Privacy Policy

Depending on how you use the product, we may process:

• Account information, such as display name and role.
• Email address associated with your sign-in method.
• Authentication information needed to keep you signed in, including session identifiers. Passwords are stored only as one-way hashes by the authentication service. We never store passwords in the app or on the device in recoverable form.
• QR generation activity, including type, size, colors, a short content preview, and a content hash used for integrity — not a public copy of the full payload.
• QR scan activity when history is enabled, stored as a shortened reference rather than a full sensitive payload.
• Subscription and payment records such as plan, amount, currency, status, and Paystack reference. PugaQR Generator does not store raw card numbers, CVV, or PIN data.
• Device and push information where a native build uses optional platform APIs (for example network state or haptics). Camera access is requested only when you start a scan.
• Technical and log information such as timestamps, error messages, and payment event identifiers needed to operate the service.

QR codes you generate are created on your device from the content you enter. The service records a truncated preview and a hash so your history can be shown to you. We do not publish user-generated QR content, and generated marks are not made publicly addressable.

Sensitive content — for example Wi-Fi passwords, personal messages, or payment details you encode — should be treated as confidential. Do not share a QR image if the encoded payload should stay private. Scan history stores a shortened reference, not the full original payload, and remains scoped to your account.

PugaQR Generator does not sell user-generated QR content and does not use it for advertising.

Paid plans are processed by Paystack. Card details are entered on Paystack's checkout and are subject to Paystack's own terms and privacy notice. PugaQR Generator stores payment references, amounts, and fulfillment state so we can activate the correct plan. We do not store raw card details on our servers or in the application.

Transactional emails — such as email verification, password reset, payment receipts, and subscription notices — may be sent through the application's configured SMTP / Nodemailer infrastructure. SMTP credentials are kept on the server as environment configuration and are never shipped in the frontend.

You can turn off non-essential messages (product updates, promotions, subscription reminders, and usage notifications) in Account → Email preferences. Security, verification, and payment-result emails are sent when needed to operate the account.

We apply reasonable technical and organizational safeguards appropriate to a production web and mobile application: authenticated API access, hashed pass codes, hashed passwords, server-side payment verification, rate limiting, and session cookies or platform-secure storage for session restoration. No method of transmission or storage is completely secure, and this policy does not claim otherwise.

From your signed-in Account screen you can:

• Access account information, including email, plan, and recent activity.
• Update your display name and email preferences.
• Delete your account, which removes personal profile fields, generation history, and scan history from active use.
• Request access, export, or deletion of personal data. Requests are logged so Puga Digital Technologies can complete them.

To contact Puga Digital Technologies about privacy, use Privacy team through the in-app Account tools. Payment records needed for accounting may be retained in anonymized or reference form after an account is deleted.

We keep account, payment, and security records for as long as needed to provide the service, prevent abuse, and meet legal obligations we are actually subject to. PugaQR Generatoris not directed at children, and we do not knowingly collect information from children.