Your codes stay on your keychain.

01Who we are

Kodigo ("the app", listed in the stores as "Kodigo: Save Any QR Code" and formerly called QR Keychain) is a phonebook for QR codes and barcodes, most often payment codes such as GCash, BPI, PayNow, Pix or UPI. It is available for Android and iOS and is developed and published by Jan Aguja, an independent developer in the Philippines ("we", "us"). This policy explains what information the app handles, where it goes, and how long it stays there.

Kodigo is not a banking app. It doesn't move money, connect to any bank, or read your transactions. It stores codes you already have, the way a contacts app stores phone numbers.

02What we collect

Nothing that reaches us on its own. There's no sign-up, and no server for your phonebook to go to.

Kodigo has no user accounts and does not include any analytics, advertising or crash-reporting SDKs. We do not collect, and cannot identify you from, your use of the app.

A payment QR code contains personal data about whoever it belongs to: usually their name and an account number, mobile number or payment ID. When you save someone's code, that information is stored on your phone so you can show it again. It is not sent to us. Please only save codes you were given or are entitled to use, and treat them the way you'd treat a contact's phone number.

The only information that ever reaches us is what you deliberately send: an email you write to us, or a redacted format report you review and send from your own mail app (see section 4).

03What stays on your device

Almost everything, kept in the app's own private storage.

The following is stored in a local database and the app's private files on your device:

• Codes. Kodigo stores the decoded data of each code, not a photo of it, along with the details it reads from it (scheme, bank or wallet, payee name, account identifier, amount if the code has one), a label, notes, and which contact it's filed under.
• Photos. A contact photo you add (taken with the camera or picked from your photos, then cropped on the device), and the original photo of a scanned code only if you choose to keep it. Keeping originals is off by default.
• Bank names you teach it. If you name a bank or wallet Kodigo doesn't recognise, that name is saved locally so it applies next time.
• Settings and housekeeping. App Lock and privacy overlay settings, your auto-cleanup preference, a list of images Kodigo has saved to Photos (so it can clean them up), when you last made a backup, and a cached copy of the public bank list.

On iPhone, when you share an image or text to Kodigo from another app, the share extension briefly passes it to the app through a storage area on your device that only Kodigo and its extension can read.

Kodigo does not add its own encryption to this local database. It relies on your phone's sandboxing and device encryption, plus the optional App Lock described in section 8.

04When something leaves your phone

Only when you tap something, and only to the place you pick.

Sharing a code

Share opens your phone's share sheet with an image of the code. For text-friendly codes (such as a Pix "copia e cola" code, a UPI link or a URL) the code's text is included too, and that text contains the payee details encoded in it. It goes only to the app or person you choose. Copy puts a single value, such as an account number, on your clipboard.

Save to Photos

Save to Photos writes an image Kodigo drew into your photo library, so a bank app's "Upload QR" picker can find it. The image shows the code, the bank or wallet, the contact name, and the account number with all but the last four characters hidden. Depending on your auto-cleanup setting, Kodigo later deletes that image again (on iPhone your system asks you to confirm, and the photo stays in Recently Deleted for 30 days). Export original to Photos saves a copy of a kept original photo and is never auto-deleted. Kodigo only ever deletes images it created itself for hand-off.

Backups

Kodigo can export everything you've saved, photos included, into a single .qrkeychain file, encrypted with a passphrase you choose (AES-256-GCM; recommended and on by default). You can turn encryption off after a warning, in which case the file contains your codes in readable form. You decide where the file goes using your phone's share sheet or Save to Files: your own cloud drive, a messaging app, email to yourself. Kodigo never uploads a backup on its own, and we don't keep or have access to any copy. Restoring reads a file you pick with your phone's file picker.

"Help support this QR" reports

If you tap "Help add support for this QR" or "Something's wrong with these details," Kodigo shows you a preview of a report before anything is sent. Names, account numbers, amounts and other personal values are replaced with placeholder characters, keeping only the structure of the code (which fields it uses, its country and scheme), plus the app version, platform and an optional note you can write. No images, contact names or device identifiers are included. Nothing is sent unless you tap Send, which opens your own email app addressed to [email protected] (or your share sheet if no mail app is set up). Kodigo doesn't have a server to receive this itself.

Opening links and calling

For codes that contain a link (a web address, a UPI link and similar), Open hands it to your browser or the matching app. Tapping a contact's phone number opens your phone or messaging app. What happens next is governed by that app or website.

Your phone's own backup

Kodigo doesn't opt out of your operating system's device backup. If you have it turned on, Google's Android backup or Apple's iCloud or computer backup may include Kodigo's database and photos, so they come back when you restore a phone. That backup is made and stored by Apple or Google under your account and their terms; Kodigo never sees it. You can turn it off in your phone's settings.

05Network requests

One small public download. No uploads, no identifiers.

Bank and wallet list. Kodigo ships with a list of bank and e-wallet names built in, and re-downloads it from janapps.com/kodigo/registry.json so newly launched banks and e-wallets are recognised without an app update. It checks when the app starts or returns to the foreground, at most once every six hours, or when you tap "Refresh institution list now" in Settings. It is a one-way download of a small public file: the app sends nothing about you or your saved codes, and the request carries no identifier. The site is served by Cloudflare Pages, which, like any web host, may log the originating IP address and user agent for ordinary traffic and abuse handling. If the download fails, Kodigo keeps working with the copy it already has.

App store. To show the Pro price and restore a past purchase, the app talks to the App Store or Google Play through your phone's own store service (see section 7).

Kodigo makes no other requests of its own. Actions you take yourself, such as sharing, opening a link or sending a report, use whichever app you hand them to.

06Third-party services

No ad networks, no analytics, no billing middleman.

• Apple and Google app stores, for the Pro purchase. See section 7. (Apple privacy policy, Google privacy policy)
• Cloudflare, which hosts janapps.com and serves the bank list. (Cloudflare privacy policy)
• Google ML Kit (Android only). On Android, Kodigo reads QR codes and barcodes with Google's ML Kit barcode scanner, which is built into the app and runs on your device; images and decoded content are not sent to Google. Google states that ML Kit may contact its servers to send diagnostic and usage metrics about the scanner's performance, along with basic device and app information. See ML Kit's terms and Google's privacy policy. On iPhone, scanning uses Apple's built-in Vision framework.

Kodigo does not use Google Sign-In, Firebase, or any other account or cloud service, and we do not sell, rent or share your information with anyone.

07Purchases

Kodigo is free for your first five saved codes. Kodigo Pro, which removes the limit, is a one-time, non-consumable purchase. It talks directly to Apple's StoreKit or Google Play Billing, and the store itself verifies your purchase. There is no third-party billing service, so no intermediary receives your purchase history. Apple or Google handles the payment under its own terms and privacy policy, as with any purchase on those platforms. We never see or store your payment details; the app only learns whether Pro is unlocked. Neither store ever receives your saved codes, contacts, notes or photos.

08Permissions

Permissions that need your approval are asked for only when you first use the feature that needs them.

• Camera, to scan QR codes and barcodes, and to take a contact photo if you choose. Frames are analysed on your device and are never uploaded or saved, unless you choose to keep a code's original photo.
• Photos. Adding a code from an existing photo, or picking a contact photo, uses your phone's system photo picker, which only gives Kodigo the specific photos you pick, never your whole library. Saving to Photos needs permission to add images. On iPhone, Kodigo also asks for photo library access the first time you save, so auto-cleanup can later find and delete the images it created; limited access ("selected photos") is enough. On Android 10 and later no photo permission is needed; Android 9 and earlier asks for storage access to save the image.
• Contacts. "Import from Phone Contacts" asks for contacts permission and then opens your phone's own contact picker. Kodigo copies only the name and photo of the one contact you pick into its own storage at that moment. It doesn't keep a live link to that contact, doesn't sync with it later, and never writes anything to your address book.
• Face ID, fingerprint or device passcode, only if you turn on App Lock. Unlocking is handled entirely by your phone's operating system; Kodigo never sees or stores your biometric data or passcode. The optional privacy overlay hides the app's contents in the app switcher.
• Network access, for the bank list download and the app store.
• In-app billing (Android), so Google Play can handle the Pro purchase.
• Screen brightness and keep-awake (no permission prompt), while a code is on screen, so it's easy to scan. Both go back to normal when you leave.

Kodigo does not request your location, microphone, or access to your whole photo library on Android.

09Retention & deletion

It's your phone, so you're in charge of the delete button.

Everything Kodigo stores lives in the app's private, sandboxed storage on your device and stays there until you remove it. Deleting a code or contact inside the app removes it immediately. Uninstalling the app, or clearing its data through your device's system settings, removes everything. There is no account or server-side copy for us to delete, because none exists.

Copies you made yourself live on outside the app until you delete them: backup files you exported, codes you shared, and images saved to Photos that auto-cleanup hasn't removed (or that you set to "Manually" or "Never"). Your phone's Apple or Google backup follows its own retention. Format reports you email us are kept in our inbox only as long as needed to add support for that code, and we'll delete one on request.

10Your rights

Depending on where you live, including under the Philippine Data Privacy Act of 2012, the GDPR or similar laws, you may have the right to access, correct or delete personal data held about you. Because Kodigo doesn't hold your phonebook on any server, the simplest way to exercise these rights is in the app on your own device. If you're the owner of a payment code someone saved, that copy exists only on their phone and we have no access to it. For anything we do hold, such as an email or report you sent, contact us and we'll respond.

11Children's privacy

Kodigo is not directed at children under 13. We do not knowingly collect personal information from children, and as described above, the app doesn't collect personal information from anyone.

12Changes to this policy

If this policy changes, the updated version will be posted at this address with a new effective date, and any material change will be noted in the app's release notes. If a change affects what data leaves your device, we'll say so plainly. Continued use of the app after a change means you accept the updated policy.

13Contact

Questions about privacy? Email [email protected]. It goes straight to Jan Aguja, independent developer, Philippines.