Skip to content
QRSalt
Sign in

Acceptable use policy

What a QR code, a short link or a hosted page may not be used for, and when we switch a working code off.

Last updated 18 September 2026

Why this document exists

We promise that your codes keep redirecting for at least 90 days after you stop paying, and longer while people go on scanning them. A promise like that is only worth something if the exception is written down plainly instead of buried, so here it is: we disable codes used for abuse, whether the account is paid, free, lapsed or dormant. Everything below is that exception, in full.

A QR code is scanned by someone who cannot see where it goes, and a short link hides its destination too. That is what makes abuse here worth taking seriously. This policy applies to everything you do with QRSalt: codes, short links, custom domains, hosted pages, menus, contact cards, forms, uploaded files and pictures, and the API.

Child sexual abuse material: zero tolerance

Never upload, link to or share child sexual abuse material, or anything that sexualises a child. There is no warning and no appeal about the content itself. When we find it or someone reports it:

  • a report in this category hides the picture straight away, before anyone reviews it;
  • the material is taken out of public view, and we keep a fingerprint of it so it cannot be uploaded again;
  • we close the account, and every code in it stops working;
  • we may report it to the authorities and keep what they or the law require us to keep.

We may also use automated tools, our own or our providers', to find this kind of material.

Prohibited uses

Phishing and credential theft

Pages that imitate a bank, a delivery company, a government service, an employer or any other organisation in order to collect passwords, card numbers or personal details. Codes stuck over the top of someone else’s legitimate code - on a parking meter, a menu, an invoice - are the version of this we act on fastest.

Malware and unwanted software

Anything that distributes malware, spyware, ransomware, cryptominers, or software installed without informed consent, including drive-by downloads.

Fraud and deception

Fake shops, advance-fee scams, fake invoices and payment requests, fake charity appeals, counterfeit goods, deceptive investment or cryptocurrency offers, and pages designed to obtain money by misrepresentation.

Spam

Sending our codes or short links in bulk unsolicited email, text messages, direct messages or comments, and link schemes built on them. You may use codes and links in your own marketing only where the law lets you contact the people you send them to.

Abuse of short links and custom domains

Using a short link, a custom link name or a redirect to hide where it really goes: cloaking (showing our checks or reviewers one destination and real visitors another), changing a destination to something harmful after it was checked, redirect chains built to slip past filters, and link names or custom domains that pretend to be someone else, such as a bank’s name or a “login” or “verify” page. You may only connect a custom domain you own or are allowed to use.

Impersonation

Presenting yourself as another person, business or public body, or using a brand, logo or name you have no right to use, in a way likely to mislead.

Illegal content

Content that is unlawful where it is published or accessed, including non-consensual intimate imagery, incitement to violence or terrorism, content that infringes someone else’s copyright or trademark, and the sale of goods or substances you are not licensed to sell.

Harassment and other people’s data

Content that threatens, harasses or exposes a person, such as publishing their private details. Forms that ask for passwords, full card numbers, or health or other sensitive data without a lawful basis and a clear notice to the people answering.

Security abuse

Using redirects to disguise an attack, evade a security filter or reputation system, or chain into an open redirect; and probing, overloading or interfering with our infrastructure or anyone else’s.

Also not allowed

  • Reselling access to our redirects or short links as your own service, without our written agreement.
  • Creating codes or links automatically at a volume that is not plausible use, or using several accounts to get around plan limits or a suspension.
  • Content that is legal but that we are not willing to host or redirect to, such as sexually explicit material on a QR Menu, or material that is gratuitously violent.
  • Anything that breaks the law, or helps someone else break it.

These lists are examples, not a complete list. We decide, acting reasonably, whether something breaks this policy, and we may act on anything that puts people, the service or us at risk, even if it is not named here.

How we enforce it

  • We check destinations against lists of malware and phishing sites when a code or link is created or changed, and again from time to time, because a destination can turn hostile long after it was approved.
  • Uploaded pictures are fingerprinted, and a picture we have removed cannot be uploaded again.
  • Anyone can report a code, a link or a page, with no account and no sign-in, using the report form or by writing to abuse@qrsalt.com. Reports are reviewed by a person. Include the scanned link or the code image and, if you can, where you found it.
  • Confirmed phishing, malware and other clear abuse are disabled immediately, without notice beforehand; we email the account afterwards to say what we did and why. A disabled code serves a neutral page explaining that it has been switched off.
  • We can take down a hosted page or menu, remove a picture, or suspend a whole workspace, which disables every code in it.
  • For anything less clear-cut we contact the account first and give a chance to fix it, unless doing so would put people at risk.
  • Repeat or deliberate abuse ends the account, and the codes stay disabled. In those cases the promise that codes keep working does not apply, and no refund is due. When such an account is later erased, we keep a one-way fingerprint of the email address for two years after the erasure - a keyed hash that cannot be turned back into an address - so that if that address comes up in a later investigation we can see it has been here before. It is a record for us to check, not a block on the sign-up form.
  • We may share information with the authorities and report illegal content, where the law requires it or where we believe someone is at risk.

If we get it wrong

Automated checks make mistakes, and a wrongly disabled code on printed material is a real cost to you. Reply to the notice or write to support@qrsalt.com and a person will look at it. We try to answer appeals quickly and to restore a code as soon as we are satisfied it is legitimate.

Related

This policy forms part of the terms of service. What we record about scans and reports is described in the privacy policy.