// Legal

Privacy Policy

Effective May 6, 2026

Ovoo is a product and service designed and developed by Nomad Studio. All trademark and copyright in Ovoo belongs to Nomad Studio. This policy explains what data we collect when you use Ovoo, how we use it, and what control you have over it. We have tried to keep it short and plain.

What we collect

—Account information: your email address and, if you sign in with Google, your name and profile picture.
—QR code data: the destination URLs you provide and the custom slugs you choose.
—Scan analytics: timestamp, country, city (from Vercel edge headers), device type, and browser, recorded each time one of your QR codes is scanned.
—Usage data: standard server logs (IP address, request path, user-agent) retained for up to 30 days.

What we do not collect

—We do not track individual scanners across codes or sessions.
—We do not sell, rent, or broker your data to third parties.
—We do not use your destination URLs for advertising or profiling.

How we use your data

—To provide the redirect and analytics service — showing you scan counts, geographic breakdowns, and device trends for your own codes.
—To authenticate you and keep your account secure.
—To improve reliability and debug issues using aggregated, anonymised logs.

Data storage and security

—Data is stored on Supabase (PostgreSQL, hosted on AWS). Active slug destinations are cached in Upstash Redis for low-latency edge redirects.
—All data is encrypted in transit (TLS) and at rest.
—Row-level security policies ensure you can only access your own codes and scans.

Third-party services

—Google Analytics — we use Google Analytics to understand how visitors use Ovoo. It collects anonymised usage data such as pages visited, session duration, and device type. Google's privacy policy applies to this data.
—Authentication provider — we use a third-party service to handle sign-in securely. It processes your email address and, if you use social login, your name and profile picture.
—Infrastructure providers — we rely on third-party cloud services for hosting, database storage, and edge caching. These providers may process request metadata such as IP address and country as part of delivering the service.

Data retention

—Scan records are retained indefinitely unless you delete the associated QR code.
—Deleting a code permanently removes it and all its scan records from our database.
—You can request full account deletion by emailing us — all your data will be removed within 30 days.

Your rights

—You can export or delete your data at any time from the dashboard.
—If you are in the EU or UK, you have rights under GDPR including access, rectification, erasure, and portability.
—To exercise any of these rights, contact us at the address below.

Contact

—Questions about this policy? Email hello@bynomad.studio and we will respond within 5 business days.