October 13, 2026 · Updated October 15, 2026
How we count QR scans without cookies (and what we can't know)
A QR scan is an odd thing to measure. There’s no page you control, no script running, and often no website at all. The phone camera reads a link, the browser opens it, and the person is gone. Yet Mitr’s QR campaigns report scans, unique scanners, devices and cities. So what exactly is being collected, and what isn’t?
The half-second between scan and landing
Every Mitr QR code contains a short link that belongs to us, not the final destination. When someone scans it:
- Their phone opens our short link.
- We look up which code it is, and check it’s active.
- We record the scan, if it should be recorded (more on that below).
- We send the phone on to the real destination.
For ordinary web links this is a standard redirect. For a phone call, SMS, email or UPI payment, browsers don’t reliably follow redirects, so we show a tiny page that opens the right app and has a button as a fallback. Either way the person lands where you wanted. If something goes wrong with the recording, the redirect still happens: a scan is never lost to a failed log entry, and it’s never blocked by one.
What we store about a scan
| We store | Why |
|---|---|
| Which code (placement) and campaign | So you can compare flyers |
| Time | For the daily chart and busiest hours |
| Country, region and city | A coarse place, from a lookup |
| Device type, operating system, browser | Phones vs tablets, Android vs iPhone |
| A hashed visitor identifier | To estimate unique scanners |
What we don’t
- No cookies and nothing saved on the phone. There’s nothing to consent to at this step because nothing is placed on the device.
- No IP address. It’s used for a moment to work out the city, then dropped. It isn’t written to the scan record.
- No name, phone number or email. A scan alone identifies nobody. Those only exist if the person fills in a form and ticks the consent box. See how consent works on the form.
How “unique scanners” works without tracking anyone
The visitor identifier is a one-way hash of the phone’s connection details and browser, mixed with a secret that changes every day and with the specific code. That has three consequences, all intended:
- Two scans from the same phone on the same day, of the same code, produce the same identifier. That’s how we estimate “unique”.
- The next day, the same phone produces a different one. We can’t follow a person from day to day.
- Scans of two different codes never share an identifier. We can’t connect “the person who scanned the flyer” to “the person who scanned the shop window”.
The price is that unique scanners is an estimate, per day. Someone who scans on Monday and again on Friday counts as two. Two people sharing one office network and the same phone model can occasionally count as one. We think that’s the right trade: a slightly fuzzy number beats a precise profile of a stranger. It’s the same reasoning behind why we built analytics without cookies.
Scans we choose not to count
- Link previews and bots. When someone pastes your QR link into WhatsApp or Slack, the app fetches it to draw a preview. That isn’t a person, so it isn’t recorded.
- Quick repeats. The same visitor opening the same code again within a few minutes is counted once. Double-taps and refreshes shouldn’t inflate your numbers.
- Past your plan’s monthly allowance. The person is still sent to your destination. We simply stop storing new scan details until the month turns over, and your dashboard tells you how many weren’t recorded.
Scan history is also kept for a limited time that depends on your plan, then deleted.
What we can’t tell you
Being straight about the limits matters more than a long feature list:
- Who scanned. Unless they fill the form, you don’t know.
- Where they saw the code. A scan carries no information about the poster it came from, which is why each placement gets its own code.
- Scan versus tap. If you share the link in a message, a tap on it looks identical to a camera scan.
- City, exactly. It’s a lookup from a network address, so it can be off: mobile networks sometimes resolve to a city that isn’t where the phone is. When the lookup finds nothing at all, the scan is shown as Unknown rather than guessed, and kept apart from real cities so it can’t distort the chart.
If you’d like the legal side of this, we’ve written about what India’s DPDP Act means for an analytics stack. To see the numbers for yourself, start free and make a code.
Frequently asked questions
Can QR codes be tracked without cookies?
Yes. A dynamic QR code opens a short link first, the scan is recorded on the server, and the phone is then sent to the real destination. Nothing is stored on the scanner's phone, so no cookie is needed.
Does Mitr store the IP address of people who scan?
No. The IP address is used for a moment to work out the city and is then dropped. It is not written to the scan record.
How are unique scanners counted without tracking people?
Each scan gets a one-way hash of the phone's connection details and browser, mixed with a secret that changes daily and with the specific code. The same phone scanning the same code on the same day gives the same hash, so unique scanners is an estimate per day. The next day the same phone looks new.
Can I tell who scanned my QR code?
Not from a scan alone. A scan carries no name, phone number or email. You only learn who someone is if they choose to fill in a form and tick the consent box.