Privacy policy

Who we are

QuR Tag is run by Impact Consulting AI LLC, a Florida limited liability company ("we", "us"). This policy covers the QuR Tag website and app at qurtag.com, including the page a finder sees after scanning a tag. Questions: info@impactconsulting.ai.

1. The short version

• We collect what we need to let a finder reach you about a lost thing, and nothing more.
• A finder sees your item, never your name, email or phone number.
• Finders do not make an account. We do not record where they are.
• We do not sell your information and we show no ads.
• You can download your data or delete your account yourself, at any time, from Settings.

2. What we collect from owners

• Account: your email address, the first name you give us, and your password, which is stored only as a secure hash.
• Sign-in records: when you sign in, the network (IP) address and browser type of that sign-in, kept with the session so we can keep accounts safe.
• Items you add (up to three on the Free plan): the name, an optional description, an optional photo (we shrink it on your device before it is saved), an optional note for the finder, an optional private note, and whether you marked it lost.
• Tags: the code of each tag you make and whether it is switched on.
• Conversations: the notes you and a finder write to each other, and when they were read.
• Membership, if you buy one: which plan you have, whether it renews, when it ends, and the reference numbers Stripe or Apple give the subscription. We do not receive or keep your card number.
• Messages you send through the Contact us form: the text, the topic, the email address to reply to, and, if you were signed in, your account and plan. We keep them until the question is dealt with and as long after as we need to answer follow-ups.
• Notifications, if you allow them in the iPhone app: your phone's device token (a code Apple gives the app so that our server can send it alerts), whether the app is a test or a live build, and the notification choices you make in Settings. We keep the token until you sign out, delete your account, or Apple tells us it no longer works.
• How the app is used, kept as counts in our own database and nowhere else: when you press "I have it back" on a conversation, when you print, share or download a tag file (which style, look and paper, and whether in the app or on the website), whether you use the iPhone app or the website, and which link brought you to QuR Tag if it carried a label such as ?ch=newsletter (kept in your browser tab until you create the account, then stored once on the account). None of this is used to profile you; it is used only to count.
• Family, if you use it: the email address you invite, until the invite is used, canceled or has expired (and for 30 days after), and the names and email addresses of the people in the family, which they can all see.

3. What we collect when someone scans a tag

• A scan record: the time, which tag was scanned, and a rough device type (for example "iPhone" or "Android phone"). We do not keep the finder's network address or location with it.
• If the finder writes: their notes. Anything they choose to write, such as where they found the item, is part of the note.
• A private conversation key and code. When a finder sends their first note, we give their browser a key so it can reopen that conversation, and a conversation code (12 letters and numbers) they can type at qurtag.com/reply on another phone or computer. The key stays in their browser; we keep only a scrambled (hashed) form of it, which cannot be turned back into the key or the code.
• A scrambled form of the network address the first note came from. We keep a keyed hash, which cannot be turned back into the address, with each new conversation for 30 days, so that when an owner blocks a finder, new notes from the same network can be refused. We do not keep the address itself.
• If the finder chooses: an email address, to be told when the owner replies. It is optional. It is kept only for that conversation, stored encrypted, and never shown to the owner, to anyone at QuR Tag through our screens, or to anyone else. We use it only to email the finder when the owner replies, with the reply and a link back to the conversation, at most once every 10 minutes, and every email has a link to stop them.

4. What we do not collect

We do not collect or store payment card or bank details: payments are taken by Stripe (on the web) or Apple (in the app), and we never see the card number. We do not collect government ID, health or medical information, or precise location. There is no field for any of these, and we ask you not to put them in an item name, a note or a message. Please do not put a child's full name on a tag.

5. How we use it

• To run QuR Tag: show the finder the item, deliver notes between you, and show you your inbox.
• To keep it safe: sign-in limits, stopping abuse and spam, and fixing faults.
• To count how QuR Tag is used, as totals only (for example, how many tags were scanned this month, how many people printed a tag, or how many came from each link). We do this in our own database, with no analytics company.
• To answer you when you write to us.

We do not use your information for advertising, and we do not sell or rent it to anyone.

6. Who can see it

• A finder who scans your tag sees the item's name, its photo, your note for the finder, and whether it is marked lost. Nothing else about you.
• You see the notes a finder writes about your items. The finder sees your replies.
• Other people in your family, if you are in one, see the family's items, tags, scans and inbox, and the names and email addresses of the people in the family. They do not see anything you made on your own account before you joined.
• We can see stored data when we need to run or repair QuR Tag, stop abuse, or meet a legal duty.
• We may share information if the law requires it, to protect someone from harm, or as part of a sale or merger of our business, in which case this policy keeps applying to it.

7. Our service providers

These companies process data for us only so that QuR Tag works, under their own data protection terms:

• Vercel Inc. hosts the website and runs our server code. Like any web host it keeps short-lived request logs, which include network addresses.
• Supabase Inc. runs the database where your account, items, tags and conversations are stored, in the United States.
• Stripe, Inc. takes card payments on the web and runs the payment and membership pages you are sent to. It receives your email address, your card details (which it keeps, not us) and your payment history, under its own privacy policy.
• Apple Inc. takes payment for memberships bought in the iPhone app, under Apple's own terms and privacy policy. We receive only whether a subscription is active, which plan it is and when it ends.
• Apple Inc. also delivers the alerts we send to your iPhone (the Apple Push Notification service). It receives your device token and the text of each alert: the item's name and the finder's note, or only "You have a new note" if you chose to hide the note on the lock screen. We use no other push service.
• RevenueCat, Inc. records iPhone app subscriptions for us and tells our server when one starts, renews or ends. It receives your QuR Tag account number (a random identifier, not your email address), your purchase records from Apple, and technical details of your device and network address.
• Functional Software, Inc. (Sentry) receives an error report when the website or the app breaks: the error message, where in the code it happened, the kind of browser or phone and its system version, and the address of the page with any tag, invite or reset codes removed. We ask it not to record your network address, and we send no account, email address, notes, cookies or clicks. Reports are not sent from test machines.
• Resend (Resend, Inc.) sends our email: the link to reset your password, and the emails that confirm your address, tell you a finder wrote (at once, or as a copy ten minutes after an alert you have not opened), or carry a family invite; and, for a finder who asked, the email that says the owner replied. It receives the address and the text of that email.

8. Cookies and browser storage

Owners get one sign-in cookie, which keeps you signed in. A finder's browser stores the private conversation key and code described above, so they can come back to their conversation. We use no advertising or tracking cookies and no third-party analytics. Your browser tab remembers the label of the link that brought you here until you close the tab, and nowhere else. The error reports in section 7 set no cookies. If you pay on the web, the payment page is Stripe's and uses Stripe's own cookies.

9. How long we keep it

• Your account, items, tags, scans and conversations: until you delete them or your account.
• Deleting an item deletes its tags, scans and conversations at once, and its tag stops working.
• Deleting your account deletes everything above at once. Copies in our providers' backups are replaced on their normal schedule.
• Sign-in records end when the session ends or expires.
• A finder's email address: deleted when the conversation is closed or the finder is blocked, right after the last email when the owner marks the thing returned, when the finder stops the emails, or after 30 days without a note, whichever comes first.
• The scrambled network address kept with each new conversation: 30 days. A block that uses it lasts 30 days, or until the owner unblocks.
• Your phone's device token: until you sign out of the app or delete your account, or until Apple tells us it is no longer valid.
• Membership records: while your account exists. Deleting your account deletes them here; Stripe, Apple and RevenueCat keep their own records under their own rules. Cancel a membership that is still renewing before you delete your account, so you are not charged.

10. Your choices and rights

• See and change your items at any time in the app.
• Download your data: Settings, then Download my data.
• Delete your account: Settings, then Delete my account. It takes effect at once. A membership that is still renewing must be canceled first.
• Cancel a membership: on the web, Membership, then Manage membership. On iPhone, Settings, your name, Subscriptions. You keep your plan until the end of the period you paid for.
• A finder who wants their notes removed can email us with the tag code and roughly when they wrote.
• For anything else, including a question about the law where you live, email info@impactconsulting.ai. We answer requests within 30 days.

11. Security

QuR Tag is served over HTTPS only. Passwords and finders' conversation keys are stored hashed. QuR Tag's data sits in its own part of our database, reached through separate logins that can reach nothing else, and a finder's page can only read the item card and that finder's own conversation. No system is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires.

12. Children

You must be 18 or over to make an account. A parent or carer can tag a child's things from their own account. A finder can be any age; we do not ask finders who they are.

13. Changes

If we change this policy, we will update the date at the top. If a change is significant, we will put a notice on this site before it takes effect.

14. Contact

Impact Consulting AI LLC, Florida, United States. Email info@impactconsulting.ai.