Privacy Policy
Fast QR Barcode: Scan & Create
This policy covers the app Fast QR Barcode: Scan & Create, published by Wishmon Inc. M8M Labs, which appears as wishmon on Google Play and as M8M Labs on the App Store. In this policy, "we" and "us" mean Wishmon Inc. M8M Labs.
Last updated: 5 October 2026
The short version
What you scan and what you create never reach us. The app has no account and no sign-in, and it never sends a code, a photo, or your history to us or to anyone else. Your phone's own backup may keep a copy in your Google or Apple account, which is described under What the app stores.
It can send two kinds of anonymous technical data to Google: crash reports, and counts of which features get used. Neither contains anything you scanned, and neither is sent unless you say yes. The app asks once, the first time you open it, and sends nothing at all until you answer - you can change your answer any time in Settings.
What the app can access, and why
Camera. Used only to read QR codes and barcodes while you are looking at the scan screen. Frames are decoded on the device as they arrive and are never recorded, stored, or transmitted. The camera is shut down as soon as you leave that screen.
Photo library, reading — the app never asks for this. Choosing Scan from album opens your phone's own picker, which runs outside this app and hands back only the file you chose; sharing a picture to the app works the same way. The app cannot see the rest of your library and does not ask to. The picture is decoded on the device and not kept.
Photo library, adding. Asked for the first time you save a code you made, and it is permission to add a photo rather than to read one - your phone grants no ability to look at what is already there. It writes that one image and nothing else.
The app never opens the camera or your photo library on its own.
What the app stores
Your history - the codes you have scanned and created, and any note you wrote about one - is a single file inside the app's own private storage on your device. No other app can read it, and we never receive it.
Your phone backs that file up, and you should know where it goes. Both Android and iOS back up app data by default, so a copy of your history goes to your own Google or Apple account, encrypted, along with the rest of your phone's backup. Three things follow from that:
- It is what restores your history when you set up a new phone.
- It can outlive the app: deleting the app removes the file from the phone, but a backup taken earlier may still hold a copy until your phone or your account discards it.
- Whatever was in the codes you scanned - a Wi-Fi password, a contact - is in there too, because it is part of the history.
- So is anything you typed into a note. A note is the one thing here that is yours rather than something a code happened to contain, and it is kept with the entry rather than separately - so it is stored, backed up and exported wherever the entry goes.
We cannot read any of it; it is in your account, not ours. Turning it off is a phone setting rather than an app one: Google One - Backup on Android, Settings - your name - iCloud on iOS.
You can export that history to a file yourself, delete individual entries, or clear all of it, from within the app.
An export leaves the app's protection, and that is the point of it. Inside the app the history is private storage no other app can open. Exported, it is an ordinary JSON file wherever you saved it - readable by anything on that device that can read files, and by anyone you send it to. It contains the codes, their notes, and when each was added. That is what makes it useful for moving to a new phone or keeping your own copy; it is also why it is worth thinking about where it goes.
What the app sends
Two things, both to Google, and neither of them is a code you scanned.
Crash reports, through Firebase Crashlytics. When the app fails, it sends the stack trace, the device model, the operating system version, and how long the app had been running. This is how a bug that only happens on somebody else's phone gets fixed at all. It is sent when the app next starts, not while you are using it.
Usage counts, through Google Analytics for Firebase. When something happens that the app has a name for - a code was scanned, a code was created, an image was saved - it sends that name, the kind of code involved (qr, ean13, code128), and a one-word category (url, wifi, product, text). Google also attaches its own app-instance identifier, along with the device model, operating system version, and country.
What is deliberately not in that. The value of a code never leaves the device. Not the digits, not a URL, not a Wi-Fi password, not a shortened form, not a hash. The list of things that can be sent is a fixed vocabulary written into the app's source, not a description of what it happens to send today - there is no code path from a scanned payload to a network call.
Saying yes, and changing your mind. Both of the above are off until you allow them. The app asks once on its first run, and both SDKs ship disabled, so nothing is collected before you answer - a "no" leaves nothing behind because nothing was gathered. Settings has one switch for both, and it works in either direction. Turning it off stops collection from that moment; it cannot recall what was already sent.
One thing the switch does not reach. On Android, the Google library that reads the codes (ML Kit) reports its own diagnostics to Google and offers no way to turn that off. It is part of the decoder rather than something this app chooses to send, and it carries no code of yours - but it is not covered by the switch above, and saying so is more honest than implying the switch covers everything.
Two buttons send nothing themselves but hand text to another app, and neither is automatic. Tapping Open website on a scanned link hands that link to your browser. Tapping Search this product on a retail barcode hands that product number to a web search in your browser, because the number on its own tells you nothing. In both cases the app makes no network request itself - it passes the text to your browser and stops there, and from that point your browser's own privacy policy applies.
Who else is involved
Google, as the provider of Firebase Crashlytics and Google Analytics for Firebase, and as the provider of the on-device code decoder (ML Kit) the scanner uses. Google's handling of the data described above is covered by https://firebase.google.com/support/privacy.
There are no advertisers, no analytics broker, and no data sold or shared with anyone else.
Children
The app is suitable for all ages. It asks for no personal information at any point, and nothing it sends identifies a person.
Your choices
- Say no when the app asks, which is the state it ships in, or turn usage counts and crash reports off later in Settings.
- Delete any entry, or all of them, from History.
- Export your history to a file you keep.
- Uninstalling removes the history file with the app.
Changes
If a future version collects anything not described here, this policy will be updated before that version is published, and the change will be described here.