Privacy Policy — QR Quota

The short version

QR Quota collects no personal data about your association. Your association's data — members, amounts, IBAN, receipts — stays on your device. There's no account to create. There is no analytics, no advertising and no trackers — in the app and on this website. Only if you take the annual plan does my server keep a small record: your invite code, the code of whoever invited you, and the number Apple gives your subscription, with its status and dates. Never your name, your email or your Apple account. App Store "App Privacy" for QR Quota reads: Purchase History and User ID, linked to you, used only for the app to function; none of it is used to track you.

What stays on your device

• Everything you enter in the app: associations, members and their weights, the association's account details (IBAN or QR-IBAN), expense reports (one-off and recurring), generated QR-bills and payment status.
• Photos of receipts you take as proof — stored with iOS Data Protection, like the rest of the app's files.
• The member directory: the names, e-mail addresses, postal addresses and photos you add for the members you bill. They stay on your device like everything else — I never receive them.
• An optional diagnostics log: off by default, it records only event codes and counts — never names, e-mail addresses, IBANs or amounts — is deleted after 7 days, and never leaves your device unless you attach it to a support e-mail yourself.

What leaves your device — only when you choose

• Sending QR-bills. When you send an expense report or a QR-bill, the PDF is delivered either by the app you pick from the share sheet (Mail, WhatsApp, AirDrop…) or, if you have connected your own email account, by QR Quota itself — straight from your address. Either way it travels under the terms of that app or of your email provider. Alpine Lynx never sees or receives it.
• Backups. Device backups and any backup file you export go to your own iCloud or wherever you choose to save them. They are yours; I have no access.
• Purchases. Subscriptions are processed by Apple through the App Store. I never see your payment details. With the annual subscription, the app sends my server the receipt signed by Apple, for the invite codes — see below.

Invite codes (annual plan)

Each annual subscription has its own invite code. When someone subscribes to the annual plan with your code, your next renewal costs less; their price stays the same. That's all my server is for: keeping the codes and knowing which subscription each one belongs to. This is everything it knows.

• When. Invite codes only exist with the annual subscription (including the free trial period). Without it, the app never talks to my server. The monthly subscription has no invite code.
• What the app sends. The annual subscription's receipt, signed by Apple — which contains the subscription number Apple assigned, the product, the purchase and renewal dates, and the environment (production or sandbox) — and, if you entered it, the code of the person who invited you. That receipt does not contain your name, your email, your Apple account or payment details, and the app does not send them.
• What I store. That subscription number, your invite code (generated by me, at random), the code of the person who invited you, the subscription's status, dates and amounts paid, and a log of the notifications Apple sends me about it (renewal, expiration, refund). Apple sends those notifications with the same numbers — never with personal data.
• What for. To know which subscription each invite code belongs to and apply the renewal discount, and to confirm with Apple, in the days before each renewal, that the subscription is still active. Nothing else.
• What I never store. Name, email, Apple account, IP address, payment details. There is no account and no sign-in: the server doesn't know who you are. The IP address is used only in memory, to block abuse, and is never logged.
• Where. On Cloudflare, with the database in Western Europe.
• Who sees what. You can see the invite codes of the people you invited, and whoever invited you can see your invite code. Codes only — never names. I do not share this data with anyone besides Apple, who already has it; I do not sell it, it is never used for advertising, and it is never used to train AI models.
• Keeping and deleting. The records stay for as long as the annual subscription exists: they are what calculate your discount, and the app re-creates them every time it opens while the subscription is active. Once it ends, you can ask me to delete them — write to me with your invite code. Without a request, I delete them myself: at the latest 12 months after the subscription ends. Test invite codes (TestFlight) are kept in a separate ledger, marked "Sandbox", and never mix with the real ones.

Connected email account (app password or Google)

If you choose to, QR Quota can send the QR-bills through your own email account, so your members receive the message from the association and not from me. You can connect it in two ways — an app password created at your provider (SMTP), or your Google account (OAuth). Nothing is connected until you connect it, and you can disconnect at any time.

• How it connects. With an app password you create at your email provider (SMTP), or by connecting your Google account. The address, the server settings, the app password and the Google tokens are stored only in your device's Keychain — never on any server of mine.
• Google: sending only. I request a single scope, gmail.send, plus your email address (openid, userinfo.email) so the app knows which address it is sending from. gmail.send permits sending, nothing else: I do not read, list, search, modify or delete your messages, and I have no access to your mailbox, contacts, calendar or files.
• What I use it for. Only to send the QR-bill emails of your own association, one message per member, from your own address. Nothing else is ever sent through your account.
• Sharing and retention. I share this with nobody. It is kept until you disconnect the account in the app — at that point it is deleted from the device.
• Never for AI training. I never use your data — or anything received from Google APIs — to train AI or machine-learning models, and I never sell it or transfer it to anyone.
• Every send starts with you. By default the app sends nothing on its own: you review who receives what, and each message leaves when you tap send. If you switch on automatic sending for a recurring expense report, you are authorising the app to send that report for you on its send date, as soon as you open it — still through your own email account, and you can switch it off whenever you like.
• What I can see. Nothing. Messages go from your device straight to your email provider and travel under that provider's terms and privacy policy.
• How to disconnect. Remove the account in the app (Settings → Sending account); the password or token is deleted from the Keychain at that moment. If you connected Google, you can also revoke access at myaccount.google.com/permissions. If you used an app password, delete it at your provider too.

The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Support

If you email me, I receive your email address and whatever you write. I use it only to reply, and I do not add you to any list.

This website

This site sets no cookies and runs no tracking scripts. It is served by my hosting provider, which may keep standard technical logs (such as IP addresses) to operate the service.

Your rights

Under the Swiss Federal Act on Data Protection (revDSG) and the GDPR you have rights of access, correction and deletion. Because your data lives only on your device, you exercise them directly in the app: edit or delete anything at any time, or delete the app to remove everything, including the "Delete all data" option in Settings. For anything else, write to me. The invite codes' data is the only data outside your device: to delete it, write to me with your invite code after the annual subscription has ended.

Children

QR Quota is a tool for treasurers and is not directed at children under 13.

Changes

If this policy changes, the new version will be published on this page with a new effective date. Material changes will be highlighted in the app's release notes.

Contact

Alpine Lynx · Switzerland · Email me