Privacy Policy

Effective date: 5 October 2026

Good Enough QR Menu is a mobile app and website (geqrmenu.com) that lets restaurants, cafés, caterers and event hosts publish a digital menu behind a QR code. It is built and run by an independent developer. In this policy, "we", "us" and "our" mean that developer.

This policy explains what information we handle, why, and what you can do about it. It covers two groups of people:

Owners: people who create an account in the app to build and publish menus.
Guests: people who open a published menu by scanning a QR code or following a link.

If something here is unclear, email us at support@geqrmenu.com and we'll answer you directly.

The short version

Guests never need an account.
Our website (including menu pages) uses Google Analytics to understand how it's used. Analytics cookies are only set if you accept them.
We count menu scans without storing anyone's IP address.
Owners give us a name, an email address and a password. We store the password only in a scrambled (hashed) form.
We don't sell personal information, we don't show ads, and the app has no analytics or advertising tools built in.
You can ask us to delete your account and everything in it at any time.

Information we collect

If you create an account (owners)

Account details. Your name, email address and password. A phone number is optional. We never store your actual password: it's run through a one-way hashing function (bcrypt) before it reaches our database, so we can check it at sign-in but can't read it.

Verification and reset codes. When you sign up or reset your password, we email you a one-time code. We store only a hash of that code, along with when it expires and how many attempts have been made, so codes can't be guessed or reused.

The menus you build. Menu names, descriptions, sections, dishes, prices, tags, availability, event dates and expiry dates, plus any links you add (for example your Instagram page). Published menus are public by design. See "Who can see your menu" below.

Account activity. We keep a record of account events such as sign-ups, sign-ins, password resets, and menus being created, published or deleted. Each entry has a date and time, your account ID and, for sign-in events, your email address. We use this to keep accounts secure and to investigate problems you report.

You don't sign up, and we don't ask who you are. To show owners an honest scan count, our server takes your IP address and your browser's user-agent string, combines them with a private server key and today's date, and turns the result into a fixed-length code (a SHA-256 hash). We store only that code, the menu you viewed and the date.

That means:

your IP address itself is never written to our database,
the code can't be turned back into your IP address, and
because the date is part of every code, codes from different days can't be linked to the same person.

The only purpose of this is to count each visitor once per menu per day.

Website analytics

Our website, including menu pages, uses Google Analytics 4, a service from Google, to tell us which pages are visited, roughly where visitors come from (country and city level), what device and browser they use, and how they arrived (for example a search engine or a shared link). We use this only to improve the website. It is not used in the mobile app.

If you accept, Google Analytics sets first-party cookies (named `_ga` and `_ga_<ID>`) that last up to 2 years, so repeat visits can be recognised.
If you decline, or haven't chosen yet, no analytics cookies are set. Google may still receive cookieless signals (such as the page viewed and that a visit happened) without any identifier that recognises you across visits.
Google Analytics doesn't log or store full IP addresses. We have turned off Google signals and ad personalisation, and we don't link analytics to owner accounts.

You can change your choice at any time with the "Cookie settings" link at the bottom of our home page, or by clearing this site's data in your browser. You can also use Google's opt-out browser add-on. Google processes this data under its own privacy policy, and data may be processed on Google servers outside your country.

Information every visitor sends

Like any website, our server receives basic technical details with each request: IP address, date and time, the page requested, and the browser or app making the request. These appear in our server logs, which we use to keep the service running, spot abuse and fix errors.

On your device

The app keeps a sign-in token on your phone so you stay signed in. It's removed when you sign out. Our website only sets cookies if you accept analytics (see "Website analytics" below). It stores your accept or decline choice in your browser's local storage so we don't ask again.

What we don't do

We don't sell or rent personal information to anyone.
We don't show ads, and we don't use advertising or analytics SDKs in the app.
The app doesn't ask for access to your contacts, camera, photos, microphone or location. The only permission it uses is internet access.
We don't send marketing emails. The only emails we send are the ones you need: verification codes and password resets.

How we use information

We use the information above to:

create and secure your account, and let you sign in,
send verification and password-reset emails,
host your menus and show them to guests at your menu link and QR code,
show you scan statistics for your menus,
detect and prevent abuse, fraud and attacks, for example by limiting repeated sign-in attempts,
answer you when you contact us, and
meet our legal obligations.

When you publish a menu, anyone with the link or QR code can see it, along with any links you've added. Live menus can also be found by search engines such as Google, which helps guests find you. When you unpublish or delete a menu, or it reaches its expiry date, it stops being shown and we ask search engines not to list it. Copies that search engines have already stored may take some time to disappear.

Please don't put personal information about other people (such as staff phone numbers) on a public menu unless they've agreed to it.

We share information only as needed to run the service:

Hosting provider. Our servers and database run on infrastructure provided by a hosting company, which stores data on our behalf.
Email delivery provider. Verification and reset emails are sent through an email delivery service, which receives your email address and the message.
Google Analytics. Website usage data, as described in "Website analytics" above.

These providers may only use the data to provide their service to us. We may also disclose information if the law requires it, to respond to a valid legal request, or to protect the rights, property or safety of our users, the public or ourselves. If the service is ever transferred to someone else, your information would move with it, and this policy would continue to apply to it.

Where information is stored

Our servers may be located outside the country you live in, which means your information may be processed in a country with different data protection laws. Wherever it's processed, we protect it as described in this policy.

How long we keep information

Account details and menus: for as long as your account exists. Menus you delete are removed from our database straight away.
Guest scan records: deleted automatically after 365 days. Each menu keeps only its total scan count after that.
Website analytics (Google Analytics): user-level data is deleted automatically after 14 months. Reports keep only aggregated totals after that.
Expired sign-in tokens: removed automatically once they expire.
Server logs and account activity records: kept for up to 12 months, unless we need them longer to investigate a security incident.
After you delete your account: we delete your account, menus, links and statistics within 30 days of your request. Copies in backups, if any, are overwritten on a rolling basis.

How we protect information

All traffic between the app, our website and our servers is encrypted with HTTPS. Passwords and one-time codes are stored only as hashes. We limit repeated sign-in and code attempts, and signing out cancels your session token. No online service can promise perfect security, but we take reasonable steps to protect your information and keep those steps under review.

Your choices and rights

Update your menus at any time in the app. To change your account details, email us.

Delete your account. Email support@geqrmenu.com from the address on your account and ask us to delete it. We'll confirm, then delete your account and all of its menus within 30 days. Printed QR codes for those menus will stop working. Full instructions are on our account deletion page.

Get a copy of your data. Ask us by email and we'll send you a copy of the account and menu data we hold about you.

If you're in the European Union, the United Kingdom or a similar jurisdiction, you also have the right to access, correct, delete or move your personal data, to object to or restrict certain processing, and to complain to your local data protection authority. Where those laws apply, we rely on these legal grounds:

To provide the service you signed up for (performing our contract with you): your account and menus.
Our legitimate interests: keeping the service secure, preventing abuse, and counting scans in the privacy-friendly way described above.
Legal obligations: when the law requires us to keep or disclose information.

We'll respond to any request within 30 days. We may need to confirm your identity first, usually by asking you to write from the email address on your account.

Children

The app is for businesses and adults organising events, and owners must be at least 18. We don't knowingly collect personal information from children. Guests of any age can view menus without giving us any personal information. If you believe a child has created an account, contact us and we'll delete it.

Changes to this policy

If we change this policy, we'll update the effective date at the top. If a change materially affects how we use your information, we'll tell owners in the app or by email before it takes effect.

Contact

Questions, requests or complaints about privacy:

Email: support@geqrmenu.com