Privacy and safe use

ScanHook reads QR codes and barcodes and sends their decoded contents to a webhook receiver you choose. Use only destinations you control or have permission to use.

What is processed

• Cloudflare verifies your email identity. ScanHook keeps your email, account approval status, and account timestamps.
• Your saved webhook titles, descriptions, URLs and active status are stored on the server. A URL may contain a secret: treat it as a credential. Saved URL paths and query strings are not returned in the destination list; you can replace a URL by editing it.
• Scan history stores decoded text, type, destination title/ID, time and delivery result. Decoding runs in your browser; ScanHook does not upload or save camera video.
• Your decoded scan, type, timestamp and destination title/ID are sent to your selected receiver. That receiver controls its own storage and processing. Deleting data in ScanHook does not delete copies at the receiver.

Storage and access

Cloudflare hosts the application, login service and database. Your browser stores app-shell files and your selected destination ID for installation and offline display; it does not intentionally cache API responses or queue offline scans. Your account's destinations and history are restricted to your verified email. The administrator can manage account status and delete accounts; account-management screens do not expose other users' scan contents or webhook secrets. The operator's database access is separate from those screen permissions. Webhook URLs are not end-to-end encrypted against the operator.

Limits and deletion

There are account, request, delivery and storage limits. The default is 25 destinations and 1,000 history entries per account; sending stops at the storage limit until you delete entries. Existing history is not automatically erased by this update. You can delete individual entries or clear your history. Ask the administrator to delete your account, destinations and history. A small bounded security audit trail of account changes remains, including the actor and affected email; it contains no scan contents or webhook URLs. Short-lived counters and duplicate-request records expire and are cleaned during use. Database backups can retain prior versions according to the hosting provider's retention settings.

Safe use

Do not scan passwords, payment-card data, health records or other sensitive personal information. Do not use ScanHook to send spam, attack receivers, or access systems without permission. A timeout can mean the receiver accepted a scan but its reply was lost: check the receiver before sending again. ScanHook never automatically retries delivery.

For account or data requests, contact the administrator who provided you access. This page describes the current application; it is not a guarantee of complete security or legal compliance.