PRIVACY POLICY
Your privacy at Q-L
Last updated October 1, 2026
Quantum Leap (Q-L) connects a code on a diamond tag to content that can change. This policy explains what Q-L records when you visit q-l.co, scan a tag or use a Q-L account, why we record it, and the choices you have. Q-L is operated by PhotoScribe Technologies Inc. (“PhotoScribe”, “we”, “us”).
IN SHORT
- You can scan a tag without an account. We count scans by tag, time, type of device, browser and country. We do not store IP addresses and we do not record who scanned.
- What a tag opens is public. Anyone who scans the tag can see it, so keep private documents off your tag.
- An account holds your name, your email address and your password in a protected form that we cannot read.
- No advertising, no tracking across websites, and we never sell personal information.
- Our cookies only keep you signed in, protect forms and carry short notices from one page to the next.
Who is responsible
PhotoScribe Technologies Inc. operates Q-L at q-l.co and at the store addresses ending in .q-l.co, and is responsible for the personal information described in this policy. You can reach us at contact@q-l.co.
Stores (jewelers, houses and brands) that use Q-L decide what their tags open and to whom they give access. They are responsible for the content they attach and for the email addresses they enter.
When you scan a tag
Each time a tag is opened, by scanning the code on its card or by typing its address, Q-L records:
- the tag’s code and the date and time;
- the result: the tag opened its content, showed its setup page, was paused, or was not a registered code;
- the type of device (phone, tablet, computer or automated program) and the browser family, such as Safari or Chrome. We work these out from the identification your browser sends, then discard it;
- the country, as a two-letter code provided by our network provider.
We do not store your IP address, your browser’s full identification or anything else that identifies you. A scan is not linked to your account, even when you are signed in.
When you scan a code that is not a Q-L code, such as another company’s QR code, a Wi-Fi code or a contact card, nothing is recorded. When a code looks like a Q-L code (letters and digits only) but is not in our registry, we record the code as scanned, so that we can help with mistyped codes and notice attempts to guess codes.
The scanner at q-l.co/scan reads codes inside your browser. The camera image, and any photo you choose, stay on your device. Only the code that was read is sent to us.
The people who manage a tag see how often it was scanned. The store that manages a tag sees its scan statistics. PhotoScribe sees all scan records.
What a tag opens is public
A tag can open a web address, a message, or a photo, video or document uploaded to Q-L. Anyone who scans the tag, or knows its address, can see it. Uploaded files are stored on our servers with their file names.
Please do not attach anything you would not show a stranger, such as an appraisal that includes your home address.
Accounts
You need an account to set up or manage a tag or a store. For each account we keep:
- your name, your email address, and your password in hashed form (Argon2), which we cannot read or recover;
- for the administrator of a store, the phone number given when the store was registered;
- when the account was created, when you last signed in and whether your email address is confirmed;
- the tags you manage and the stores you belong to.
For a store we also keep the details entered when it was registered, or later by the store or by Q-L: the store’s name, web address, contact name, contact email, phone number and postal address, the terms agreed with Q-L, and our own notes.
When a store gives a customer access to a tag, it enters the customer’s email address and we email that person a link to the tag. If the person has no Q-L account yet, the address is kept with the tag as an invitation until they create one. The tag’s history keeps a record of the access given.
Tag history
Every tag keeps a history of the changes made to it, such as a new destination or access given to someone. Each entry includes the email address of the person who made the change, the email address of anyone given or losing access, and, for a new destination, the earlier one (a web address, a message or a file name). The store that manages the tag (including a store that receives the tag later) and PhotoScribe can see this history; the tag’s individual owner does not. The history stays with the tag, including after an account is deleted, so the record of who changed what remains complete.
When you replace or remove an uploaded file, the file itself is deleted. A rolling list that is switched off keeps its files, unpublished, until they are removed or the tag is cleared.
We send email only when it is needed for your account or a tag: to confirm your address, to reset your password, and to tell you that you have been given access to a tag. If this policy changes significantly, we may also email account holders about it. We do not send newsletters or advertising.
If you write to contact@q-l.co, we keep your message and our reply so that we can help you.
Cookies and storage in your browser
| Name | What it does | Kept for |
|---|---|---|
ql_session | Keeps you signed in. Set when you sign in, register or reset your password. | 30 days, or until you sign out |
ql_csrf | A random code that protects forms from misuse by other websites. It contains nothing about you. | 1 year |
ql_flash | Carries a short notice, such as “Saved”, to the next page. | 1 minute |
ql-theme | Browser storage, not a cookie. Remembers whether you chose the light or dark look. It is never sent to us. | Until you clear it |
These are needed for Q-L to work, so we do not ask for consent. We use no advertising, analytics or social media cookies, and our pages load no scripts from other companies. Our network provider, Cloudflare, may add its own protection: a security cookie (for example __cf_bm) that tells people apart from automated traffic, or a small script that hides email addresses on a page from address-collecting programs.
Because we do not track visitors across websites, every visitor is treated the same whether or not the browser sends a Do Not Track or Global Privacy Control signal.
Service providers
We use a small number of companies to run Q-L. They handle information only on our behalf:
- Railway (hosting) runs the Q-L application and stores its database and uploaded files in the United States (Virginia).
- Cloudflare (domain and network services) runs the q-l.co domain name, can carry and protect traffic to the site, and forwards email sent to contact@q-l.co. When it carries traffic, it sees visitors’ IP addresses.
- Resend (email delivery) sends our account emails. It receives each recipient’s address and the message.
These providers may keep IP addresses in short-lived security and delivery logs under their own policies. The Q-L application itself does not store them.
When we share information
We do not sell or rent personal information, and we do not share it for advertising. We disclose it only to the service providers above; when the law requires it; to protect Q-L, its users or the public against fraud, abuse or harm; or to a company that takes over Q-L, which would remain bound by this policy.
How long we keep information
- Accounts: until the account is deleted.
- Store details: while the store uses Q-L. When a store stops, we delete its details, or keep only what its remaining tags or the law (for example for business records) require.
- Scan records: for as long as Q-L runs, to show statistics over time. They contain nothing that identifies the person who scanned.
- Tags, their content and their history: a tag’s code is permanent and is never deleted or issued again. Its content stays until it is changed, or until the tag is cleared for a new owner, which removes the content from the tag. The history keeps earlier web addresses, messages and file names.
- Confirmation and password reset links: single use and stored only in hashed form. A confirmation link is valid for 72 hours, a password reset link for 2 hours.
- Server logs: kept by our hosting provider for a limited time for troubleshooting. They record the pages requested, without anything typed or scanned into them, and some administrative actions with the email address of the account that made them. They do not include IP addresses.
Your choices and rights
Your account page shows your name, your email address and whether it is confirmed, your tags and your stores, and lets you change your password. You can change what your tags open at any time. To remove it entirely, ask the store that supplied the tag, or us.
To get a copy of your information, correct it, or delete your account, email contact@q-l.co from the address on the account. We reply within 30 days. Deleting an account releases the tags it managed. The tags and their history remain, because a tag belongs to the jewelry rather than to an account; if you also want the content of your tags removed, tell us and we will clear it.
Depending on where you live (for example in the European Union, the United Kingdom, California or Israel), you may have further rights, such as to object to certain uses or to complain to a data protection authority. We will respect them where they apply.
Legal bases (European Economic Area and United Kingdom)
We use account and store information to provide the service you signed up for (performance of a contract). We keep scan statistics and tag histories because we and the stores have a legitimate interest in knowing how tags are used and in protecting the registry from misuse. We keep business records where the law requires it (legal obligation).
Security
Connections to Q-L are encrypted (HTTPS). Passwords are hashed with Argon2, sign-in sessions are signed and expire, forms are protected against requests from other websites, and only authorized people can change a tag. No system is perfectly secure. If a breach affects your information, we will notify you as the law requires.
Children
Q-L is not intended for children. We do not knowingly create accounts for anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.
Where information is stored
Q-L is run from the United States and its data is stored there. If you use Q-L from another country, your information is transferred to the United States, where privacy laws may differ from those where you live. Where the law requires safeguards for this transfer, we rely on the data protection terms our providers offer, such as the European Commission’s standard contractual clauses.
Changes to this policy
We will post any change on this page with a new date. If a change is significant, we will also email account holders before it takes effect.
Contact
PhotoScribe Technologies Inc.
contact@q-l.co