1. Our Data Collection Principle: Local-First

RowaQR defaults to keeping all user scan data, generated QR codes, and search logs strictly within your device's local storage (AsyncStorage/Keychain).

Our application NEVER integrates third-party ad networks, behavioral trackers, or profiling tools.

2. Requested Device Permissions and Purposes

Camera Permission: Used exclusively to detect and decode QR codes and barcodes within the viewfinder in real time. Video feed is never recorded, transmitted, or stored on remote servers.

Photo Library Permission: Used only when you choose to scan a barcode from your gallery or save an exported QR image to your device.

Network Access: Utilized for QR-Drop direct file transfer handshakes, anti-phishing heuristic evaluations, and GS1 barcode price queries.

3. QR-Drop P2P File Transfer Security

Files transferred via QR-Drop are end-to-end encrypted during transit and exist only in an ephemeral session between sender and recipient.

Files are never retained permanently on central servers. Once downloaded or upon 1-hour session timeout, all intermediate buffers are completely destroyed.

4. Anti-Phishing Security Checks

Scanned URLs undergo instant threat analysis to shield users from fraudulent sites. Checks use anonymized cryptographic hashes and are never tied to individual user profiles.

5. User Rights and Data Protection Officer Contact

Under GDPR and global privacy frameworks, you retain the right to access, rectify, port, and permanently delete your personal data.

For any privacy inquiries or assistance with data erasure, please contact us at support@rowaqr.app.