Privacy policy

Effective November 7, 2026

Short version: no accounts, no names, no email addresses, no ads, no analytics, no tracking across sites. We keep just enough to stop people from voting twice, and we store even that in a form we can’t turn back into your IP address or device.

Who we are

qrvote.org is operated by QRvote. Questions about this policy: legal@qrvote.org.

If you vote

A device cookie. The first time you open a vote page, we set one cookie (qv) containing a random ID. It’s how we recognize your phone so it gets exactly one vote. We store only a scrambled (keyed-hash) version of it. It’s “strictly necessary” for the service you asked for, so we don’t show a cookie banner. The scrambled version is the same in every contest, so our moderators can see that one phone took part in several (when, never what it chose), to spot ballot stuffing and abuse. It isn’t used for anything else and isn’t shared.
Your vote: which entry you voted for, and when.
Network and browser signals, hashed. We turn your IP address and browser type into keyed hashes that are different for every contest. They let us limit how many votes come from one network and spot ballot stuffing. We don’t store your IP address itself.
Rough location and network type. Our host, Cloudflare, tells us the country and network operator a request came from (e.g. “US, a mobile carrier” or “a cloud-hosting company”). We use it to flag suspicious votes. When a vote comes from a cloud-hosting company, its organizer sees that company’s name (say, “Microsoft”) and how many votes came from it, so they can tell their own office network from a script. Organizers never see the network of a phone carrier or home internet provider. We keep a list of network operators' names (companies, such as a mobile carrier) for up to 365 days after we last see a vote from one, so our own moderators can see which operator a group of votes came through when they review a contest for ballot stuffing.
Ballot tickets (only in contests that use them): which ticket your phone activated.
The camera, only if you use our scanner. The “Scan a QR code” button reads the code in your browser, on your phone. The camera picture (or a photo you pick) is never uploaded or stored; only the link in the code is used, and only if it’s a QRvote link.
Your settings stay on your device. The language you pick, the site theme, animations on or off, and whether you turned down reading the site in your browser’s language are kept in your browser’s local storage. We never receive them. Your browser’s language is only read on your device, to offer a translation.

Organizers see vote totals and anonymous, grouped anti-cheat signals, such as “5 phones on one network”. They never see your IP address, and they can’t see who you are.

If you answer a survey

We store your answers with the same scrambled device ID and hashed network signals described above, so each phone answers once. The organizer sees each response and can download them, but not who sent it. If the organizer makes results public, only totals and averages are shown; written answers are never public. Please don’t put private information, like your phone number, in a written answer.

If you take a quiz

A quiz is a survey with right answers, so the same applies. Your score is worked out from your answers; it isn’t stored separately. To break ties, we note when you first open the quiz and how long you take. If the quiz has a leaderboard and you add a name, it’s stored with your answers and shown next to your score when the organizer makes results public, so use a nickname. Organizers can remove a name.

If you play a scavenger hunt

We store which checkpoints your phone found and when, with the same scrambled device ID and hashed network signals. If you add a name, it’s shown on the hunt’s leaderboard when the organizer makes it public, so use a nickname rather than your full name. Organizers see each player’s progress and can remove a name.

If you post on a Q&A, ideas board, nomination or wall

What you post (the text, and a name if you add one) is public: it’s shown to everyone who opens the page and on the event’s big screen. If the organizer approves posts first, it shows once they do. It’s kept until the organizer deletes it or the board is deleted (see below). The organizer can hide it, and can download the board’s posts with their names, but not who sent them. Upvotes are stored like votes, with the same scrambled device ID and hashed network signals.

To let you edit or delete your own posts and to enforce the limits, each post keeps a keyed hash of your device cookie. It’s never shown to anyone, organizers included. When you delete a post it’s gone, unless someone had reported it while the report was open: then it stays hidden, for our moderators only, until the board is deleted. Posts on our “Try it” samples are deleted after a day.

If you judge a contest

The organizer types your name when adding you as a judge. We store it with the scores you give (1 to 10 per thing judged), and nothing else about you. Your judge link is the only key; we don’t store it, but recreate it from a server secret when the organizer needs to show it again. The public sees only the judges’ combined scores, once voting closes, and the site never shows which judge gave which score. Your link also stays in your browser’s local storage so the scorecard reopens. Removing you as a judge deletes your scores.

If you run a contest, survey, quiz, hunt or board

The contest details and entries you type, and any photos you upload.
A keyed hash of your network, used to limit how many contests one network can create per day.
A log of the changes you make (for example “added 3 entries” or “ended voting”), with the time and the same keyed network hash. It helps us investigate abuse and is kept for 365 days, even after the contest is deleted.
If our moderators need to reach you about a contest (for example, to answer a message you sent us), they may leave a note at the top of its dashboard. Only someone with the organizer key sees it, and it’s deleted with the contest.
Your organizer key is stored only as a hash on our side. Your browser keeps a copy in its local storage so you can get back to your dashboard. Clearing your browser data removes it. “Move to another device” (on the “Yours” page) puts your saved keys in a QR code that goes straight to your other device; the keys ride in the part of the link that browsers never send to us. If you use an AI assistant built into your browser, the site offers it a few tools (WebMCP): it can list the titles of the contests saved in your browser and read their results, and while your dashboard is open it can do what a few of its buttons do (end or reopen voting, add entries, run a live quiz, download results). It never gets your organizer key, and it can’t delete or start over. A draft link an assistant makes for you carries the filled-in form inside the link itself; we don’t receive any of it until you click Create.
If you connect an AI app (like Claude or ChatGPT) to a contest, we keep a record of that connection: the app’s name and web address as it gave them, which contests, whether it can read or manage, and when. The organizer key it acts with is stored encrypted so that only the app’s own access token can unlock it; the app itself never receives the key. A connection ends when you disconnect it on the dashboard, when you delete the contest, or after 90 days unused, and connecting or disconnecting shows in the contest’s activity log. If a connected app creates a contest for you, we keep that contest’s organizer key encrypted with a key of ours (not the app’s), so the app can keep managing it until you disconnect it; you get the contest through a one-time link that works for 24 hours. An agent can also connect with a 6-digit code you type on QRvote: until you do, we keep only an anonymous registration (no personal data) for a day; after, it’s a connection like any other. We also count how the assistant tools get used (which tool, whether it worked, and the app’s name), with nothing about you or your contest.
Question packs you save (“Save as a pack”) stay in your browser’s local storage only. They never reach our servers, and clearing your browser data removes them.
The names of any judges you add, and their scores.

If you upload photos of people, you’re responsible for having their permission (and a parent’s or guardian’s permission for children).

Our moderators may look at the photos you upload, once they’re on show, to keep the site safe. They note which photos they’ve looked at (the photo, who looked and when), and the note is deleted with the photo or the contest.

If you order prints

The Print page can send your signs, posters and certificates to Zazzle, which prints and ships them. Nothing goes to Zazzle until you click an Order button under one of its pages (or open an order link that an AI app you connected to the contest got for you), and then only what that print needs:

A poster: a picture of the poster, with your contest’s title, the poster’s words, its public link and its QR code, which only ever opens the public page. Zazzle fetches the picture from a link that only your dashboard, or an AI app you connected to the contest, hands out.
A sheet of entry signs: a picture of the sheet, with each entry’s number, name and QR code. Those QR codes are the entries’ scan codes, the ones that let people vote. Zazzle fetches the picture from a private link that only your dashboard hands out (never to an AI app), and that stops working as soon as anything on the sheet changes.
A certificate (once voting has ended): a picture of the certificate, with your contest’s title, the award, the winner’s name as your results show it (an entry’s name, or a player’s name if they gave one), their place and how they won, and the date. Zazzle fetches it from a link that only your dashboard, or an AI app you connected to the contest, hands out, and that stops working if voting reopens. Only the certificates you order go to Zazzle.
A label naming the contest (its short web address) and, for sheets and certificates, which one, so Zazzle’s sales reports tell us which contest a print was for.

Your order itself (your name, address, payment and what you bought) is between you and Zazzle, under Zazzle’s privacy notice. We never see it. Zazzle tells us what sold and our share of the sale, labeled by contest, and nothing about who bought it. Zazzle may keep the designs sent to it as part of your order, and its own cookies apply on its site. We don’t create or store the print pictures on our side: our server draws each one when Zazzle asks for it. We note each time a print picture is fetched (which contest, which picture, when, and whether a server or a browser asked; never who), so we can help if an order goes wrong. The note is kept 365 days, like the rest of our activity log. Which Order buttons you’ve clicked is never sent to us: the Print page ticks them off in your browser’s local storage, so you can see what you’ve opened, and clearing your browser data clears the ticks.

If you report something

We keep what you tell us, a keyed hash of your network (to stop report spam), and any contact details you choose to give, so we can follow up. If you report unfair voting, the contest’s organizer also sees what you wrote, which entry it’s about and when, on their dashboard, because deciding which votes count is theirs; they never see your contact details or your network. Resolved reports are deleted 365 days after they were sent. The activity log also notes that a report was sent (the reason, not your details), for 365 days.

Who else processes data

The site runs on Cloudflare (hosting, database and photo storage). Like any web host, Cloudflare handles your IP address to deliver pages and may keep short-lived operational logs. When you create a contest, vote, post or send a report, Cloudflare’s Turnstile check evaluates your browser to tell people from bots. If you order prints, Zazzle receives what that print needs (see “If you order prints”). We don’t use any other third parties, and we never sell or share data for advertising.

How long we keep it

Contests, surveys, quizzes, hunts and boards are deleted automatically 90 days after they end, and never kept longer than 365 days. That includes entries, votes, posts, judges and their scores, survey and quiz answers, hunt progress and names, the hashed signals, tickets and photos. Organizers can delete a contest sooner at any time.

One exception: if a photo is reported and appears to be illegal (for example, child sexual abuse material), we remove it from public view but must preserve it and report it to the National Center for Missing & Exploited Children, as U.S. law requires. Preserved material is deleted after 365 days.

The activity log (organizer changes, reports sent and our own moderation actions) is kept for 365 days. It never records individual votes. Our moderation console also lists when phones voted, answered or found a checkpoint, by the scrambled device ID and never what they chose. It reads that from the contests themselves, so it goes when they do.

Photos are also stripped of hidden metadata (such as GPS location) when they’re uploaded.

Children

Contests are often run at schools and community events, so children may vote. We don’t ask anyone for their name, email or other contact details. The device cookie and hashed network signals are used only to keep voting fair and the service secure, which is the “support for internal operations” that the U.S. Children’s Online Privacy Protection Act (COPPA) allows. We don’t use them to profile, advertise or contact anyone.

Your choices and rights

Because we don’t collect names or contact details, we usually can’t tell which records belong to you. If you believe we hold data about you, or you want a contest’s data removed, contact legal@qrvote.org or the contest’s organizer. Depending on where you live (for example under the GDPR or California’s CCPA/CPRA), you may have rights to access, correct or delete personal data. We’ll honor those requests where we can identify the data.

Changes

If we change this policy, we’ll update the date at the top.