NFCMagic Privacy Policy

Core app access does not require a named account

NFCMagic's core NFC and QR tools do not require you to create a profile with a name, email address or password. Optional public web experiences can still process technical information such as a visitor's public IP address, and a restaurant may publish its business phone number or receive a table number with an order.

Who controls your data

NFCMagic is published by TrustQR Ltd, registered in England and Wales, Company No. 17272910, Registered Office: 2, Frederick Street, Kings Cross, London, WC1X 0ND, United Kingdom. TrustQR Ltd is the data controller for any information described in this policy.

What stays on your device and never leaves it

The following is stored only in the app's local database on your phone and is never uploaded anywhere unless you personally choose to export or share it:

• NFC scan history (tag UID, tag type, decoded NDEF records, timestamps).
• QR scan and QR generation history, including generated QR images.
• Saved write payload profiles, task profiles, business card profiles and tag cycle definitions.
• App preferences such as your selected plan and feature toggles.
• Free-plan counters: how many QR codes you have generated, bonus QR credits earned from optional reward videos, and daily ad-frequency counters. These stay on the device and are not included in Android cloud backup.

Camera frames used for QR scanning are processed on-device using ML Kit's barcode scanner. Photo or video content is never uploaded to TrustQR Ltd or anyone else for this feature. Reading, writing and inspecting NFC tags in the Read, Write, Tools, Batch Write, Tag Emulation and Memory Dumps areas all happen entirely on-device; none of it touches our servers.

Optional cloud features and anonymous app access

Dynamic Smart Tags, Tag Cycles, AI Tap Studio, Business Analytics, Trackable QR Codes and Restaurant Menu Maker need backend services because their content must be published, updated, measured or managed across devices. Where NFCMagic uses anonymous authentication, a random identifier lets the app find the owner's cloud records without requiring a conventional named account.

• Dynamic Smart Tags and Tag Cycles (Cloud Firestore): if you use these features, the tag's label, destination URL or task actions, and scan count are stored under your anonymous identifier so the same tag can be updated later from any session.
• Device integrity check (Google Play Integrity via Firebase App Check): the app asks Google to attest that requests come from a genuine, unmodified install of NFCMagic. This exchanges device integrity signals with Google; it does not share your NFC or QR content, and no personal information is involved.
• AI Tap Studio (Firebase AI / Google Gemini): fully opt-in. Only when you actively use Build, Explain, Check URL or Suggest mode does the text you typed or pasted get sent to Google's Gemini model to generate a response. Do not paste passwords, secret keys or another person's private information into an AI Tap Studio prompt.
• Automation connectors: if you configure a webhook, Home Assistant or MQTT-style connector, NFCMagic sends the tag UID, a timestamp and your configured payload template to the destination URL or broker you entered yourself. You control that destination; TrustQR Ltd does not operate it and never sees the data that flows through it.
• Product authenticity verification: if your organisation configures a verification endpoint for NTAG 424 DNA product checks, the scanned tag's encrypted PICC data is sent to that endpoint to confirm a genuine, counterfeit, pending or tamper result. This is a tag-level cryptographic check, not something that identifies you personally.
• Trackable QR Codes: each open can record the scan date and time, the scanner's public IP address and available technical details such as device type, operating system, browser, language, time zone and screen size. If the scanner grants the browser's location request, coordinates and reported accuracy are also recorded. Approximate location may be estimated from the public IP address. Analytics are visible only to the QR owner, and the visitor continues to the intended destination after the scan is recorded.
• App analytics (Google Analytics for Firebase): to understand which features are used and where the app fails, NFCMagic records usage events such as screens opened, "tag read", "tag written", "QR generated", error codes, purchase steps and ad events, together with an app-instance identifier, device model, Android version, approximate country or region and whether you use the Free or Pro plan. NFCMagic never sends tag UIDs, tag or QR contents, URLs, Wi-Fi passwords or contact details to analytics.
• Advertising (Google AdMob) — free plan only: the free plan shows no banners and no unrequested full-screen ads. Its only ads are optional reward videos that you start yourself: one unlocks extra QR codes once your free ones are used up, another unlocks an extra Trackable QR code (up to the free limit). For the Trackable QR video, Google AdMob sends the NFCMagic server a signed confirmation containing your anonymous app identifier and the hashed device key described below, so the extra code can be credited securely. To serve, cap, measure and protect ads against fraud, Google AdMob may collect device identifiers including the Android Advertising ID, IP address, and ad interaction and diagnostic data. Pro users see no ads, and the ads SDK is not started for them. Where the law requires consent (for example in the EEA, the UK and Switzerland) you are asked through Google's consent form, and you can change your choice at any time in More → Privacy choices. You can reset or delete your Advertising ID in Android settings. Learn how Google uses this data: policies.google.com/technologies/partner-sites.
• Push notifications (Firebase Cloud Messaging): a device push token is stored under your anonymous identifier so NFCMagic can deliver alerts you choose to turn on, such as restaurant orders and waiter requests. The token is deleted when it expires.
• Free Trackable QR protection: the free plan includes one Trackable QR code, and reward videos can add more up to a small limit. To stop free codes being claimed again by reinstalling, the app sends a one-way, salted hash of Android's app-specific device identifier when you create it. The original identifier never leaves your device, is unique to NFCMagic and is not used for advertising or tracking.
• Pro purchase verification: when a Pro user creates a Trackable QR code, the app sends its Google Play purchase token to the NFCMagic server, which confirms the purchase with Google Play. TrustQR Ltd never receives your payment card details; payments are handled entirely by Google Play.
• Restaurant Menu Maker and table ordering: published restaurant branding, contact details, menu categories, food information, images, prices and allergy notices are stored so the public menu can be served. Orders can include selected items, quantities, totals, service charges, table number, timestamps and order status. Waiter calls and bill requests are stored so restaurant staff can respond through the app or secure dashboard.

What NFCMagic does not do

• NFCMagic does not require a name, email address or password for core app use. Restaurant business contact details are published only when the restaurant owner adds them to a menu.
• NFCMagic does not use your tag contents, QR contents, URLs, Wi-Fi details or contacts for advertising or analytics, and does not show ads to Pro users.
• NFCMagic does not sell personal data or Trackable QR analytics.
• NFCMagic does not read, store or transmit content from protected access cards, payment cards, passports or transit cards, because Android and the card issuers do not expose that protected content to apps.

Permissions and why the app requests them

• NFC: required to read and write NFC tags, the app's core function.
• Camera: required only for the QR scanner; requested at the time you open that screen, not at install.
• Vibrate: used for haptic feedback when a tag is detected.
• Network state: used to check connectivity before cloud-dependent features such as Dynamic Smart Tags or authenticity verification.
• Notifications: used only for alerts you turn on, such as new restaurant orders and waiter or bill requests. On Android 13 and later it is requested when you turn those alerts on, not at install.
• Internet: used by the optional cloud features, analytics and, in the free plan, the optional reward videos.
• Advertising ID (free plan): added by Google AdMob to serve and measure the optional reward videos. You can reset or delete it in Android settings.

The Trackable QR location request appears in the scanner's web browser, not as a hidden app permission. Precise coordinates are collected only when that visitor grants permission.

Children's privacy

NFCMagic is a general-purpose developer and professional utility and is not directed at children under 13. Restaurant owners and Trackable QR owners should avoid deliberately collecting location or order analytics from children without an appropriate lawful basis and notice.

Data retention and deletion

Local data (scan history, saved profiles and QR history) can be removed from the relevant screen, by clearing app storage or by uninstalling NFCMagic. Cloud records should be deleted from their management screen where a delete control is available. Restaurant owners can manage their menus and operational records through NFCMagic and the secure dashboard. QR scanners or restaurant customers who need help with a stored scan or order record can contact the QR or restaurant owner first, or contact TrustQR Ltd at the address below with the relevant link and approximate timestamp.

International data transfer

The optional cloud features, analytics and advertising described above use Google services (Firebase, Google Analytics for Firebase, Google AdMob and Google Play) and may process data outside your home country. Google's privacy and security practices govern that processing as TrustQR Ltd's service provider. Public IP addresses and permission-based coordinates from Trackable QR Codes can be personal data under applicable law.

Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of personal data. Because cloud records may use an anonymous owner identifier, menu link, QR link, table number or timestamp rather than a named account, include enough information for the relevant record to be located when contacting TrustQR Ltd.

Changes to this policy

If NFCMagic's data practices ever change, this page will be updated and the effective date above will change accordingly.

Contact

Email: privacy@nfcmagic.app
TrustQR Ltd, Registered Office: 2, Frederick Street, Kings Cross, London, WC1X 0ND, United Kingdom.