The people who scan your code

  • Every editable code's destination is looked up in Google's lists of harmful links when it is saved, and a daily check goes over the destinations again, starting with those checked longest ago. A destination found there disables its code at once.
  • A link whose site name uses non-Latin letters, which can be used to imitate a well-known name, is shown behind a warning page.
  • Every page kuody.com hosts for a code carries a “Report abuse” link, and a report reaches us at once.
  • The IP address of a person who scans is not written to the scan's record, and opening a short link sets no cookie, except for a code protected by a password and a form's page. The details are in the privacy notice.
  • No advertisement between the scan and its destination, and no page in between other than that warning, or a warning while our team reviews a report about the code.

Your account

  • A password has at least 12 characters and is stored in a form that cannot be read; repeated failed sign-ins are temporarily blocked.
  • Two-step sign-in with an authenticator app, and recovery codes. An organization's owner may require it of every member.
  • Your account page shows how many other devices you are signed in on, and signs you out of all of them in one step.
  • Each member of an organization has a role, and every change to codes and members is recorded under the name of whoever made it.

Your data

  • Every connection to the site is encrypted (HTTPS), and browsers are told never to connect any other way.
  • Cloudflare's network stands in front of the server, and the server answers nobody else.
  • Each organization's data is kept apart from the others', and automated tests check it before every update of the service.
  • The database and the files are backed up every night, encrypted on the server before they leave it.
  • An uploaded picture is checked by its content, not its name, and then re-encoded: what your visitors see is a copy we made, not the file that was uploaded.
  • The server and the files are in Germany. Cloudflare's network handles requests in its centres around the world.

What we do not claim

  • No company can promise to exist for ever. If the service ever closes, we will tell you at least 12 months in advance, and that period is written in the terms. Tying your codes to a domain you own, which is the complete guarantee, comes with the Grow plan and those above it.

Reporting a security flaw

If you find a flaw in kuody.com, write to [email protected], in Arabic or English. Give the address affected, the steps that reproduce it, and what an attacker could do with it.

What we commit to:

  • We confirm that we received your report within five working days, and tell you what we decided about it.
  • We take no legal action against anyone who researches in good faith and follows the rules below.
  • We name you when the fix is out, if you wish. We pay no bounties.

What we ask of you:

  • Test on your own account and your own codes, and look at other people's data no further than you need to prove the flaw.
  • Do not disrupt the service, flood it with requests, or deceive account holders or our team.
  • Give us a reasonable time to fix it before you publish anything.

Reporting an abusive code

A code that leads to fraud or malware is not a flaw in the service; report it on the report page: enter its short link there, and we will review it.