QR-Attend is a class attendance system. To do its job — confirm you're in class when you scan a QR code — it needs to know who you are and where the scan came from. This page lists exactly what's collected, who can see it, and how to remove it.
Information we collect
- Your account
- Name, email, hashed password, role (student / instructor / admin), academic level, and the batch you belong to.
- Each scan
- Timestamp, IP address, approximate location coordinates (with accuracy), a soft device fingerprint, and the user-agent string of the browser you used.
- Device security
- If you set up a passkey, we store its public key, credential ID, and signature counter — never the private key, which stays on your device. If you use a PIN, we store its hash.
- Anomalies
- Failed scans, expired QR codes, geofence violations, and similar security events are logged with the same context as a scan.
- Avatar
- A cartoon avatar generated by DiceBear using your email as the seed — no image is uploaded.
How we use it
- Confirm your identity when you sign in or scan.
- Record attendance and calculate per-student percentages, ranks, and trends.
- Detect fraud — off-campus scans, duplicated devices, expired QR codes.
- Notify instructors and admins about who's absent.
- Generate the public leaderboard / standings view inside your batch.
We never sell your data, run advertising against it, or share it with anyone outside the people listed in section 3.
Who can see what
You — everything about your own account and your own scans.
Your instructor — names, emails, attendance percentages, scan times, and anomalies for students in their batch.
Admins — everything, across all batches. Required to operate the system.
Third-party services
- Google Sheets
- Daily attendance is mirrored to a Google Sheet so instructors can keep an external record. Only names and date-by-date present/absent marks are sent.
- DiceBear
- Your browser requests your avatar directly from DiceBear's CDN using a seed derived from your identifier. No personal information leaves your device beyond what DiceBear needs to render the cartoon.
- Railway (hosting)
- QR-Attend runs on Railway infrastructure. They see request metadata (IP, headers) that any web host would see.
Cookies and local storage
- Session cookie
- Keeps you logged in. Signed, HTTP-only.
- CSRF token
- Protects forms from cross-site forgery.
- Device UUID cookie
- Lets the scan endpoint recognize the device you registered with WebAuthn.
- localStorage
- Your dark-mode preference, and the service worker's offline cache of static assets and visited pages — used so the app keeps working when your connection drops.
How long we keep it
Account, attendance, and anomaly records are kept for as long as your account exists. When an admin deletes an account, the database deletes all related rows (attendance, devices, anomalies, absences) in the same transaction.
Your rights
- Access — ask for a copy of everything we hold on you.
- Correction — ask us to fix inaccurate information.
- Deletion — ask for your account and history to be removed.
- Export — ask for your attendance history in a portable format.
Send any of these requests to the contact below. We aim to respond within a few working days.
Jurisdiction
QR-Attend operates under the laws of Ghana, including the Data Protection Act, 2012 (Act 843).
Changes to this policy
We'll update the "Last updated" date at the top whenever this page changes. If a change materially affects how your data is used, we'll notify you in-app before it takes effect.
Contact
Questions, requests, or concerns? Email [email protected] — or use the Need help? page for a form-based message.