Privacy Policy

QrdyCraft is operated by Qrdy, a Vietnam-based maker of creative tools. Sister products are linked from our footer (“QRdy on Canva”) and from qrdynamic.xyz. You can reach us at support@qrdynamic.xyz.

a. Account information from QrdyAI single sign-on. When you sign in to QrdyCraft through your QrdyAI account, we receive your QrdyAI user id, email address, display name, profile picture URL, and the login provider you used (Google, Apple, etc.). We store these in our database so we can attach your creations to your account.

b. Content you create. The keywords you type, the photos you upload during a mosaic generation, the resulting shape outlines, and your created mosaics. We do not keep your uploaded photos — we trace them, extract the outline, then discard the original image. Only the shape outline plus the metadata required to re-render your mosaic is stored.

c. Usage counters. We count how many AI generations and photo uploads you make each month, so we can enforce the limits of your plan. Daily-bucketed counters are kept for 90 days; lifetime counters are kept indefinitely.

d. Billing data. If you upgrade to Pro, our payment processor Lemon Squeezy collects your payment card and billing address directly. We never see or store payment card data. We receive only your subscription status (active, past_due, cancelled), plan, and renewal date.

e. Server logs. Our servers log standard request information (timestamp, request path, response status, IP address, user agent) for security, abuse prevention, and debugging. Logs are retained for up to 30 days unless we need them longer to investigate an incident.

• We do not keep the original photos you upload — only the traced outline. The original is processed in memory and discarded.
• We do not collect children's faces, voices, real names, school information, or location data.
• We do not sell or rent your personal information to data brokers.

• Operate the service. Render your mosaics, generate PDFs, enforce plan limits, surface your creation history.
• Authenticate you. Verify your QrdyAI session and attach your work to your account.
• Process payments. Receive subscription status from Lemon Squeezy and unlock paid features.
• Communicate with you. Respond to support requests; send transactional emails about your account or subscription. We do not send marketing emails without your separate opt-in.
• Prevent abuse. Detect and block automated traffic, copyright violations, and adult-content prompts.
• Comply with law. Respond to lawful requests from courts and government authorities.

QrdyCraft relies on a small set of third-party services to deliver the product. We share the minimum data each needs:

Each provider has its own privacy policy. We choose providers with reasonable data-protection practices, but we do not control how each provider handles data after we pass it.

Qrdy is based in Vietnam. Our cloud providers run in multiple regions worldwide. By using QrdyCraft you understand that your data may be transferred to, stored, and processed outside the country where you live.

• Account and creations: kept until you ask us to delete them, or until your account has been inactive for 24 months.
• Uploaded photos: discarded immediately after the outline is traced.
• Usage counters: daily bucket 90 days, lifetime totals indefinite.
• Server logs: 30 days.
• Subscription history: kept as long as required for tax and accounting (typically 5–7 years under Vietnamese law).

If you are in the EU/EEA, UK, California, or another region with privacy laws, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data (“right to be forgotten”), subject to legal retention.
• Export your data in a portable format.
• Object to or restrict processing.
• Withdraw consent for any processing you previously consented to.

To exercise any of these rights, email support@qrdynamic.xyz with “Privacy request — QrdyCraft” in the subject line and the email address on your account. We aim to respond within 30 days.

QrdyCraft is designed for parents to create with their kids, not as a service for children to sign up and use on their own. We do not knowingly collect personal information from children under the age of 13. If you believe a child under 13 has registered a QrdyAI account and used QrdyCraft, please email support@qrdynamic.xyz and we will delete the account and its data.

See our Cookies Notice for details. In short: we do not set marketing or analytics cookies. The only first-party cookie we set is an administrative session cookie for internal staff tools at /admin.

We use industry-standard practices to protect your data — TLS for all traffic, hashed credentials, access controls on our database, and limited internal access. No method of transmission or storage is 100% secure, but we take any incident seriously and will notify affected users without undue delay if a breach affecting personal data occurs.

We may update this policy from time to time. For material changes we will give at least 30 days' notice on this page and, where appropriate, by email or in-product banner before the change takes effect. The “Effective date” at the top of this page reflects the most recent revision.

For privacy questions, data requests, or to report a concern, contact:

Qrdy — support@qrdynamic.xyz