Privacy notice
Datenschutzerklärung nach Art. 13 DSGVO.
1. Controller
Eike Niehs
Hagenring 87, 38106 Braunschweig, Germany
E-Mail: info@eikeniehs.de
2. What this app does
QR generates QR codes. Static codes are made on the start page by anyone, without an account. Dynamic codes encode a short link on this server that redirects to an address their owner can change; making them needs an account.
3. Static codes
What you enter (a link, text, Wi‑Fi details, contact details, and so on) is sent to the server once to draw the code and returned to you as the image. It is not stored, not logged and not passed on: the request carries it in its body, which the web server's access log does not record. Legal basis: Art. 6 (1) (b) GDPR (providing the service you asked for).
4. Scanning a dynamic code
A dynamic code leads to https://qr.eikeniehs.de/r/…, which redirects you to the address its owner set. We count that scan by adding one to the code's counter for the current day. No IP address, device, browser, location or time of the individual scan is stored; the owner of the code sees only how many scans there were per day. Who the target address belongs to and what it processes is outside our control — check that site's own notice. Legal basis: Art. 6 (1) (f) GDPR (our and the owner's interest in knowing whether a printed code is used).
5. Server logs
Like every website, our web server records your IP address, the requested URL, time, browser type and referrer of each request, including the redirect described above. Purpose: operating the service and preventing abuse. Legal basis: Art. 6 (1) (f) GDPR. Retention: up to 90 days (log rotation). Log entries are not linked to a code's scan counter.
6. Data processed for account holders
Accounts are created via an invitation link with name, e-mail address and a password (stored as a salted hash). A session cookie (session, HttpOnly, valid 30 days) keeps you logged in. The dynamic codes you create — name, target address, style, short code and the daily scan counts — are stored until you delete them or your account is removed. Legal basis: Art. 6 (1) (b) GDPR. Accounts are deleted on request to the controller.
7. Account requests
If you ask for an account through the request form, we store the name, e-mail address and reason you enter until the request has been decided, and keep the decision (approved or rejected) with the address as a record. Legal basis: Art. 6 (1) (b) GDPR (steps prior to entering into a contract of use) together with Art. 6 (1) (f) GDPR. You may withdraw a request at any time by writing to the controller, and it is then deleted.
8. Spam protection (Cloudflare Turnstile)
The account request and password reset forms are protected by Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you open one of these forms, your browser loads a script from challenges.cloudflare.com, and Cloudflare processes your IP address, browser and device characteristics and interaction data to tell people from bots. Purpose and legal basis: our legitimate interest in keeping the forms free of automated abuse, Art. 6 (1) (f) GDPR. Transfer to the USA is covered by the EU standard contractual clauses and Cloudflare's certification under the EU–US Data Privacy Framework. Cloudflare's privacy notice: cloudflare.com/privacypolicy. No other page of this app loads anything from Cloudflare.
9. E-mail
We send e-mail for three purposes: invitation links, confirmation and notification of account requests, and password reset links. Reset links are stored only as a hash and expire after one hour. Mail is dispatched through our mail provider (STRATO AG, Pascalstraße 10, 10587 Berlin) as a processor. Legal basis: Art. 6 (1) (b) and (f) GDPR.
10. Hosting
The app runs on a server operated by us and hosted at Realtoxmedia, Felix Gassan, Talweg 4s, 21149 Hamburg. No data is shared with third parties beyond the hosting provider as a processor.
11. No tracking
This app uses no analytics, no advertising and no third-party fonts. The theme you pick (light or dark) is remembered in your browser's local storage and never sent to us. The only third-party script is the Turnstile captcha described in section 8, and it is loaded on the two public forms only.
12. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to object (Art. 15–21 GDPR), and to lodge a complaint with a supervisory authority. Contact: info@eikeniehs.de.
Last updated: 16.09.2026