What the person scanning sees
Most codes resolve straight through with no page at all. These are the states that need one — and every one of them is free of advertising, upsells and tracking cookies, permanently. The person scanning is not our customer.
- Someone scansany phone camera
- The edge answersunder 30ms at p95
- Straight throughmost scans — no page
- Or one of these stateschosen below
7 of 7 states are served at the edge by the redirect Worker today. The count is generated from the Worker's own source, so it cannot drift from what is deployed.
Ask about this dish
This code is protected
Confirm your age
Get the full guide
This code is paused
This offer has ended
This destination looks unsafe
OPTIONALTEMPORARYENDEDWARNINGPaneer tikka, from the Cafe Andheri menu. The facts come first; the assistant is optional.
Enter the access code you were given. It was set by whoever printed the code.
The destination behind this code is age-restricted. Nothing is stored about your answer beyond the fact that the gate was shown.
Cafe Andheri will email you the monsoon menu. You can skip this and go straight through.
Cafe Andheri has paused where this code points. Try again later — the code itself is working.
The monsoon tasting menu ran until 15 August. The code was set to expire on that date when it was printed.
We stopped this scan before sending you on. The destination was flagged after this code was distributed.
- Dish
- Paneer tikka
- Diet
- Vegetarian · not Jain
- Contains
- Dairy, mustard
- Spice
- Medium
Source: menu.cafeandheri.inTargets fetched at scan time
The physical-world entry point to the Ask AI Protocol. Dynamic-only, because AI deep-link formats change without notice and a static code would break permanently.
Branded interstitial for a password-protected destination. Styling follows the owner’s brand kit, not ours.
Age gate for restricted content. Deliberately not a cookie, which keeps the redirect path outside most consent regimes.
Email capture with a real skip. A gate that traps people is a gate that gets the printed code taken off the wall.
Paused state. Note what it does not say: nothing about limits, plans or payment, because none of those can pause a code.
Custom expiry page, written by the owner. An expiry is always a date someone chose — never a consequence of billing.
Threat interception. The printed code still resolves — to this warning rather than the destination, because Non-Negotiable 2 has no abuse exception.
QR-to-AI interstitial — the rules
Password gate — the rules
Age gate — the rules
Email-capture gate — the rules
Paused destination — the rules
Custom expiry page — the rules
Threat interception — the rules
- The gate runs at the edge, before any redirect, and adds no measurable latency to a correct entry.
- Failed attempts are rate-limited per code, not per person, because we do not identify people here.
- The owner sets and rotates the code. Support cannot read it, which is the point.
- Unbranded on Agency white-label accounts, so the reseller’s client never sees our name.
- No cookies on the redirect path — that is what keeps redirects outside most consent regimes.
- The gate is shown per scan rather than remembered, which is the honest trade for not tracking anyone.
- A declined answer goes nowhere. There is no second attempt flow designed to wear people down.
- The owner chooses the threshold; we do not assume 18 everywhere.
- Skipping always works. The destination is never held hostage.
- The address goes to the code owner, not to us, and never into any product we sell.
- Submissions are queued and retried, so a flaky connection does not lose the entry.
- We never sell scan data or contact data. That is a structural difference, stated in the terms.
- Only the owner can pause a destination. No limit, downgrade or failed payment ever produces this screen.
- Resuming propagates to the edge globally within ten seconds.
- The copy says what happened and what to do, in one sentence, with no "Error:" prefix.
- Scans still count while paused, so the owner can see the code is in active use.
- Expiry is a date or a scan count the owner chose deliberately.
- The page is theirs to write, so an ended campaign can still point somewhere useful.
- A cancelled subscription never produces this screen — that is Continuity Mode, and it keeps resolving to the last destination.
- Expiry can be lifted, and the same printed code starts working again.
- The classic attack is a clean code swapped after distribution, which is why every active destination is re-scanned weekly.
- The code still resolves. Suspension replaces the destination with this page rather than killing the code.
- Continuing anyway is possible but deliberately unstyled and secondary. We inform; we do not pretend to be the last word.
- No owner branding here — this is the one state where our name is the reassuring one.
- Reported destinations get an automated triage pass; only ambiguous cases wait for a human.
- Dynamic-only. Targets are fetched from the registry at redirect time, so printed packaging stays valid for years while the registry updates underneath.
- The prompt never enters the payload. A 200-character prompt would force a high QR version and a print size that fails on packaging.
- Every ask carries source attribution, so the answer is grounded rather than invented.
- For allergen and medical contexts, structured data is shown first and AI is offered second. Never AI-only.
- Free on every tier by deliberate choice — it drives protocol adoption, which is worth more than gating it.
- Advertising of any kind, on any tier, including Free
- A "made with" badge or upsell aimed at the scanner
- Tracking cookies, or any cookie at all on the redirect path
- A stored IP address — geo is derived at the edge and the address discarded
- Scan data sold, licensed, or turned into a behavioural product
- Redirect p95, no interstitial
- <30ms
- Interstitial page weight
- <14KB
- Works without JavaScript
- yes
- Cookies set
- 0