Summary. QRefka Scan has no internet permission, no accounts, and no analytics. It uses the camera, and any picture you choose, to read codes on your device. It sends nothing to us or anyone else. Everything you scan or generate stays on your device.
1. Who this policy is from
QRefka Scan is published by Mikhail Mikhaylov, who is responsible for this policy. Contact details are in section 12.
2. Data the app collects and processes
To do its job, the app collects and processes one kind of personal data:
| Data | Purpose | Where it goes |
|---|---|---|
| Camera images (the live camera feed) and a photo you pick from your gallery | Finding and decoding QR codes and barcodes — the app's core function | Processed in memory on your device only; never stored, never transmitted, never shared |
Camera access is optional: it is requested only when you open the Scan tab, and you can refuse it and still generate codes or scan from a picture. Details are in section 3.
Nothing else is collected. The app has no accounts, no analytics, no advertising SDKs, and no crash-reporting service. We, the developer, never receive any of this data and have no way to access it, or any device identifiers or usage statistics.
3. Camera and images
The app requests the CAMERA permission, and only when you open the Scan tab. The camera feed is analyzed frame by frame on your device to look for QR codes and barcodes. Frames are never recorded, never written to storage, and never transmitted. Decoding stops as soon as you leave the Scan tab. The flashlight and zoom controls act on the same camera and need nothing further.
Scan from image. You can also pick a picture from your gallery. The app opens the Android system photo picker (or, on devices without it, the system file picker), and receives access to only the one image you choose, for that moment. It holds no storage or photo permission and cannot browse your gallery. The image is decoded in memory on the device, is not copied or stored, and is never transmitted.
4. Scanned and generated content
Text that you scan or encode is held in memory while the app is running. The app writes it to no database, preference file, or log, and declares allowBackup="false", so it is not included in Android backups or device-transfer flows. Between launches the app keeps only a single on/off flag recording that you agreed to this policy, stored in the app's private storage on your device, and the images of QR codes you share (see Files these actions create below).
Content leaves the app only through an action you take:
| Action | What happens |
|---|---|
| Copy | The scanned text is placed on the system clipboard. |
| Share | The generated QR image is handed to the app you pick, through a scoped Android FileProvider. |
| Save | The generated QR image is written to your gallery (Android 10 and newer). |
| Open | A scanned link is passed to the Android system, which opens it in the app you choose. |
| Call | The phone number is passed to your dialer app. The call is placed only if you start it there. |
| Send message | The number and message text are passed to your messaging app, which sends nothing until you do. |
| Write email | The address, subject and text are passed to your email app as a draft. |
| Add to contacts | The contact details (name, phone numbers, email addresses, company, job title, address, website, note) are passed to your contacts app's “new contact” form, which saves them only when you confirm. |
| Add to calendar | The event details (title, time, place, description) are passed to your calendar app's “new event” screen, which saves them only when you confirm. |
| Show on map | The coordinates are passed to your map app. If no map app is installed, they are opened in your browser on openstreetmap.org. See section 6. |
| Search the web | The scanned product code or short text is passed to your search app. If there is none, it is opened in your browser as a search on bing.com. See section 6. |
| Add network (Wi-Fi codes) | The scanned network details, including the password, are passed to the Android system's own “add network” dialog, which saves the network after you confirm. See section 5. |
Files these actions create. Two of them do put data on disk, and you should know where:
- Share first writes the QR image to a private cache folder inside the app's own storage, because Android passes another app a file reference rather than the image itself. Only apps you shared with can read it. The app deletes these files on a later share once they are more than an hour old, and clearing the app's cache or uninstalling the app removes them immediately.
- Save writes a PNG to
Pictures/QRefka Scanin your gallery. That file is yours and stays until you delete it.
For every one of these actions the app reads nothing back: it cannot see your contacts, calendar, call log or messages, and it learns nothing about what you did in the other app.
Once content reaches another app — or the clipboard — the privacy policy of that app applies.
5. Wi-Fi QR codes
A QR code can carry Wi-Fi credentials (a WIFI: payload). The app recognizes these and parses them on the device, so it shows you the network name, security type and whether the network is hidden, rather than a line of raw text.
What happens with the password depends on your Android version and the kind of network:
- Android 11 and newer, ordinary password-protected networks. The app passes the credentials to the Android system's own “add network” dialog, and that dialog saves the network once you confirm it. The password is not displayed on screen, and the app holds no permission to change your Wi-Fi settings itself — the system does the saving.
- Everything else (Android 10 and older, or WEP and enterprise
networks that the system dialog does not accept). The app shows the password so you can
type it in yourself. That screen sets Android's
FLAG_SECURE, which keeps it out of screenshots and out of the recent-apps preview.
In both cases the password is held only in memory, is written to no storage by the app, and is never transmitted. If you use Copy password, it goes to the system clipboard marked as sensitive content, which on Android 13 and newer keeps it out of the clipboard preview, the clipboard history and keyboard suggestions.
6. Network access
The app does not declare the INTERNET permission. It cannot make network requests of any kind, so no data can be sent to us or to a third party by the app itself. Following a scanned link opens a separate app — usually a browser — which does have network access.
The same applies to Show on map and Search the web: if your map or search app, or the fallback websites openstreetmap.org and bing.com, work online, it is that app or website — not QRefka Scan — that sends the coordinates or search text over the network, under its own privacy policy. Nothing is sent unless you tap one of these buttons.
7. Permissions in full
The installed package declares exactly one permission:
| Permission | Why | When requested |
|---|---|---|
android.permission.CAMERA | Scanning QR codes and barcodes | When the Scan tab opens |
No internet, network-state, storage, photo, location, contacts, calendar, phone, SMS or microphone permission is declared — in particular, none that would let the app read or change your Wi-Fi settings, contacts or calendar. The actions in section 4 work without them because the system apps do the saving after you confirm, and the photo picker in section 3 grants access to the single image you pick. Two install-time permissions that AndroidX libraries would otherwise merge into the package are explicitly stripped from the manifest, so the list above is the complete one you will see on the store listing and in Android's app info screen.
The manifest additionally declares a <queries> entry for the system
“add network” screen. That is a package-visibility declaration, not a permission: it
lets the app confirm that the dialog it sends Wi-Fi credentials to is the one belonging to
the operating system, rather than any app that claims to handle them. It grants no access
of any kind and does not appear in the permission list.
8. Third-party components
The app is built from AndroidX libraries (Jetpack Compose, CameraX) and the ZXing core decoding library. These run entirely on the device and contain no telemetry. No Google Play Services component is present in the app.
9. Your rights
The camera images and pictures described in section 2 exist only in your device's memory for as long as it takes to decode them, and never reach us, so we hold no personal data about you that we could produce, correct or delete. You can withdraw camera access at any time in Android's app settings. You can re-read this policy, or withdraw your consent to it, at any time with the ⓘ button next to the Scan and Generate tabs; after you withdraw, the app asks for your consent again before it can be used. Data protection law in your country may still give you the right to complain to a supervisory authority about how an app handles your data — in the EU and the UK, that is your national data protection authority.
10. Children
The app treats everyone the same way: camera images and picked pictures are processed only on the device, and no data from anyone — children included — is stored by the app or sent to us.
11. Changes to this policy
If the app ever changes in a way that affects this policy, the updated text will be published on this page with a new "last updated" date.
12. Contact
Developer: Mikhail Mikhaylov.
Questions about this policy: info@qrefka.ru.