Some do. Decoding a QR code happens entirely on your phone and needs no connection, so a scanner app doesn’t have to send anything anywhere. Plenty of free ones send data anyway, through advertising SDKs, analytics, a scan history synced to an account, or a link check that posts every address you scan to a server. Which of those applies is disclosed on the store listing, in the App Store privacy label or the Google Play Data safety section, and it’s worth 30 seconds before you install.
The FBI’s advice on QR scams goes further and suggests skipping scanner apps entirely, since most phones have a scanner built into the camera app. That’s a reasonable default, and it’s the honest starting point for any article about scanner apps, including one on an app maker’s own blog.
What a QR scanner app can see #
- The camera feed. Frames go through a decoder. A well-built app analyses them on the device and keeps nothing.
- Everything you scan. Links, Wi-Fi passwords in plain text, contact cards, ticket numbers. The decoded content is the sensitive part, not the image.
- Photos, if you scan from the gallery. Apps using the system photo picker only receive the image you pick. Apps that ask for full library access can see more.
- The clipboard, if it has a paste button. That should happen when you tap, not in the background.
- An advertising ID and your IP address, if it shows ads.
- Your history, if the app keeps one, and wherever it stores it.
The four ways scanner apps collect data #
Advertising SDKs #
This is the common one. Free scanners are usually funded by ads, and the ad network’s code inside the app requests ads using a device advertising identifier, your IP address, the approximate location derived from it, and how you interact with the ads. That’s separate from the app developer seeing your scans, and it’s what the “Data used to track you” section of an App Store label is about.
Analytics #
Crash reporting and usage analytics are normal in apps. Less normal is analytics that records what you scanned or how often, which is content rather than usage.
Accounts and cloud history #
Some scanners sync your history so it follows you between devices. That means your scans are on someone’s server, subject to their retention and their breaches. A scanner does not need an account to work, so treat a sign-up requirement as a question to answer rather than a feature.
Server-side link checks #
An app that promises to check links against a database of dangerous sites has to send those links somewhere to be checked. That may be a fair trade, since a blocklist catches known phishing sites and an on-device check can’t. But it does mean the URLs you scan leave your phone. Nothing in either arrangement is inherently dishonest; the difference should just be visible to you.
Separately, the code itself can do some of the tracking. A dynamic QR code routes every scan through the provider’s server before forwarding you, so that scan is logged no matter which app you used. Static vs dynamic QR codes explains how to tell them apart.
How to check an app before you install it #
- Read the Google Play Data safety section. It’s on the listing, and developers have to declare what they collect, what they share, and whether collection is optional. Google notes that it does not independently verify these disclosures, and that data which stays on the device doesn’t have to be reported at all.
- Read the App Store privacy label. Apple requires developers to declare data in three buckets: data used to track you, data linked to you, and data not linked to you. Tracking has a specific meaning there: linking your data with third-party data for advertising, or handing it to a data broker. These labels are self-declared too.
- Look at the permissions. A scanner needs the camera, and photo access only if you scan screenshots. Contacts, location, phone and full storage access are not required to read a square.
- Check whether an account is required. If it is, ask what’s being stored on the other end.
- Check where history lives. “Synced” and “backed up” mean a server. “On device” means your phone.
- Find the privacy policy. A real developer has one, at a working address, describing the ad network by name.
How to reduce what any scanner collects #
- On iPhone, use Ask App Not to Track. Apple’s setting stops an app from accessing the advertising identifier, and you can review it per app under Settings > Privacy & Security > Tracking, or turn off the requests entirely.
- On Android, reset or delete your advertising ID under Settings > Google > Ads, and turn off ad personalization.
- Grant the camera, refuse the rest. Revoke anything else in your phone’s app settings; the related feature simply stops working.
- Turn off history, or clear it. A scan history is genuinely useful for finding a code you read last week, but it’s also a log of where you’ve been. If the app keeps one, make sure you can delete it.
- Use the built-in camera for one-off scans, which is the FBI’s suggestion, and keep an app for the things the camera can’t do.
What QR Handler collects #
QR Handler is our app, so judge this against its privacy policy rather than our description of it. It runs no servers and has no accounts: scan history, created codes, labels, favorites and settings are held in local storage on the phone, and “Clear all data” in Settings removes them. Camera frames are analysed on the device, and no photos or video are captured or uploaded. The photo picker only hands over the image you choose, the clipboard is read only when you tap Paste, and contacts or calendar entries are written only when you tap to add one, never read. The link safety check, which names the real host and flags plain http, shortened links, raw IP addresses and look-alike characters, runs offline.
Two actions do reach the internet, and only when you tap them: Reveal destination asks a shortened link’s server where it leads, so that operator sees a request from your device, and Search product opens a web search for a barcode number.
The honest limit is the ads. QR Handler is free and supported by Google AdMob, so the ad SDK may collect device information including an advertising identifier, IP address, approximate location derived from it and ad interactions. In the EEA, the UK and Switzerland the app shows Google’s consent form before requesting an ad, and on iOS it asks for App Tracking Transparency permission. Those choices are yours to change at any time. An app with no ads at all collects less, and that’s a fair reason to prefer one.
Privacy and safety are different problems #
An app that collects nothing still can’t tell you whether the site behind a code is a scam. The FTC’s guidance on QR codes is about the destination: inspect the URL for misspellings or a switched letter before you open it, and don’t scan codes you weren’t expecting. A private scanner that shows you the full address helps with that; it doesn’t replace it. See checking a QR code before opening it, and the best QR code scanner app for how the options compare.
Frequently asked questions #
Do QR code scanner apps store what I scan? #
Many keep a history. The question is where. On-device history stays on your phone and disappears with the app; a synced or account-based history lives on the developer’s server. The store listing’s Data safety section or privacy label should say which.
Is the built-in camera more private than a scanner app? #
Usually, because it has no advertising SDK and no history to store. The FBI recommends using it for that reason. A scanner app earns its place only if you need something the camera doesn’t do, like previews with link warnings, barcode support or a code generator.
Can a QR scanner app see all my photos? #
Only if you grant full library access. Apps that use the system photo picker receive just the image you select. Check the photo permission in your phone’s settings and set it to selected photos or off if you don’t scan from the gallery.
Do free QR scanner apps sell my data? #
Free apps are usually ad-supported, which means an ad network receives device identifiers and ad interaction data rather than your scans. Whether anything is shared more widely is what the “data shared with third parties” disclosures are for. Neither store verifies those declarations independently.
Does the owner of a QR code know that I scanned it? #
Not from a static code, since no server is involved in reading it. If you open a link, the website sees an ordinary visit, and any tracking parameters in the address tell it which poster or campaign you came from. A dynamic code’s provider logs the scan as it redirects you.