What's tracked

The data we record for each scan, how bots are handled, and what we don't store.

Recorded for each scan

Time of the scan
Which code, and whether it was a QR scan or a link click
Country, region or state, and city, worked out from the network location
Device (iOS, Android, desktop or other), operating system and browser
Browser language
Which redirect rule matched, if any

What we don't store

We never store raw IP addresses. To count unique visitors, we keep a one-way hash of the IP address and browser, salted with a value that changes every day. It can't be turned back into an IP address, and the same person can't be followed from one day to the next.

Because of that, Unique visitors counts unique visitors per day, so someone who scans on two different days counts twice.

Bots and link previews

Crawlers, monitoring tools and link previews (for example when a link is pasted into WhatsApp, Slack or LinkedIn) are detected by their user agent. They're shown as Bots and previews (excluded) and left out of every other number. They also don't count toward scan limits, webhooks or Google Analytics events.

Location accuracy

Location comes from the scanner's network, not GPS. City-level data can be off, especially on mobile networks, and is sometimes missing. Missing values show as "Unknown".

Times and time zone

Daily totals and the Scans by hour heatmap use your workspace's time zone. The page names the time zone it's using.