What we check. And what we don’t keep.

The first check stays on your phone

The app reads and checks the QR code on your device. This check needs no internet. It does not open links, send messages or approve payments for you.

Deep checks require your consent

After one-time consent, deep checks run automatically. The code contents, type, language and device findings go to the cloud. A scene photo is sent if you provide one. Photos can capture people or personal information. Include only the surroundings needed for the check.

Where

Servers and storage are in AWS Frankfurt (eu-central-1). Amazon Bedrock models may process requests in other AWS regions within the European Union.

Photos

Temporarily kept in private encrypted storage before the check. We delete them after analysis. If deletion fails, a one-day automatic cleanup rule is the backup; physical deletion can happen later.

Check results

Results become unavailable after 24 hours. Automatic deletion of stored data can take longer. The original code contents are removed from the record when the check completes or is marked as failed.

Destination screenshots

Stored privately with encryption. A screenshot link lasts 15 minutes. Screenshots have a one-day automatic cleanup rule; physical deletion can happen later. Keep result and screenshot links private: anyone with them can view them.

Application logs

Application logs must not contain personal data or full QR payloads.

An isolated browser visits the destination in the cloud. The destination may see that browser request and information within the URL itself. Your phone’s cookies and signed-in sessions are not passed to it.

To check an Instagram profile, we send Apify only its public username; processing may occur outside the EU.

How AI contributes to a result

Rules on your phone identify known risks and a proven minimum score. The deep check adds redirects, page findings, scene analysis and matches to known cases. Claude on Amazon Bedrock helps combine and explain that evidence.

AI can raise risk. It cannot lower it below the minimum proven by your phone. A higher score means more detected risk, not a percentage probability of fraud. Results explain the reasons, the consequences of continuing and the limits of the check.

AI can be wrong. It may miss fraud or flag a legitimate code. In the spirit of EU AI Act transparency, we identify AI assistance and keep the decision with you. Safe QR does not make payments or grant permissions for you.

This website and the training pages

The website is hosted on Cloudflare Workers. This is separate from checks on AWS: web requests pass through Cloudflare’s network and are not promised to stay in Frankfurt. Ordinary connection information, such as an IP address, is processed to deliver pages.

We use no analytics or advertising scripts, tracking cookies or newsletter forms. The gallery does not accept your QR codes. Gallery search stays in your browser. The training payment form sends and stores nothing.

The cases feed loads public reports. If its source is unavailable, a labeled verified selection is shown. Following a source link takes you to that publisher’s website.

Contact and corrections

Contact the Safe QR team through the project repository. Do not include card details, login codes, photos of people or full private QR codes in public reports.