This page names every provider that makes LoveQR work, the country each one is based in, where the servers are, what each one claims about its energy, and what we do with IP addresses. It also names what we do not yet know.
Our commitment
You cannot choose a service you cannot see into. That is why this page exists, and it follows from what LoveQR has tried to be from the start: a place where you know what is going on.
Many services claim to protect privacy. Few say whose servers they run on, in which country, under which law, and what they pass on to third parties. Yet those three questions decide everything else: a promise of confidentiality is only worth as much as the chain of providers carrying it.
We commit to four things.
Naming. Every provider involved in running the service is named on this page, with its country and its exact role. Including the ones that do not suit us.
Claiming only what is verified. We do not write that something is compliant because it ought to be. When we have not checked, we say so.
Publishing what is unresolved. This page has a section devoted to what we do not know. It is deliberate and it will stay. A transparency page containing only good news is not a transparency page.
Reducing, step by step. We commit to reducing, in stages, what leaves a person's device, what leaves Europe, and what we keep. Step by step, because LoveQR is built by one person with limited means, and announcing more would already break the first commitment.
We do not promise to be perfect. We promise to be legible, and to move in that direction without going back.
The starting point: no new device
LoveQR runs in the phone's browser. There is no application to install, no headset, no glasses, no additional hardware. Augmented reality uses the camera, compass and motion sensors of the device the person already owns.
That is the most significant saving on this whole page, and it appears in no carbon report: a service that does not require buying a device avoids a footprint far larger than that of its servers.
Where the data lives
Accounts, conversations, posts and files are held by Lovable Cloud, the managed service of Lovable Labs Sweden AB, a Swedish company based in Stockholm. The database connection point is in the eu-central-1 region, in Frankfurt, Germany.
The underlying technology of that managed service is Supabase Inc., a United States company, running on Amazon Web Services servers. We have no direct contract with them: our contractual counterpart is Lovable.
| Company | Country | Role |
|---|
| Holder of the data | Lovable Labs Sweden AB | Sweden | Database, accounts, multi-factor authentication, files, server functions |
|---|
| Underlying technology | Supabase Inc. | United States | Engine of the managed service, on Amazon Web Services |
|---|
| Transport and protection | Cloudflare, Inc. | United States | Name servers, static file caching, transport encryption, protection against denial-of-service attacks |
|---|
Holder of the data
- Company
- Lovable Labs Sweden AB
- Country
- Sweden
- Role
- Database, accounts, multi-factor authentication, files, server functions
Underlying technology
- Company
- Supabase Inc.
- Country
- United States
- Role
- Engine of the managed service, on Amazon Web Services
Transport and protection
- Company
- Cloudflare, Inc.
- Country
- United States
- Role
- Name servers, static file caching, transport encryption, protection against denial-of-service attacks
What Cloudflare does, and does not do. Cloudflare carries and protects traffic: it is a transport layer sitting in front of the hosting. No account, conversation or profile data is kept there; nothing resides there. And since the content of private conversations is end-to-end encrypted, it stays unreadable at every step of the transport, including that one.
What we write nowhere: that LoveQR is hosted in Switzerland. The company is Swiss; the data is in Germany.
The data shown in the application
| Source | Country | What it provides | Licence |
|---|
| MET Norway — Norwegian state meteorological institute | Norway | The forecasts in the weather card | CC BY 4.0 |
|---|
| OpenStreetMap — OpenStreetMap Foundation | United Kingdom, worldwide community | Map backgrounds, places, points of interest | ODbL |
|---|
| Overpass mirrors | Germany, Switzerland, Austria, Japan | Querying OpenStreetMap data | ODbL |
|---|
| Nominatim — OpenStreetMap Foundation | United Kingdom | Address search and reverse geocoding | ODbL |
|---|
| Photon — Komoot | Germany | Geographic resolution of content | ODbL |
|---|
| Geoapify — operated by Keptago Ltd | Cyprus (European Union) | Fallback for place data | Service terms |
|---|
| Wikidata and Wikimedia Commons | United States | Encyclopaedic information and images on place cards | CC BY-SA and public domain |
|---|
| OpenAgenda | France | Public event listings | Licence Ouverte 2.0 |
|---|
| discover.swiss | Switzerland | Swiss tourism content and events | Platform contract |
|---|
| Switzerland Tourism | Switzerland | Swiss tourism data | OpenData terms |
|---|
| DATAtourisme | France | French tourism data | Licence Ouverte |
|---|
| Agenda du Libre | France | Free software events | Free licence |
|---|
| Open data portals — Paris, Basel, Montreal, New York, Opendatasoft | France, Switzerland, Canada, United States | Local public listings | Respective open licences |
|---|
| TheSportsDB | not verified | Sports events | to be verified |
|---|
| GDELT | United States | Press search | Project terms |
|---|
MET Norway — Norwegian state meteorological institute
- Country
- Norway
- What it provides
- The forecasts in the weather card
- Licence
- CC BY 4.0
OpenStreetMap — OpenStreetMap Foundation
- Country
- United Kingdom, worldwide community
- What it provides
- Map backgrounds, places, points of interest
- Licence
- ODbL
Overpass mirrors
- Country
- Germany, Switzerland, Austria, Japan
- What it provides
- Querying OpenStreetMap data
- Licence
- ODbL
Nominatim — OpenStreetMap Foundation
- Country
- United Kingdom
- What it provides
- Address search and reverse geocoding
- Licence
- ODbL
Photon — Komoot
- Country
- Germany
- What it provides
- Geographic resolution of content
- Licence
- ODbL
Geoapify — operated by Keptago Ltd
- Country
- Cyprus (European Union)
- What it provides
- Fallback for place data
- Licence
- Service terms
Wikidata and Wikimedia Commons
- Country
- United States
- What it provides
- Encyclopaedic information and images on place cards
- Licence
- CC BY-SA and public domain
OpenAgenda
- Country
- France
- What it provides
- Public event listings
- Licence
- Licence Ouverte 2.0
discover.swiss
- Country
- Switzerland
- What it provides
- Swiss tourism content and events
- Licence
- Platform contract
Switzerland Tourism
- Country
- Switzerland
- What it provides
- Swiss tourism data
- Licence
- OpenData terms
DATAtourisme
- Country
- France
- What it provides
- French tourism data
- Licence
- Licence Ouverte
Agenda du Libre
- Country
- France
- What it provides
- Free software events
- Licence
- Free licence
Open data portals — Paris, Basel, Montreal, New York, Opendatasoft
- Country
- France, Switzerland, Canada, United States
- What it provides
- Local public listings
- Licence
- Respective open licences
TheSportsDB
- Country
- not verified
- What it provides
- Sports events
- Licence
- to be verified
GDELT
- Country
- United States
- What it provides
- Press search
- Licence
- Project terms
The Overpass mirrors used are overpass-api.de in Germany, overpass.osm.ch in Switzerland, overpass.kumi.systems and overpass.private.coffee in Austria, and overpass.osm.jp in Japan.
The credits required by these licences are shown where the data appears: the OpenStreetMap notice while augmented reality starts up and on every place card, and in the weather card the notice "Données météo : MET Norway (CC BY 4.0) · © OpenStreetMap contributors (Nominatim)".
Purchases, printing and trees
| Provider | Country | What it provides |
|---|
| Stripe | Ireland, Dublin — the contracting entity depends on the merchant's country | Payments and subscriptions |
|---|
| Gelato | Norway, Oslo | Printing and delivery of orders |
|---|
| Ecologi Action Ltd | United Kingdom, London | Funding of tree planting |
|---|
Stripe
- Country
- Ireland, Dublin — the contracting entity depends on the merchant's country
- What it provides
- Payments and subscriptions
Gelato
- Country
- Norway, Oslo
- What it provides
- Printing and delivery of orders
Ecologi Action Ltd
- Country
- United Kingdom, London
- What it provides
- Funding of tree planting
The workshop tools
These services are used only by the administration workshop, to prepare content. They receive no account, conversation or location data.
| Service | Country | Use |
|---|
| Translated — MyMemory | Italy, Rome | Tag translation |
|---|
| Lovable AI Gateway | Sweden | Workshop image generation |
|---|
| Pexels | not verified | Free photo and video search |
|---|
| Pollinations | not verified | Workshop image generation |
|---|
| ElevenLabs | United States | Workshop voice and music |
|---|
| Holo | not verified | Writing of blog articles |
|---|
Translated — MyMemory
- Country
- Italy, Rome
- Use
- Tag translation
Lovable AI Gateway
- Country
- Sweden
- Use
- Workshop image generation
Pexels
- Country
- not verified
- Use
- Free photo and video search
Pollinations
- Country
- not verified
- Use
- Workshop image generation
ElevenLabs
- Country
- United States
- Use
- Workshop voice and music
Holo
- Country
- not verified
- Use
- Writing of blog articles
QR codes are computed on the device
A profile's QR code contains the profile itself, compressed: first name, age, country, language, description text and interests. That is what makes it readable without an account and without a connection.
This computation is done entirely in the browser, on the person's own device. No outside service is involved, and no profile data leaves the device when the code is generated. The library used, qrcode, is free software under the MIT licence, run locally.
The same is true of the flyers and the QR codes of professional spaces.
IP addresses
Every request to a website transmits an IP address: that is how the network works. The useful question is therefore not whether we see it, but what we do with it and to whom we pass it on.
No transmission to any third party. No IP address is transmitted to an outside service. Only the infrastructure providers named above receive it, because they need it to carry the connection.
What they are used for. IP addresses are used only to protect the service: device registration and consistency checks between devices and accounts; geographic verification, comparing the network country with the GPS country; risk evaluation, sanctions and detection of suspicious behaviour; payment checks and limits on the number of printed orders; limits on login attempts and request rates, to prevent abuse.
What is kept, and in what form. In most of these uses the address itself is not kept: it is turned into a fingerprint, and it is the fingerprint that is stored. Rate limiting uses the address in memory only, never writing it.
Counting visits in the browser does not rely on the IP address: it uses a random session identifier and the day. Public searches made without a session do use a daily fingerprint derived from the address and the declared browser; they are counted separately, as searches and not as visits. This has to be said so as not to suggest otherwise: what we measure are observed sessions, not unique people.
Retention. Logs related to fraud prevention are kept for one hundred days, after which they are deleted automatically.
Fonts
A font loaded from an outside server transmits the visitor's IP address to that server, without their asking. That is why the question appears on this page.
All fonts are hosted with the site: those of the public pages as well as the decorative ones that can be chosen to personalise the appearance of a conversation. No page, and no personalisation, contacts an outside font server.
They are served in WOFF2 format and are only downloaded when actually used: opening the site without personalisation loads none of them.
Scripts. Latin and Latin Extended sets are provided for every family, and the Cyrillic set for those that have one, so that Russian and Ukrainian also benefit from personalisation. Decorative Latin fonts do not exist in Chinese, Japanese or Arabic: for those scripts the text is shown in the device's system font, which also avoids downloading several megabytes on every visit. The previews in the selector say so.
What each provider claims about its energy
The nuance to know before reading the figures. In this industry, "one hundred per cent renewable electricity" almost never means that the current reaching the server comes from a wind turbine. It usually means the operator has bought renewable origin certificates matching its consumption. This is called market-based accounting, as opposed to location-based accounting, which measures the real electricity mix of the local grid. The two figures can be very far apart. We prefer to write that rather than copy the most flattering claim.
For a sense of scale, a European host that publishes a detailed report, Hostinger, states for 2025 one hundred per cent renewable electricity in its data centres — and specifies that seventy-three per cent of the energy actually came from renewable sources, the remainder being covered by guarantees of origin and certificates. Its scope 2 emissions stand at 23 tonnes of CO₂ equivalent on a market-based basis, and 4,367 tonnes on a location-based basis. The same gap exists, without always being published in such detail, at most of the providers on this page.
| Provider | What it claims | Level of precision |
|---|
| Amazon Web Services — under Lovable Cloud | Having reached one hundred per cent renewable electricity in 2023, through purchase agreements and certificates | Public company statement |
|---|
| Cloudflare | Powering its network with one hundred per cent renewable electricity since 2019, through certificates; commitment to remove its historical emissions | Public company statement |
|---|
| Gelato | 88% of orders produced in the customer's country and 99% in their region, across 31 countries and more than 150 production hubs, which shortens transport. Their 2024 report contains no statement about production energy. | Annual sustainability report, measured figures |
|---|
| MET Norway | Norwegian public institute. No energy statement specific to their infrastructure has been consulted. | — |
|---|
| Lovable | No public energy statement consulted to date. | — |
|---|
| Supabase | No public energy statement consulted to date. | — |
|---|
| OpenStreetMap and its mirrors | Community and volunteer servers; no sustainability report. | — |
|---|
Amazon Web Services — under Lovable Cloud
- What it claims
- Having reached one hundred per cent renewable electricity in 2023, through purchase agreements and certificates
- Level of precision
- Public company statement
Cloudflare
- What it claims
- Powering its network with one hundred per cent renewable electricity since 2019, through certificates; commitment to remove its historical emissions
- Level of precision
- Public company statement
Gelato
- What it claims
- 88% of orders produced in the customer's country and 99% in their region, across 31 countries and more than 150 production hubs, which shortens transport. Their 2024 report contains no statement about production energy.
- Level of precision
- Annual sustainability report, measured figures
MET Norway
- What it claims
- Norwegian public institute. No energy statement specific to their infrastructure has been consulted.
- Level of precision
- —
Lovable
- What it claims
- No public energy statement consulted to date.
- Level of precision
- —
Supabase
- What it claims
- No public energy statement consulted to date.
- Level of precision
- —
OpenStreetMap and its mirrors
- What it claims
- Community and volunteer servers; no sustainability report.
- Level of precision
- —
The trees
Anyone can fund the planting of a tree for one franc, through Ecologi Action Ltd in London. The number of trees funded appears on their profile.
What it is, and what it is not. It is a contribution that adds to the running of the service. It is not an offset of LoveQR's footprint: we have not measured that footprint, so we do not claim it is cancelled out. Conflating the two would be exactly the criticism rightly made of token environmental claims.
What we do not know
This section is the reason this page exists. The items below are real gaps, and we prefer to write them rather than let it seem that everything is known.
- The execution region of the server functions. The database connection point is in Frankfurt. No region is set in the configuration for the functions, and we do not infer it from the database's.
- The location of the database backups.
- The physical location of the origin of the site's files. Response headers identify the distribution layer, not the origin server.
- The final destination, region and retention of the audience measurements added by the hosting platform. Two statistics scripts are present on the production pages; they do not come from LoveQR's code, and we cannot state that they respect the privacy setting offered in the application.
- The retention period and region of data transmitted to Stripe, Gelato and Ecologi during a purchase.
- LoveQR's carbon footprint. It has never been measured. No figure is put forward.
What we do not do
- No advertising.
- No advertising tracking, no profiling for advertising purposes.
- No resale or transfer of personal data.
- No accessibility certification claimed: the settings exist, the label does not.
- No claim of hosting in Switzerland. The data is in Germany.
How this page is kept up to date
It is revised whenever the infrastructure changes. The not verified and to be confirmed notes are work in progress, not turns of phrase: they will disappear one by one, and others will appear.
Sources of the claims cited: MET Norway, terms of service and licence, at docs.api.met.no; Gelato, 2024 sustainability report; Geoapify, legal notice; Hostinger, 2025 sustainability report; Cloudflare and Amazon Web Services, public statements by those companies.
Frequently asked questions
Where is LoveQR's data hosted?
Accounts, conversations, posts and files are in Frankfurt, Germany, in the eu-central-1 region. They are held by Lovable Cloud, the managed service of Lovable Labs Sweden AB, a Swedish company based in Stockholm.
Is LoveQR hosted in Switzerland?
No. The company is Swiss, based in Bex in the canton of Vaud, but the data is hosted in Germany. LoveQR nowhere claims to be hosted in Switzerland.
Who actually hosts LoveQR, and under which law?
The holder is Lovable Labs Sweden AB, a Swedish company, therefore subject to European Union law. The underlying technology of its managed service is Supabase Inc., a United States company, running on Amazon Web Services. LoveQR has no direct contract with Supabase.
Does LoveQR use American services?
Yes, two: Supabase, as the underlying technology of the managed service, and Cloudflare, for transport and traffic protection. They are named on this page with their exact role. LoveQR itself is a Swiss company with no parent company.
What does Cloudflare do for LoveQR?
Cloudflare provides the name servers, static file caching, transport encryption and protection against denial-of-service attacks. It is a transport layer: no account, conversation or profile data is kept there. Since the content of private conversations is end-to-end encrypted, it stays unreadable at every step of the transport.
Does LoveQR pass data to third parties?
No personal data is sold or transferred. The only transfers are those the service requires: the infrastructure providers, then Stripe for a payment, Gelato for a printed order and Ecologi for buying a tree, only when the person carries out those actions.
What does LoveQR do with IP addresses?
They are used only to protect the service: device registration, geographic verification, risk evaluation, payment checks and abuse limiting. In most of these uses the address is not kept as such but turned into a fingerprint. No IP address is transmitted to any outside service.
How long does LoveQR keep its logs?
Logs related to fraud prevention are kept for one hundred days, after which they are deleted automatically.
Does a profile's QR code go through an outside service?
No. It is computed entirely in the browser, on the person's own device, using a free library under the MIT licence run locally. No profile data leaves the device when the code is generated.
Where do the map, place and weather data come from?
Maps and places come from OpenStreetMap and its community servers, in Germany, Switzerland, Austria and Japan, with Geoapify as a fallback. The weather comes from MET Norway, the Norwegian state meteorological institute, under the Creative Commons Attribution 4.0 licence. Credits are shown where the data appears.
Does LoveQR run on renewable energy?
Its hosts claim so, but you need to know what that means: in this industry, "one hundred per cent renewable" usually refers to a purchase of certificates rather than the electricity actually consumed. This page explains that gap and quotes each provider's claims without rephrasing them in our favour.
Do the funded trees offset LoveQR's footprint?
No, and LoveQR does not claim they do. The trees are a contribution that adds to the running of the service. LoveQR's footprint has never been measured, so no offset can be claimed.
