What a redirect can observe
A dynamic QR code points to a hosted short URL. When a phone requests that URL, the service can increment a count before returning a redirect. QRForever groups these requests by code, day, country, device category and operating-system family. It does not store a scanner’s IP address, identity or a cookie identifying the scanner. A direct static code does not use our redirect, so we cannot measure its scans. Reading a static Wi-Fi or contact payload may not make any network request at all.
A count is not a person
One person can scan several times, and a phone can request a link more than once. A shared short link can also be opened by someone who never saw the printed QR. For those reasons, describe the number as counted requests or scans rather than unique people. QRForever does not deduplicate across visitors with tracking identifiers. The count does not prove that a destination page finished loading, that someone read it or that a payment was completed. Those are separate events on systems outside the redirect.
Some requests are intentionally excluded
Known bots and link preview agents are excluded using a small user-agent filter. HEAD requests also redirect without incrementing counts. This reduces noise from previews but cannot identify every automated request or distinguish every genuine camera scan. A browser with an unusual user-agent can be classified as Other, and a bot that presents itself as a normal browser may still be counted. Treat small changes in daily totals cautiously and compare patterns over a useful period rather than interpreting each request as a verified visitor.
Country and device are approximate categories
Country comes from Cloudflare’s request metadata and may reflect a VPN, proxy or mobile network route rather than the person’s physical location. Missing country data appears as XX. Device and operating system are inferred from the user-agent header into broad groups such as mobile, tablet, desktop, iOS or Android. These are useful for checking whether a mobile landing page matters to your audience, but they are not precise device inventories. We do not attempt to identify an exact handset or build a fingerprint from those fields.
Use campaign parameters at the destination
If you control destination analytics, you can add ordinary campaign parameters to the destination URL, for example utm_source=print, utm_medium=qr and utm_campaign=autumn-menu. Use a different campaign value for each meaningful print placement if you want to compare them. Avoid adding personal information to URLs: addresses can be logged by other systems and shared by visitors. Your destination analytics tool has its own privacy and consent responsibilities. QRForever scan totals and destination session totals will not necessarily match because they measure different requests at different points.
Choose a reporting window and protect access
Free shows thirty days of scan aggregates. Pro and Business provide a window up to 730 days and CSV export. Business also includes an API for code management and statistics, subject to an API-key rate limit. Keep access links and API keys private, and revoke keys you no longer use. Downloaded reports should be handled according to your own retention needs. Counts can help decide which sign needs clearer placement or which campaign deserves review, but they should sit alongside feedback, completed forms and actual business outcomes when you judge whether a printed campaign worked.
Before your next print
Should I test before printing?
Keep reading
Do QR codes expire? · Static vs dynamic QR codes · QR codes with a logo: practical guidance · QR code size and print guide · Wi-Fi QR codes: format and safety