our site configuration. Google processes analytics information under its own terms and policies. Analytics is not loaded on the dynamic account and workspace page.
Your choices and browser storage
We store your analytics choice in local browser storage. You can reopen Privacy choices in the footer and decline analytics for future visits. Choosing No thanks does not disable the tools. This site also honours Do Not Track and Global Privacy Control by not loading analytics. Blocking storage or scripts in your browser may affect preference retention or tool functionality. Existing Google cookies can be removed through your browser settings.
Emails and support
If you email us, your address and message are handled by our email services so we can respond and investigate the issue. Do not include sensitive tool content unless necessary. We keep correspondence only as needed for support, operating the service and applicable obligations; contact us if you want to ask about a message or request deletion.
Destinations and managed links
A dynamic account stores your internal username, linked sign-in identities and email addresses, password and recovery-key hashes if you use password sign-in, active sessions, code names, destination links and creation/update times in Cloudflare D1. We do not store a readable password or recovery key. Destinations must be stored for redirects and editing to work. Do not use private document links or confidential information as code names. An active session uses a necessary HttpOnly cookie for up to 30 days. Logging out invalidates that session. Password changes and recovery invalidate previous sessions. Account and code records remain while your account exists; you can delete the account in settings. Provider backups may retain records for their normal recovery period. We do not provide individual-visitor tracking or scan analytics.
External destinations
Scanning a dynamic code contacts our redirect service and then the destination website. Cloudflare handles the redirect request for delivery and security. The destination has its own privacy practices. Static codes may go directly to a third-party website without contacting us.
Advertising and updates
There is no AdSense advertising script enabled in this release. If advertising is introduced, this page and the applicable consent controls will be updated before it is enabled. We may revise this page when tools or providers change. The date shown on the page identifies the most recent review.
Privacy of the code you download
Local generation does not make the finished QR confidential. A WiFi QR contains its network details, a vCard contains the contact fields, and a URL may include a document-sharing token. Anyone who receives a copy may be able to decode those details. Check the intended audience before placing a code on a public sign or sending it to a printer.
Account deletion and printed links
Deleting a dynamic account removes its codes and stops their managed redirects. Export the link list before deleting if you need a record, but note that an export does not keep the old redirects operating. Static images already downloaded do not depend on a dynamic account, and we cannot remove copies that other people hold.
Provider information
Cloudflare privacy policy · Google privacy policy · Resend privacy policy
Contact the operator about your information or read our terms of use.