What a scan actually records
Specifically, and including what it deliberately does not. If you are putting a code on something the public will scan, you are the one who has to be able to answer this.
What is recorded
The time. The country, region and city, derived from the network the request came in on. The device type, operating system and browser, with versions. The referrer, when the browser sends one. Which code was scanned, and where it forwarded to.
What is not
No IP address is stored against a scan. It is used to derive the location and then discarded — the row that reaches the database never had one.
Nobody is asked for their location. The browser's location permission is never requested, so there is no prompt and no precise coordinate. City-level from the network is as fine as it gets, and in some countries that is a very large city.
No name, no email, no advertising identifier, and nothing that follows somebody to another site. Scanning a code sets nothing any other site could read.
Returning visitors, without identity
To say "this is the same person as an hour ago" we hash the signals above with a rotating secret salt. The result identifies a visit as a repeat without identifying a person, and cannot be reversed into the inputs.
For scans from the EEA the salt is rotated on a schedule and the old one destroyed, at which point a returning visitor stops being recognisable. That is a deliberate loss of data quality in exchange for a bounded window.
Strict privacy mode
Available per account. It drops the fingerprint entirely, so everything is counted as an anonymous visit and "unique visitors" stops being reported rather than being reported wrongly.
This describes what the product does. Whether your use of it needs a notice, a lawful basis or a record of processing depends on your jurisdiction and your purpose — that judgement is yours, and this page is not legal advice. Our privacy policy is here.