Effective date: October 24, 2026.
Who this policy covers
This policy describes how pandapicks.shop handles information when you use our website, QR tools and memberships. Contact Panda Picks through our support page with privacy questions or requests.
Business contact address:
8530 Ave Costa Norte, San Diego Ca 92154Free static QR content
The static generator creates your QR code in your browser. It does not send the entered content or logo to the Panda Picks account service. Downloaded codes contain the information you encode. Anyone who scans a shared Wi-Fi code can access its embedded network details.
QR & barcode reader
Images selected for the reader are decoded locally in your browser and are not uploaded to Panda Picks by the reader. Review decoded destinations before opening them; the destination website applies its own privacy practices.
Your account & saved codes
Accounts store your name, email, a password hash, verification status and account history needed for access. Saved dynamic QR codes store a name, destination, design and any optimized logo. Saving an editable code sends that data to the server.
Why we use this information
We use account and saved-code information to provide the service, deliver paid access, protect accounts, prevent abuse, respond to support requests and maintain billing records. Security controls use limited technical identifiers, including hashed rate-limit identifiers derived from an account or request address.
Scans & hosting logs
The application records aggregate redirect counts and daily totals. From this update, it also groups new scans by device, operating system, browser, language and referrer hostname. Country and city are included only when supplied by a server-side GeoIP configuration; otherwise they are recorded as Unknown. The breakdown table does not store raw IP addresses, full user-agent strings, full referrer URLs or individual visitor profiles. These counts can include repeat visitors and unrecognized bots; they are not unique-person counts. Hosting, proxy and email services may maintain logs that include IP addresses and request details.
Aggregate country, network and bot reporting
When enabled by the owner, the server counts public-page GET requests reaching this application, including requests identified as crawlers, previews, monitors or automation. These aggregate request counts do not require browser JavaScript and are separate from consent-based browser measurement. IP addresses are looked up locally in GeoLite databases to estimate country, city and network organization, then discarded by this reporting feature. No individual identifier or raw user-agent string is stored in request statistics. Bot family labels are inferred from user-agent claims and are not verified identities; unidentified traffic is not confirmed human traffic. Network organization is the IP routing network, not proof of the visitor’s employer, identity or precise ISP. Hosting and CDN services may maintain their own logs. Aggregate rows are scheduled for removal after 90 days during collection; inactivity may delay cleanup.
Website visit measurement and email records
When enabled by the owner, local website measurement records consenting public-page visits, the referring hostname and a random browser identifier that rotates each UTC day. A daily keyed hash is stored, not the raw browser identifier or IP address. Browser-day totals are not unique-person totals across days. Private account pages and owner visits are excluded. You can decline or withdraw measurement using Cookie preferences. Local visit records are retained for up to 90 days, with cleanup during collection. Checkout reporting uses account identifiers and checkout handoffs to show possible abandonment; it does not record payment-form contents. Email logs retain recipient addresses, subjects, template types, timestamps and sending status for up to 90 days, with cleanup during sending. Email bodies, verification links and reset tokens are not stored in these logs. SMTP acceptance does not confirm inbox delivery.
Session cookies
Account pages use a secure session cookie to keep you signed in and protect forms. Static QR generation does not need an account. Google measurement may be enabled by the site owner. Advanced Consent Mode can send limited measurements without cookies before storage consent is granted; optional measurement storage is controlled by your choice below.
Google measurement and purchase events
When enabled, Google tags load with analytics_storage, ad_storage, ad_user_data and ad_personalization denied by default. They can send limited cookieless measurements while storage consent is denied, including before you choose or after you decline. Google receives technical connection information, including your IP address, when contacted. Choosing Allow measurement permits measurement cookies and advertising measurement data use; advertising personalization remains disabled. Local browser visit collection still requires consent.
Explicit events contain public page paths and QR download format/mode. Confirmed initial Panda Picks subscription payments can send a transaction identifier, amount and currency to Google Ads and a connected Analytics destination from the signed-in thank-you page. That page does not send our normal page-view or local visit event. Our events omit QR content, logos, account name, email and payment-method details; explicit page locations exclude query strings and fragments. Owner visits remain excluded.
Your measurement choice is stored in this browser for 180 days. Change it using Cookie preferences. Withdrawing consent sets measurement storage and advertising data use to denied and removes accessible measurement cookies; limited cookieless Google signals may continue. Account cookies remain in place. Whop checkout has its own privacy and cookie choices.
Payments & Whop
Whop hosts checkout and manages your payment method and recurring billing. Panda Picks does not receive your card number through its checkout flow. The application stores identifiers and membership details needed to link your Whop access to your Panda Picks account, and checks current access with Whop.
Purchase verification records
We verify signed Whop payment notifications against Whop’s API and retain payment, event, membership and local account identifiers, mode, amount, currency, payment time, verification status and browser event acknowledgement. The purchase tracking table stores no raw webhook body, email, card data or raw IP address. Records are scheduled for deletion after 90 days during billing-worker runs; inactivity can delay cleanup. A browser callback does not prove Google counted or attributed a purchase.
Your email is used for account verification, password recovery and requested account communication. Verification and reset links expire and can be used once. Passwords and API keys are not included in customer email.
Service providers and disclosures
Hosting, email and payment providers process information needed to operate their parts of the service. Whop processes checkout and membership information. When Google measurement is enabled, Google receives limited cookieless signals while storage consent is denied, and fuller measurement when you allow it. We may disclose information when legally required or reasonably necessary to protect users, rights and service security. Providers have their own privacy terms and may process data in countries other than your own.
Retention and security
Account, membership, saved-code and support records are retained for service delivery, account history, security, recordkeeping and legal obligations. There is no single automatic deletion period for all records. Removed QR identifiers are retained so that old printed links cannot be reassigned. Contact us to request a review of data no longer needed.
We use account access controls, password hashing and HTTPS connections to help protect information. No online system can guarantee absolute security. Keep account credentials private and avoid encoding sensitive information in codes you intend to share publicly.
Removing codes & account requests
Removing a dynamic code stops its printed link from redirecting. The application retains a record of removed links so they cannot be reassigned. Removing a code is separate from deleting all account data. Contact support to request a review of your account data or a correction; there is no self-service account deletion in this version.
Your choices and rights
Depending on where you live and the law that applies, you may have rights to request access, correction, deletion or a copy of your personal information, or to object to or restrict certain uses. Contact support to make a request. We may verify your identity and retain information where required or permitted by law. Withdrawing optional measurement consent does not close your account or cancel your membership.
Children
Panda Picks is intended for general personal and business use and is not directed at children under 13. If you believe a child has provided account information without appropriate permission, contact us so we can review and address it.
Policy updates
We may update this policy to reflect changes to the service or our practices. We will publish the current policy with its effective date and provide additional notice where required.
Password-protected QR links
When you protect an editable QR link, we store a one-way password hash rather than the plaintext password. Visitors enter the password on Panda Picks before being redirected. Failed password attempts are rate-limited. A successful unlock is remembered in the visitor’s session for up to 15 minutes; changing the QR password invalidates that authorization. The destination website has its own access controls; protecting a QR redirect does not make the destination itself private.
Uploaded PDFs
PDF uploads are stored on our server outside the public website folder and delivered through active QR links. Files without a QR password are accessible to anyone who has the QR link. Password protection checks access before file delivery, but authorized visitors can download and share the PDF. Replacing or deleting a PDF removes its previous stored file; hosting backups may retain copies under the hosting retention policy. Do not upload sensitive documents you are not entitled to share.