Privacy policy
This policy explains what Cosmic QR collects when you use our website and web app at cosmicqr.co.uk, why we need it, and the choices you have. Last updated 27 October 2026.
Who we are
Cosmic QR is run by COSMIC CODES DIGITAL LIMITED, a company registered in England and Wales (company number 16798563), registered office Fergusson House, 124-128 City Road, London, EC1V 2NJ. We are the controller of your personal data and are registered with the Information Commissioner's Office (registration number ZC279091). Contact us at support@cosmicqr.co.uk.
What we collect and why
| What | Why we use it | Legal basis |
|---|---|---|
| Name, email and password | To create and secure your account | Contract |
| Mobile number | One verified UK number per person, to stop fake and duplicate accounts | Legitimate interests |
| Age check result | Cosmic QR is 18+ only. You do the check before you first connect, post or message (until then nobody can see you). Stripe Identity checks a photo of your ID and a selfie. We use your date of birth once, only to confirm you're 18 or over, and keep just the result; we then ask Stripe to delete the photos and details from the check | Legal obligation and legitimate interests |
| The days you open the app (the date only, no times or places) | To count how many members come back, so we can improve the app | Legitimate interests |
| Profile details you add: photo, bio, links, your song, birthday (day and month), your Space | To show your profile to people you choose | Contract |
| Your business card, if you make one: business name, type of business, logo, cover photo, what you do, area, status line, hours, colour, price list, badges you add (such as insurance or a registration number), a booking link, when you're "Available now", business posts (words, photos, story, how long, where) and a business phone number | To show your card to people you choose and run Get a quote, reviews, the card wallet and Call. The phone number is never shown | Contract |
| Card wallet, reviews and quote requests: cards you save, reviews you leave, quote messages you send and, only if you tick the box, your account email | To keep your saved cards, show reviews on a business's card and pass your quote to the business so they can reply | Contract |
| Scans, connections, when you met, each connection's level and your own groups of people | To run connecting, your connections list and who sees what | Contract |
| Posts (words, photos, videos, Space posts), stories, reactions and emojis, ratings, recommendations | To show them to the people you choose | Contract |
| Story stickers, photo stickers, replies, likes, emojis and comments on stories, and people you tag | Replies and who joined show only to the story's owner; a tagged connection is told. All deleted with the story after 24 hours | Contract |
| Challenge wins you choose to share: the challenge, your photos and words, and the first names and photos of connections who were part of it | Shown to your connections like any post. Only people you're connected with are named; others are just counted. Nothing is shared unless you tap Share | Contract |
| Comments on posts: your words, replies, likes on comments, and @mentions | Shown to everyone who can see the post. Only the post owner's connections can comment. You can delete your own comments and the post's owner can delete any on their post. Kept until deleted, or until the post is deleted or vanishes. In your data download | Contract |
| Messages you send to your connections | To deliver them to the person you're talking to | Contract |
| Phone alerts and emails | To tell you about connections, messages, payments and safety decisions. Alerts never show what a message says | Contract and legal obligation |
| Points, levels, streaks, rewards and challenges | To run challenges, levels, rewards and the leaderboard between you and your connections fairly | Contract |
| Challenges: who you challenged, and when each of you scanned the other's code to start and finish | To check a challenge really happened in person and give points. No location is used | Contract |
| Out now, Go out plans, events and Together groups, only if you choose to share | To tell the connections you choose: the words you type for where or what, the time and who's in. We never track your live location | Consent |
| Connect from afar invites and no-signal codes | To connect you with someone you know when you can't scan in person, or when there's no signal. We keep only a scrambled copy of each passcode | Contract |
| Other QR codes you scan with our scanner (My scans) | To check the link before it opens and keep a list only you can see. Clear it any time | Legitimate interests |
| Scans you choose to share: the link, what it was, where, your caption, and the link's preview picture or your own photo | Shown to your connections in the feed. We copy the linked page's preview picture into our own storage when you share, so viewers' phones never contact that site. Removed when you delete the post or your account | Consent |
| Song links you paste | We look the song up on Spotify or Apple's iTunes service to fill in the name and artist. Only the link is sent | Contract |
| Business stats: that someone opened a business card or saw a business post (once a day each, with the day; visitors are counted by a scrambled code that changes daily, never their address) | To show the business numbers only: opens, views, saves and quotes after a post. The business never sees who | Legitimate interests |
| Payments for the business card subscription | Handled by Stripe. We never see or store your full card number | Contract |
| Reports and blocks | To keep people safe and act on rule-breaking | Legitimate interests and legal obligation |
| Reports from visitors without an account (about a shared business card): what they tell us and, only if they give it, their email so we can tell them what we decided. We use a scrambled, daily-changing code made from their connection to stop floods of reports; we never keep their address | To keep people safe and act on rule-breaking | Legitimate interests and legal obligation |
| A fingerprint of each photo you upload (a code worked out from the picture, not the picture itself) | So a photo we've removed as an intimate image shared without permission can't be posted again. Deleted with the photo, except fingerprints of removed photos, which we keep to stop them coming back | Legal obligation and legitimate interests |
| Complaints about how we use your data | To look into them and answer you, as the law requires | Legal obligation |
| Device data and cookies | To keep you signed in, remember which phones you've checked with a text code, and keep the app secure. The app uses no advertising or tracking cookies | Legitimate interests (cookies the app needs to work) |
| Marketing emails, if you opt in | Launch news and updates. Unsubscribe any time | Consent |
Your messages
Only you and the person you're talking to can see your messages in the app. They're encrypted while they travel and where they're stored, but they aren't end-to-end encrypted, which means we could technically access them. We only look at messages when a conversation is reported to us or the law requires it. If you report a conversation, the last 20 messages are sent with your report so we can review it. Phone alerts never show what a message says.
Who can see your profile
Your profile is not searchable. Someone can see it only after scanning your live code in person (or through a connect-from-afar invite you send). If they don't connect with you, it closes for them after 24 hours. Your connections can keep seeing it until you or they remove the connection. You choose how much each connection sees by giving them a level: Friend (everything, the default), Work (the top of your profile and your business card) or Public (just your name, photo, area and bio). Your Space, stories, Out now and Go out plans are for Friends only. People aren't told which level you've given them. People who can open your profile see your level, streak, milestone badges and, unless you hide it, how many connections you have.
Your business card is attached to your profile: business name, logo, cover photo, what you do, area, a status line, hours, a colour you choose, your type of business, a price list, badges you add (shown as "stated by the business": we don't check them, so only add what's true), a main button (Get a quote, Book or Call out), an optional booking link to another site (its own privacy policy applies there), "Available now" while you switch it on, and your business posts (words only, or up to 10 photos shown as a swipe or a grid, an optional title, how long it took, where, and an optional before photo). A booking request you receive is kept like a quote request. A business post shows on your business card, and also in your Social posts if you choose "Also post on Social"; it follows the same rules as your other posts. A business number you add is stored separately and is never shown: when someone who can see your card taps Call, their phone dials it, so it will appear on their phone. Your card also has a fixed code that never changes, which you can print. Anyone with your card's code or share link sees the card, projects and reviews, but not your number or the rest of your profile. When a member scans your card's code, or saves it, it goes into their card wallet and they can keep opening it until they remove it. When someone saves your card for the first time through another member's link, that member and you each get 5 points (up to 5 a day per sharer), and you see who shared it and how many opened it. If someone that member sent asks you for a quote, you see who sent them, and if you mark the quote "We got the job", that member gets 25 points and you get 10 (at most 5 a week). Your first review of a business earns you 5 points. The number of cards saved through your links shows as a badge on your profile (Connector, Local Legend, Super Sharer). Reviews can only be left by people who scanned your code in person, and show their first name and initial. If someone asks you for a quote, we keep their message and, only if they tick the box, their account email so you can reply. You can also see who scanned your code in the last 30 days.
With no signal, your phone can show a no-signal code that lasts 24 hours; anyone who scans it only connects once you confirm you met (within 7 days), and at most 10 people can use each code. Only you can see your full connections list, your groups, your card wallet and “My scans”.
The leaderboard only compares you with your connections, so only they see your place and points. You can hide yourself with “Show me on leaderboards” in Settings → Privacy.
Some old data from features we've removed (private notes on connections, and who viewed your profile) is no longer shown or added to. Your old notes are still in your data download, and all of it is deleted with your account.
Who we share data with
We never sell your data. We share it only with providers who help run Cosmic QR, under contracts that protect it:
- Supabase (database and logins) and Vercel (hosting)
- Twilio (text message checks)
- Resend (sending our emails)
- Stripe (payments, and the 18+ ID check through Stripe Identity)
- Apple, Google, Mozilla or Microsoft, if you turn on phone alerts: they deliver an empty alert to your phone, which then fetches the words from us, so they never see what an alert says
- Google Safe Browsing, only for links in other QR codes you scan with our scanner, to check they're safe
- Spotify and Apple (iTunes), only to look up a song link you paste
- TikTok, YouTube or Spotify, only when you open a post that plays something from them: their player loads inside the post and their own privacy policy applies
- When you share a scanned link, our server fetches that page once to copy its preview picture; the site sees our server, not you
We may share data with the police or regulators where the law requires it. Some providers store data outside the UK; when they do, we use the UK's approved safeguards.
How long we keep it
- Your account and profile: until you delete your account
- Posts set to vanish: deleted when they vanish; stories after 24 hours
- Messages: until you unsend them or delete your account; vanishing messages after 24 hours or 7 days
- My scans: until you clear them; we keep your latest 500
- Stories, and everything on them: 24 hours
- Phone alert sign-ups: until you turn alerts off; queued alerts: 2 days; queued emails: up to 30 days
- Points: 12 months (your level remembers the total)
- Payment records: 6 years, because tax law requires it. Stripe, our payment provider, keeps these records
- Reports about rule-breaking: up to 2 years after the case closes
- Complaints about your data: up to 2 years after we answer
Your rights
Under UK data protection law you can ask to see, correct, download or delete your data, object to how we use it, or withdraw consent. You can download or delete your data any time in Settings. For anything else, email support@cosmicqr.co.uk and we'll reply within one month.
If you're unhappy with how we've used or kept your data, you can complain to us in Settings → Complain about my data, or by email to support@cosmicqr.co.uk. We'll confirm we've received it within 30 days, look into it, keep you updated and tell you the outcome. You can also complain to the Information Commissioner's Office at ico.org.uk.
Under 18s
Cosmic QR is only for people aged 18 or over. If we learn someone under 18 has an account, we close it and delete their data.
Changes
We'll tell you in the app and by email before any important change to this policy.