Privacy policy

This policy explains what Cosmic QR collects when you use our website and web app at cosmicqr.co.uk, why we need it, and the choices you have. Last updated 31 October 2026.

Who we are

Cosmic QR is run by COSMIC CODES DIGITAL LIMITED, a company registered in England and Wales (company number 16798563), registered office Fergusson House, 124-128 City Road, London, EC1V 2NJ. We are the controller of your personal data and are registered with the Information Commissioner's Office (registration number ZC279091). Contact us at support@cosmicqr.co.uk.

What we collect and why

What	Why we use it	Legal basis
Name, email and password	To create and secure your account	Contract
Mobile number	One verified UK number per person, to stop fake and duplicate accounts	Legitimate interests
Age check result	Cosmic QR is 18+ only. You do the check before you first connect, post or message (until then nobody can see you). Our ID check partner, Didit, checks a photo of your ID and a live selfie. We use your date of birth once, only to confirm you're 18 or over, and keep just the result; we then delete the check (photos and details) at Didit. If you don't finish, or the check is still being reviewed, we delete it at Didit within a day anyway	Legal obligation and legitimate interests
The days you open the app (the date only, no times or places)	To count how many members come back, so we can improve the app	Legitimate interests
Profile details you add: photo, bio, links, your song, birthday (day and month), your Space	To show your profile to people you choose	Contract
Your business card, if you make one: business name, type of business, logo, cover photo, what you do, area, status line, hours, colour, price list, badges you add (such as insurance or a registration number), a booking link, when you're "Available now", business posts (words, photos, story, how long, where) and a business phone number	To show your card to people you choose and run Get a quote, reviews, the card wallet and Call. The phone number is never shown	Contract
Card wallet, reviews and quote requests: cards you save, reviews you leave (shown with your first name and initial; your photo only to signed-in members), quote messages you send (if the business taps "Write a reply for me", your message goes to Anthropic once to draft their reply) and, only if you tick the box for each, your account email and the mobile number you signed up with (shown only to that business, on that request, so they can reply, call or WhatsApp you)	To keep your saved cards, show reviews on a business's card and pass your quote to the business so they can reply	Contract
Scans, connections, when you met, each connection's level and your own groups of people	To run connecting, your connections list and who sees what	Contract
Posts (words, photos, videos, Space posts), stories, reactions and emojis, ratings, recommendations	To show them to the people you choose	Contract
Story stickers, photo stickers, replies, likes, emojis and comments on stories, and people you tag	Replies and who joined show only to the story's owner; a tagged connection is told. All deleted with the story after 24 hours	Contract
Meet-up wins you choose to share: the meet-up, your photos and words, and the first names and photos of connections who were part of it	Shown to your connections like any post. Only people you're connected with are named; others are just counted. Nothing is shared unless you tap Share	Contract
Comments on posts: your words, replies, likes on comments, and @mentions	Shown to everyone who can see the post. Only the post owner's connections can comment. You can delete your own comments and the post's owner can delete any on their post. Kept until deleted, or until the post is deleted or vanishes. In your data download	Contract
Messages you send to your connections	To deliver them to the person you're talking to	Contract
Phone alerts and emails	To tell you about connections, messages, payments and safety decisions. Alerts never show what a message says	Contract and legal obligation
A few tips in your first weeks (finish your age check, meet your first person, plan a meet-up) and one note if you haven't been back for 2 weeks	To help you get started with the app you joined. Switch them off any time with Nudges in Settings → Notifications	Legitimate interests
Points, levels, streaks, rewards and meet-ups	To run meet-ups, levels, rewards and the leaderboard between you and your connections fairly	Contract
Meet-ups: who you invited, and when each of you scanned the other's code to start and finish	To check a meet-up really happened in person and give points. No location is used	Contract
Go out plans, events and Together groups, only if you choose to share	To tell the connections you choose: the words you type for where or what, the time and who's in. We never track your live location	Consent
Invite links, older connect-from-afar invites and no-signal codes	To connect you with someone you know when you can't scan in person, or when there's no signal. We keep only a scrambled copy of any passcode	Contract
Where you came from when you joined: the name of the app or website that sent you (for example Instagram, or "direct") and the kind of link (an invite link, an Add a friend link, a business card or the website), worked out on your first visit and kept in a cookie for 30 days. Never the full address or anything else about you	So we know which apps bring new members and where to spend our time. Deleted with your account	Legitimate interests
Your username, whether people can find you by username or mobile number, and the searches you make in Find a friend (what was searched and who was found)	To let friends find you only by an exact match, and to stop people trying lots of names or numbers. Searches are kept 30 days	Contract, legitimate interests
Find a business: your business card is listed by trade and area unless you switch it off. While it's listed, your card's own page (business name, trade, area, card, business posts and reviews) can also show up in search engines such as Google	So members and people searching for local businesses can find you, friends' picks first in the app. Switch off "Show my business in Find a business" in Settings → Privacy to take it out of both; search engines can take a few weeks to drop it	Contract
Other QR codes you scan with our scanner (My scans)	To check the link before it opens and keep a list only you can see. Clear it any time	Legitimate interests
Scans you choose to share: the link, what it was, where, your caption, and the link's preview picture or your own photo	Shown to your connections in the feed. We copy the linked page's preview picture into our own storage when you share, so viewers' phones never contact that site. Removed when you delete the post or your account	Consent
Song links you paste (Listening to, and song posts)	We look the song up on Spotify, Apple's iTunes service or SoundCloud to fill in the name, artist and artwork (and, for Apple Music, its 30-second preview). Only the link is sent. The song post keeps the link and those details; no music is stored	Contract
Business stats: that someone opened a business card or saw a business post (once a day each, with the day; visitors are counted by a scrambled code that changes daily, never their address)	To show the business numbers only: opens, views, saves and quotes after a post. The business never sees who	Legitimate interests
Loyalty stamp cards: which businesses have stamped your card, how many stamps, when, and when a reward was given. A business sees your first name, photo, stamps, when you last visited and the rewards you've had, only for its own card, and only after scanning your code in person	To run the business's loyalty card and give you its reward. Deleted with your account (or theirs)	Contract
Payments for the business card subscription	Handled by Stripe. We never see or store your full card number	Contract
Reports and blocks	To keep people safe and act on rule-breaking	Legitimate interests and legal obligation
Reports from visitors without an account (about a shared business card): what they tell us and, only if they give it, their email so we can tell them what we decided. We use a scrambled, daily-changing code made from their connection to stop floods of reports; we never keep their address	To keep people safe and act on rule-breaking	Legitimate interests and legal obligation
A fingerprint of each photo you upload (a code worked out from the picture, not the picture itself)	So a photo we've removed as an intimate image shared without permission can't be posted again. Deleted with the photo, except fingerprints of removed photos, which we keep to stop them coming back	Legal obligation and legitimate interests
Problems you report (what happened, the page you were on, your phone and browser type, an optional screenshot, and whether we may email you)	To fix bugs and tell you when they're fixed	Legitimate interests (keeping the app working)
Messages from the Cosmic QR helper: a weekly prompt (skipped if you've posted that week), a note when you do something for the first time, the monthly recap, and for businesses a weekly tip on your card page and reminders (share a post that's doing well, Available now on a quiet week, a review ask to a customer the day after a stamp or a job you won). At most one a week, never 9pm to 9am, each switched off in Settings → Notifications. We use your activity in the app (posts, connections, meet-ups, stamps, card views) to decide what to send	To help you get the most from Cosmic QR	Legitimate interests (helping members, kept light)
Up for it: what you fancy doing (kinds of meet-up), when (today, tonight or this weekend, then it switches off), whether to show you to people nearby, your area at the time, and asks you send or get (what, a public place, a time, a short note, the answer)	To group you with connections who fancy the same; while it's on, connections you've given the Friend level see your first name, what you fancy and when on their Home (not Work or Public connections); and, only if you turn "Show me to friends of friends nearby" on (after reading the safety guide), to show your first name and what you fancy to people in the same area who share at least one connection with you and turned it on too (they also see the first name of one friend you have in common). Your photo shows to them only if they accept your ask or you accept theirs. Asks show in the app for 7 days and are deleted after 90; reports about them are kept like other reports	Contract; for people nearby, your choice to turn it on
Featured this week / Business of the week: only if you turn on "Cosmic QR can ask to feature my posts" (Settings → Notifications; off to start with), the team may see your recent photo posts in a short list and ask to feature one on the official Cosmic QR card; we may also ask a listed business to be Business of the week. Only with your yes each time; it shows your first name (or business name), the post's photos and words (or your cover photo and card details), and you can take it off any time (it also comes down if you delete the post or your account)	To show the community at its best	Your consent (you say yes each time)
Messages you send us with Contact us on the official Cosmic QR card (the topic, your message, your phone and browser type, and whether we may email you back)	To answer you	Legitimate interests (helping members)
Complaints about how we use your data	To look into them and answer you, as the law requires	Legal obligation
Device data and cookies	To keep you signed in, remember which phones you've checked with a text code, and keep the app secure. The app uses no advertising or tracking cookies. One more cookie, set on your first visit, remembers for 30 days which app or link sent you (just the app's name and the kind of link, as above), so we can count where new members come from; it isn't used for anything else	Legitimate interests (signing you in and security); for the "which app sent you" cookie, our legitimate interest in simple statistics. To stop it, clear this site's cookies or use a private window
Marketing emails, if you opt in	Launch news and updates. Unsubscribe any time	Consent

Your messages

Only you and the person you're talking to can see your messages in the app. They're encrypted while they travel and where they're stored, but they aren't end-to-end encrypted, which means we could technically access them. We only look at messages when a conversation is reported to us or the law requires it. If you report a conversation, the last 20 messages are sent with your report so we can review it. Phone alerts never show what a message says.

Who can see your profile

Nobody can browse or search for profiles. Someone can see yours only after scanning your live code, opening an invite link you sent, or typing your exact username (or your mobile number, if you switch that on in Settings → Privacy). If they don't connect with you, it closes for them after 24 hours. Your connections can keep seeing it until you or they remove the connection. You choose how much each connection sees by giving them a level: Friend (everything, the default), Work (the top of your profile and your business card) or Public (just your name, photo, area and bio). Your Space, stories and Go out plans are for Friends only. People aren't told which level you've given them. People who can open your profile see your level, streak, milestone badges and, unless you hide it, how many connections you have.

Your business card is attached to your profile: business name, logo, cover photo, what you do, area, a status line, hours, a colour you choose, your type of business, a price list, badges you add (shown as "stated by the business": we don't check them, so only add what's true), a main button (Get a quote, Book or Call out), an optional booking link to another site (its own privacy policy applies there), "Available now" while you switch it on, and your business posts (words only, up to 10 photos shown as a swipe or a grid, a before and after photo, or a short video reel up to 60 seconds, with an optional title, how long it took, where and a "price from"). A booking request you receive is kept like a quote request. If you ask us to, we can fill in your business card for you: we tell you in the app when it's done, it's recorded in our admin log, and you check it and switch it on yourself. We may also make a card for a business before it has joined, from details the business gave us or has published itself (business name, logo or photos, what it does, prices, area, business phone and business email), and send the business a private link to it. Only someone with that link can see the card; it's never listed or searchable. If you open the link and tap "This is my business", you sign up with your own mobile, do the age check, and the card moves onto your account. If nobody claims it, it's deleted with its photos 30 days after the link runs out (links last 14 days), and you can ask us to delete it sooner. You can also choose "Just my business": your profile then shows your business card instead, people can't find you as a person (only in Find a business), and you can switch the social side on in Settings → Privacy. A business post shows on your business card, and also in your Social posts if you choose "Also post on Social"; it follows the same rules as your other posts. A business number you add is stored separately and is never shown: when someone who can see your card taps Call, their phone dials it, so it will appear on their phone. A business email you add is kept the same way: it's never shown on the page, and when someone who can see your card taps Email, their mail app opens addressed to it, so they'll see it once they write to you. Your card also has a fixed code that never changes, which you can print. Anyone with your card's code or share link sees the card, projects and reviews, but not your number, your business email or the rest of your profile. While "Show my business in Find a business" is on, your card's own page can also appear in search engines such as Google; your profile, Social posts, Space and messages never do. When a member scans your card's code, or saves it, it goes into their card wallet and they can keep opening it until they remove it. Our own official Cosmic QR card (news, tips and Contact us) is added to every member's card wallet when they join; you can remove it like any other card. Its posts reach every member, so anyone can comment on them: people you're not connected to see only your first name on those comments (no surname, username or photo). When someone saves your card for the first time through another member's link, that member and you each get 5 points (up to 5 a day per sharer), and you see who shared it and how many opened it. If someone that member sent asks you for a quote, you see who sent them, and if you mark the quote "We got the job", that member gets 25 points and you get 10 (at most 5 a week). Your first review of a business earns you 5 points if you've really used them (you scanned their code in person, they stamped your loyalty card or marked your job won, or you saved their card from a friend's link); you can leave up to 3 new reviews a day. The number of cards saved through your links shows as a badge on your profile (Connector, Local Legend, Super Sharer). Reviews can only be left by members who have your card in their wallet (because they scanned your code in person or saved your card from a link someone shared) or who are your customers (you stamped their loyalty card or marked their quote "We got the job"; they can also open your card), one each, and show their first name and initial. If someone asks you for a quote, we keep their message and, only if they tick the box for each, their account email and their mobile number so you can reply, call or WhatsApp them. You can also see who scanned your code in the last 30 days.

With no signal, your phone can show a no-signal code that lasts 24 hours; anyone who scans it only connects once you confirm you met (within 7 days), and at most 10 people can use each code. Only you can see your full connections list, your groups, your card wallet and “My scans”.

The leaderboard only compares you with your connections, so only they see your place and points. You can hide yourself with “Show me on leaderboards” in Settings → Privacy.

Some old data from features we've removed (private notes on connections, and who viewed your profile) is no longer shown or added to. Your old notes are still in your data download, and all of it is deleted with your account.

Who we share data with

We never sell your data. We share it only with providers who help run Cosmic QR, under contracts that protect it:

Supabase (database and logins) and Vercel (hosting)
Twilio (text message checks)
Resend (sending our emails)
Microsoft (our support email inbox, for emails you send to support@cosmicqr.co.uk)
Stripe (payments)
Didit (the 18+ ID and selfie check)
Anthropic (Claude), only for messages you send us with Contact us, problems you report and reports about content (it drafts our reply or sorts a report by urgency for us to check; a person always reads it and decides), and, for businesses, when you tap "Write it for me" (it gets a small copy of your first photo, what you've written and your card's details) or open a quote request (it gets the request and your card's details to draft a reply). Nothing is sent or posted without you. Anthropic doesn't use this to train its models
Apple, Google, Mozilla or Microsoft, if you turn on phone alerts: they deliver an empty alert to your phone, which then fetches the words from us, so they never see what an alert says
Google Safe Browsing, only for links in other QR codes you scan with our scanner, to check they're safe
Spotify, Apple (iTunes) and SoundCloud, only to look up a song link you paste
Spotify, Apple and SoundCloud when a song post shows or plays: the artwork and the music load straight from them (Apple Music previews and SoundCloud play as you scroll; Spotify's player loads when you tap play), so they see your device's internet address as with any website, and their own privacy policy applies
When you share a scanned link, our server fetches that page once to copy its preview picture; the site sees our server, not you

We may share data with the police or regulators where the law requires it. Some providers store data outside the UK; when they do, we use the UK's approved safeguards.

How long we keep it

Your account and profile: until you delete your account
Posts set to vanish: deleted when they vanish; stories after 24 hours
Messages: until you unsend them or delete your account; vanishing messages after 24 hours or 7 days
My scans: until you clear them; we keep your latest 500
Stories, and everything on them: 24 hours
Phone alert sign-ups: until you turn alerts off; queued alerts: 2 days; queued emails: up to 30 days
Points: 12 months (your level remembers the total)
Payment records: 6 years, because tax law requires it. Stripe, our payment provider, keeps these records
Reports about rule-breaking: up to 2 years after the case closes
Problems you report and messages you send with Contact us: screenshots 90 days, the report or message 12 months
Complaints about your data: up to 2 years after we answer

Your rights

Under UK data protection law you can ask to see, correct, download or delete your data, object to how we use it, or withdraw consent. You can download or delete your data any time in Settings. For anything else, email support@cosmicqr.co.uk and we'll reply within one month.

If you're unhappy with how we've used or kept your data, you can complain to us in Settings → Complain about my data, or by email to support@cosmicqr.co.uk. We'll confirm we've received it within 30 days, look into it, keep you updated and tell you the outcome. You can also complain to the Information Commissioner's Office at ico.org.uk.

Under 18s

Cosmic QR is only for people aged 18 or over. If we learn someone under 18 has an account, we close it and delete their data.

Changes

We'll tell you in the app and by email before any important change to this policy.