When you scan a QR code, your phone reads a short piece of text from the pattern and shows it to you. That is all. Nothing opens, nothing is sent, until you tap. If you then open a link, the website learns what any website learns about a visitor: the time, the kind of phone, and a rough location from the network. It does not learn your name, your contacts, or where you are standing. Here is the whole sequence, what each party can see, and how to scan with the least exposure.
What does your phone actually do when it scans?
A QR code is a grid of dark and light squares that encodes text. Your camera app finds the three big corner squares, reads the grid, corrects for the angle and any small damage, and turns the pattern back into the text that was put in. That text is almost always a web address, but it can also be a Wi-Fi network, a contact card, a phone number, a message or a payment request.
The phone then shows you what it found: a banner on iPhone, a chip or a Google Lens card on Android. It does not open anything on its own. This pause is the moment to read the address, and our guide on how to check if a QR code is safe covers what to look for in it.
Nothing has left your phone yet. The code's owner does not know you scanned it.
What can a QR code contain?
| What is in the code | What your phone offers to do | What to check before you confirm |
|---|---|---|
| Web address | Open the page in your browser | The domain is the one you expect |
| Wi-Fi network and password | Join the network | You were told about this network by the venue |
| Contact card (vCard) | Save a contact | The details match the person or business |
| Phone number or text message | Start a call or a message, with the text filled in | The number and the message are what you intend to send |
| Open a new email with the address filled in | Same | |
| Location | Open it in a maps app | Fine; it only shows a place |
| Calendar event | Add the event | Fine; it only adds an entry |
| Payment request | Open your payment app with the amount filled in | The payee name and amount, every time |
| App link | Open the app store page | It is the official store, not a download from a website |
Every row needs a tap from you. The code can fill in details; it cannot press confirm.
Do QR codes track you?
A printed code cannot track anything. It is ink on paper. The question is really about what the code points to.
Static codes hold the final address directly. When you open it, you visit the site like any other visitor; the person who printed the code never finds out that a scan happened. Nothing is counted.
Dynamic codes hold a short link that redirects to the final page. The redirect is what makes the code editable and trackable: the short link's server sees the request on its way through, and that is how scan analytics work. Our comparison of dynamic and static QR codes explains why most business codes are dynamic.
What a redirect server can see is the same as what any website sees when you open a page:
- That a request happened, and when. The scan count and the hour-of-day chart come from this.
- The network address. From it, a rough location: a country, a region, often a city or a postal area. It is derived from the network, not from GPS, and it is wrong whenever you are on a VPN or a mobile network routed through another city.
- The browser and device type. iPhone or Android, which browser, and whether the scan came from inside an app such as Instagram or WhatsApp.
- The link's own code. If a campaign uses one code per poster, the server knows which poster was scanned.
What it cannot see without asking you: your name, your phone number, your contacts, your photos, your exact position, or anything from other apps. A website can request precise location or camera access, and your phone shows a permission prompt first. If a page that just opened from a code asks for location, think about why; a menu does not need it.
What AriaQR records
AriaQR counts scans this way and stops there. Every dynamic code reports total scans, unique visitors, scans per day, an hour-of-day heatmap, device and operating system, in-app browser detection, and country, region, city and postal area when the network allows. There are no cookies and no permission prompts; uniqueness is estimated without identifying anyone. The owner of the code sees charts and a map, not people. Our post on QR code analytics walks through each number.
Can a QR code steal your information?
Not by being scanned. The only things that can leave your phone are the things you type into a page or approve in a prompt after the scan. That is why every QR code scam ends on a form: a sign-in page, a card form, a "verify your details" page. The code gets you there; you do the rest.
The same applies to the other kinds of code. A Wi-Fi code cannot read your traffic unless you join the network. A contact code cannot read your contacts; it offers to add one. A payment code cannot move money until you confirm the payee and the amount in your own payment app.
So the rule is short: a page that a code opened should give you something and ask for nothing sensitive. The moment it asks for a password or a card number, close it and go to the real site yourself.
How to scan with the least exposure
- Read the address before you tap. Ten seconds, every time.
- Keep your camera's "open links automatically" setting off, if it has one. The preview is your only pause.
- Decline Wi-Fi, contact and payment codes you were not expecting. A stranger's code should never change your phone's settings or move money.
- Say no to permission prompts that make no sense. A menu asking for your location, a ticket asking for your camera.
- Never install from a page a code opened. Apps come from the app store you open yourself.
- If you are unsure, check it without opening it. The free QR code safety checker reads a photo of a code on your device, explains what it does, and never opens the link.
What a trustworthy code keeps private
If you print codes for other people, the way to be trusted is to collect less and say so. Count scans, not people. Use rough location from the network and never ask for precise location unless the page genuinely needs it. Do not set cookies through the redirect. Do not ask for a sign-in to show a menu. And land on your own domain so that the preview tells the visitor exactly who they are dealing with.
Customers cannot see your analytics settings, but they can feel the difference between a code that just works and one that interrogates them.
How AriaQR keeps scans private and codes safe
Since most of this post is about what a code's owner can see, here is what AriaQR itself does with a scan. The controls are listed on our security page and explained in the privacy policy.
- No cookies, ever. Scans, short-link clicks and landing-page visits set no cookies.
- No stored network address. The rough location is derived from the network at the moment of the scan and the address itself is never kept. Unique visitors are counted with a one-way hash whose secret changes every day, so nobody can be followed from one day to the next.
- No permission prompts. A code never asks your phone for precise location, camera or contacts. If a landing page offers a map and you choose to share a precise location, that is deleted after 90 days.
- Destinations are checked. Every link is checked against Google Safe Browsing when it is made or changed, and short links and free codes again every day; flagged links stop redirecting. Anyone can report a link, and reported links warn before they redirect.
- Businesses get written terms. The data processing terms apply on every plan and say what we keep, for how long, and that a breach is notified within 72 hours.
If you want to know exactly what a code would hand to your phone before you tap, the free QR code safety checker explains it on your device, and the QR code reader shows the raw text inside it.
Where to start
Scan with the banner habit: read, then tap, and treat any request for a password or card as a stop sign. If you make codes, choose a setup that counts scans without tracking people, and keep the page simple. You can make a code that works this way, verified before download, and see pricing when you need more than one.