Acceptable Use Policy

Summary

Don't use QRdx to trick, harm or exploit the people who scan your codes: no phishing, malware, scams, illegal goods, spam, deceptive redirects or impersonation.
Don't attack or overload QRdx, and don't get around its limits or safety checks.
We check links automatically, review reports, and switch off codes or suspend accounts that break this policy. That's the one reason we ever stop a code.
See something that breaks it? Report it.

Who and what it covers

This policy is part of the Terms of Service. It applies to everyone who uses QRdx and to all Customer Content: where your codes point, your hosted pages and forms, your files, the themes you publish, your prompts to AI features, and how you use the API, CLI and MCP server. "End Users" means the people who scan your codes or use your pages.

Banned content

Your codes, pages and files must not lead to, contain or promote:

Phishing: fake login, payment or parking pages, or any page made to collect passwords, card numbers, one-time codes or other credentials under false pretences.
Malware: viruses, spyware, ransomware, unwanted software, or links that start a download End Users didn't expect.
Scams and fraud: fake giveaways, investment or crypto schemes, fake invoices or fines, advance-fee fraud, or fake shops.
Illegal goods and services: for example illegal drugs, weapons or explosives where they are illegal, counterfeit goods, stolen data, or anything else illegal where you or your End Users are.
Betting or gambling services.
Sexually explicit or adult content.
Child sexual abuse material, or any content that sexualises minors. We report it to the authorities and close the account.
Intimate images shared without consent, including fake or generated ones.
Hate speech, harassment or violent extremism: content that attacks people for who they are, threatens them, or promotes terrorism.
Infringement: pirated content, or content that infringes someone's copyright, trademark or other rights.
Private information about someone published without their permission (doxxing).

Banned uses

Deceptive redirects. Don't hide where a code really goes: no switching a reviewed destination to a harmful one, no cloaking (showing reviewers one page and End Users another), and no chains of redirects or URL shorteners used to disguise a destination.
Impersonation. Don't pretend to be another person, a brand, a bank, a government body or QRdx, including through a custom domain, a hosted page or a lookalike domain.
Spam. Don't use codes, short links, forms or email notifications for unsolicited bulk messages, link spam or search-engine manipulation, and don't mass-create codes or accounts to do it.
Collecting data unfairly. Don't use forms to ask for passwords, full card numbers, government ID numbers or health data. Collect personal data only with a legal basis and a clear notice, and only add tracking pixels with consent where the law requires it. See the Data Processing Addendum.
Attacking the Service. Don't probe, scan or test QRdx for vulnerabilities except under our Security policy, and don't try to reach other customers' data, overload the Service or disrupt it.
Getting around limits. Don't use several accounts, rotating addresses or automation to avoid plan limits, rate limits, new-account checks or a code we've switched off, and don't use QRdx as a free redirect checker or image host at scale.
Misusing AI features. Don't use AI themes or AI art to make content this policy bans, realistic fakes of real people, or other people's trademarks and logos without permission, and don't try to get around the models' safety filters.
Breaking the law, including export controls and sanctions.

How we enforce it

Automatic checks.

Destinations of new and edited dynamic codes are checked with Google Web Risk and offline checks. Links listed as malware, phishing or unwanted software, and dangerous link types, are refused.
Accounts in their first 7 days can create up to 30 dynamic codes an hour, and their codes pointing to URL shorteners, bare IP addresses or lookalike domains stay switched off until a person has reviewed them.

Reports. Anyone can report a code without an account. A reported code whose link Google Web Risk lists as harmful is switched off immediately. A person reviews every report within 24–48 hours.

What we can do, depending on how serious the case is:

hold a code for review;
switch off a code or page, for everyone who scans it; codes we switch off can't be switched back on by their owner;
block a file and delete its contents;
remove a community theme;
suspend or close the account;
report illegal content to the authorities when the law requires it or people are at risk.

We act only on abuse, never on billing: see the Never-Hostage Guarantee. When we can, and when it's safe and lawful, we tell the account owner what we did and why.

Appeals

If you think we made a mistake, email support@qrdx.dev with "[appeal]" in the subject and the code's short link or the account's email address. A person looks at it again and replies.

Changes: 1 November 2026. First version, bringing together the rules from the Terms of Service and the abuse report page, with the safety checks QRdx runs today.