Privacy Policy

Last updated: 1 March 2026

1. Who We Are

QR Trail is a UK-based family project that provides interactive QR code treasure hunt kits and related digital tools.

At this stage, the service is operated privately by an individual based in the United Kingdom. If the project becomes a registered business, this policy will be updated accordingly.

For privacy enquiries, please contact

Email: admin@creative-classroom.co.uk

For the purposes of UK data protection law, we act as the Data Controller for personal data processed through this platform.

2. What Information We Collect

We collect only the minimum data necessary to operate the service.

A. Account Information (if you register)

Email address

Password (stored securely as a one-way hash)

B. Player Nicknames (Optional)

A nickname chosen by the player

A randomly generated player identifier stored in a cookie

We strongly discourage the use of real names in nicknames.

C. Kit & Trail Data

When managing a kit

Kit ID

Trail configuration

Clue text

Reveal codes

Scan events (timestamp, QR number triggered)

D. Technical Data

For security and diagnostics

IP address

Browser type (user agent)

Basic request logs

This information is used only for platform operation and abuse prevention.

3. How We Use Your Information

We use collected data to

Provide and operate the QR Trail platform

Display leaderboards (if enabled)

Validate QR scans and reveal clues

Prevent fraud and misuse

Improve reliability and performance

We do not sell personal data. We do not use advertising trackers.

4. Cookies

We use essential cookies for

Session management

Storing a player identifier

Storing a nickname (if chosen)

These cookies

Are used only for platform functionality

Do not track users across other websites

Do not contain sensitive personal data

You may delete cookies at any time via your browser settings.

5. Children’s Privacy

QR Trail may be used by children during supervised events.

We do not request or require

Dates of birth

Home addresses

Contact details

Real names

Nicknames are optional and should not include personal information.

Parents, teachers, or organisers are responsible for supervising child participation.

If you believe personal data has been entered inappropriately, please contact us and we will remove it.

6. Lawful Basis for Processing

Under UK GDPR, we rely on

Legitimate Interests – operating and securing the platform

Contract – where account functionality is provided

7. Data Storage & Hosting

Data is hosted on a Virtual Private Server located in the United Kingdom.

We implement security measures including

HTTPS encryption

Secure cookies

Content Security Policy (CSP)

Server-side validation

Access controls

8. Data Retention

We retain data only as long as necessary

Account data: until account deletion

Trail configuration: until deleted by organiser

Scan logs: retained for operational and security purposes

If you would like data removed, please contact us.

9. Payments (Future Shopify Integration)

If online payments are introduced, they will be processed securely via Shopify.

QR Trail will not store card details. Payment information will be handled directly by Shopify in accordance with their privacy policy.

This policy will be updated before any payment processing goes live.

10. Your Rights

Under UK data protection law, you have the right to

Access your personal data

Correct inaccurate data

Request deletion

Object to processing

Lodge a complaint with the Information Commissioner’s Office (ICO)

ICO: https://ico.org.uk/

11. Updates to This Policy

We may update this Privacy Policy as the project evolves. The latest version will always appear on this page.