Who runs this site
Skanzu is an independent project operated from Bulgaria, in the EU. For anything on this page — including deleting your email — write to privacy@skanzu.com.
What is never collected
- No IP addresses are stored, anywhere.
- No cookies on the marketing pages — no analytics, no preferences.
- No third-party scripts, ad networks, pixels or trackers.
- No device fingerprints, and no profiles that follow you across sites.
The QR code you generate is built entirely in your browser. The address, network name or contact details you type into the generator are never sent anywhere.
What is collected
Two kinds of counters, both deliberately dull, plus an email only if you type one:
- Page counters. A page view increments a counter for that day, that page and
the event type. A row looks like
2026-11-08 · view · /qr-code-for/menu · 41. It cannot be traced back to a visitor: no IP, no browser string, no referrer, no session. - Scan counters for dynamic codes. Each scan increments a per-code counter for that day, a coarse country (from the network edge, e.g. “BG”) and a device class (mobile or desktop). Nothing about an individual scan is stored.
- Your email — only if you submit it. The launch form sends the address, the page you were on, and the time. Nothing else is captured alongside it.
If you sign in
Signing in is optional, and there is no password. When you ask for a link at
app.skanzu.com:
- Your address is the account. It is stored with the time the account was created — no name, no photo, no profile.
- A single-use link is emailed to you and expires after 15 minutes. Only a hash of that link is stored, so a copy of the database cannot be used to sign in as you.
- One session cookie is set on
app.skanzu.comwhen you sign in, so the app knows it is you. It cannot be read by scripts, it is not used for analytics, and it is deleted when you sign out or after 30 days. - Scans are never attached to your account. Scan counters stay aggregate — per code, day, country and device class — so there is no per-visitor history to join to you.
Why this is allowed
Page and scan counters are aggregate statistics that do not identify anyone. Your email is processed on the basis of consent, given when you press the submit button, and you can withdraw that consent at any time. When you sign in, the address is processed because you asked for the account — and deleting the account deletes it.
How long it is kept
Counters are kept as daily totals only, with no finer granularity. Your email is kept until the one message it exists for has been sent — the day dynamic codes open — or until you ask for it to be deleted, whichever comes first. An account address is kept for as long as the account exists, and sign-in links and sessions are deleted as soon as they expire. Deletion requests are actioned within 30 days, and the address is removed rather than archived.
Who else sees it
The site, its database and the sign-in email all run on Cloudflare, in its EU region, as hosting provider and data processor — no separate mail vendor receives your address. Nothing is sold, rented or shared with anyone else, and no marketing platform holds a copy of the list.
Your rights
You can ask for a copy of what is held about you, ask for it to be corrected or deleted, or object to the processing. Write to privacy@skanzu.com and you will get an answer within 30 days. If you think it has been handled badly, you can complain to the Bulgarian Commission for Personal Data Protection, the supervisory authority for this site.
Changes
If this page changes in a way that affects you, the date below changes with it. Last updated 8 November 2026.