Security & Privacy

How we protect your menus and your customers

A plain-English overview of how MenuMagicQR handles uploads, QR codes, and scan analytics — including the tradeoffs we make so anyone can generate a QR menu in 2 minutes.

Last updated: July 26, 2026

In one paragraph

MenuMagicQR is a QR menu generator. Restaurants and cafés upload a menu (image, PDF, or link), we create a QR code, and diners scan it to view the menu. To keep the product frictionless, we let anyone generate a QR menu without signing up — with server-side file checks, per-owner storage isolation, encrypted transport, and privacy-first analytics as the guardrails.

Controls in place

Server-side file validation

Every menu upload — whether from a signed-in owner or an anonymous visitor — flows through an edge function that checks the actual file bytes (not just the extension) and enforces a 10 MB cap. Only JPG, PNG, and PDF files are accepted.

Owner-scoped storage

Signed-in accounts can only read or write files inside their own folder, enforced by database-level row policies. Anonymous uploads are isolated to a dedicated anonymous/ folder and given unguessable UUID filenames so links cannot be enumerated.

Automatic cleanup

Deleting a QR menu queues its file for removal from storage. A scheduled cleanup job runs regularly to permanently delete orphaned files, so old menus do not linger.

Authenticated backend actions

Every backend function that touches your data validates its caller — either a signed session token or a signed webhook — before doing any work. Rate limits are applied per IP and per menu to prevent abuse.

Privacy-friendly analytics

QR scan analytics record only the country/city (derived server-side from network headers), the browser user-agent, and the referrer. We do not store IP addresses, emails, or any personal identifier of the person scanning your QR code.

Encrypted in transit

The site, uploads, downloads, and every API call are served over HTTPS. Menu files are delivered from a public CDN so guests can scan and view menus instantly without accounts.

Tradeoffs we make on purpose

A few product decisions favor accessibility and speed over stricter access control. We list them here so you know exactly where the line is drawn.

Anonymous QR menu uploads

Why we allow it: Trying the product should not require creating an account. Restaurants can generate a QR menu, download the print files, and share it with staff before deciding to sign up.

How we contain the risk: anonymous files are validated server-side (magic-byte MIME check, 10 MB cap), written only to a dedicated anonymous/ folder, given UUID filenames, and periodically cleaned up. Anonymous uploads cannot reach any signed-in user's folder.

Public menu URLs

Why they are public: diners need to view your menu instantly by scanning a QR code — no login, no friction.

What that means: anyone with the direct file URL can view the menu. Filenames are unguessable UUIDs, and if you need private or time-limited menus we can enable signed URLs on request.

What we never collect from your diners

• IP addresses of the people scanning your QR code
• Names, emails, or phone numbers of scanners
• Precise location — analytics stop at country/city level
• Any tracking cookies on the public menu view

Reporting a security issue

If you believe you have found a vulnerability, please email us before disclosing it publicly. We investigate every report and will keep you updated on the fix.

menumagicqr@gmail.com