Privacy Policy
Fast QR Scanner & Generator
This policy covers the app Fast QR Scanner & Generator, published by Wishmon Inc. M8M Labs, which appears as wishmon on Google Play and as M8M Labs on the App Store. In this policy, "we" and "us" mean Wishmon Inc. M8M Labs.
Last updated: 5 October 2026
The short version
What your codes say never reaches us. There is no account and no server of ours, and nothing the app sends can carry the contents of a code. It stays on your phone, and in your own device backup if you use one - see below.
The app does send two other kinds of thing, on both platforms. It reports which screens you open and which kind of code you make - a URL, a Wi-Fi network, a contact - to Google Firebase, and it reports a stack trace if it crashes. What it can report is a fixed list; there is no way for text you scanned to become part of it.
One further thing is not ours and is worth saying plainly: on Android the app reads codes with Google's ML Kit, which sends Google diagnostic information about the scan - device and app details, an installation identifier, and performance figures. Google publishes what that includes and offers no way to switch it off. It never includes what a code says. On iPhone the reading itself is done by Apple's own Vision framework, which sends nothing.
What the app can access, and why
Camera. Used only to read QR codes while you are looking at the scan screen. Frames are decoded on the device as they arrive and are never recorded, stored, or transmitted. The camera is shut down as soon as you leave that screen.
Photo library, reading — the app never asks for this. Tapping Album on the Scan tab opens your phone's own picker, which runs outside this app and hands back only the file you chose. The app cannot see the rest of your library and does not ask to. The picture you pick is decoded on the device and not kept.
Photo library, adding. Asked for the first time you save a code you made, and it is permission to add a photo rather than to read one - your phone grants no ability to look at what is already there. It writes that one image and nothing else.
The app never opens the camera or your photo library on its own.
What the app stores
Your history - the codes you have scanned and created - is a single file inside the app's own private storage on your device. No other app can read it, and we never receive it. It is removed from the phone when you uninstall the app.
Anything you type into a note goes in the same file. Every history entry takes a note, and that is the one place in the app where the text is yours rather than something a code contained. It is stored, backed up and exported exactly like the rest of the entry, so it is worth knowing that a note is not a private annotation kept somewhere separate - it travels with the code it is attached to.
Your phone's own backup includes that file. If you have iCloud Backup on iOS or Google's backup on Android switched on, the history goes with everything else the phone backs up - to your account, encrypted, under your control, and never to us. That is what restores your history when you set up a new phone. It also means the file can outlive an uninstall inside that backup, and that anything a code contained - a Wi-Fi password, a contact - is in there with it. Turning the backup off is a setting on the phone, not in this app.
You can export that history to a file yourself, delete individual entries, or clear all of it, from within the app. An export leaves the app's protection. The file it writes is an ordinary JSON file wherever you save it, readable by anything that can open a file on that device and by anyone you send it to, and it carries the full text of every code and every note. That is the point of an export, and it is the one action in this app that takes your history out of the place nothing else can read.
What the app sends
Never the contents of a code, and never anything parsed out of one - not a URL, not a Wi-Fi name or password, not a phone number, email address or contact. Scanning and creating both work with no network at all: the code-reading model is built into the app rather than downloaded.
Four things do use the network, and none of them carry your codes:
Firebase Analytics and Crashlytics, on both platforms - only if you agree. Both are switched off in the app as shipped. The first time you open it, it asks whether to send anonymous usage data, and nothing is collected unless you say yes: a refusal means the data was never gathered, not gathered and then deleted. You can change your mind either way in Settings, and turning it off stops collection from that moment.
With it on, the app reports which screen you opened and which kind of code you created, chosen from a fixed list - website, Wi-Fi, text, contact, email, phone, SMS, location - which action you pressed on a result, and that the camera saw a barcode of the kind this app does not read (never what it said). It reports a stack trace if it crashes. Firebase also assigns an identifier for this installation of the app, which is not the advertising identifier and does not follow you into other apps; the app removes the Android advertising-ID permissions that Firebase would otherwise add. None of these reports can contain what a code says: the only values the app is able to send are the names on that fixed list, and there is no way to pass free text through.
Google's ML Kit, on Android only. The library that reads the codes reports diagnostics to Google: device model and operating system, the app's identifier and version, an identifier for this installation, how long a scan took, and error codes, and where in the frame it thought a code was. Google describes this at ML Kit's Android data disclosure and provides no setting to disable it, so this app cannot disable it either - this is the one thing on this page that the usage-data switch does not reach. It does not include the contents of any code.
Update and rating prompts, on Android only. Once a session the app asks Google Play whether a newer version of itself exists, and if you have used the app enough it asks Play to show its rating sheet. Both say which app is asking and nothing about you.
Links you tap. Opening a scanned link hands it to your browser, and from that point your browser's privacy policy applies. It is never automatic.
Children
The app is suitable for all ages and is not directed at children. It asks everyone the same question and collects the same two things from anyone who agrees - which screens are used and crash reports - and never the contents of a code, so nothing a child scans is collected either.
Changes
This policy is updated before a version that changes what the app sends is published, and the change is described here. The most recent change did not alter the app at all: it corrected this page, which said your history never leaves your phone when the phone's own backup had been carrying it all along. The app behaves as it always did; the sentence was wrong. Before that, Firebase Analytics and Crashlytics were put behind the consent question described above; earlier still, both ran from first launch.