Terms

A QR code hides its destination until the moment it is too late to reconsider. That is what makes a malicious one effective, and it is why these rules are enforced rather than merely stated.

Destinations are checked twice

Once when you set them and again on every single scan, because a code edited after it was approved is still pointing wherever it was edited to. Anything that is not an ordinary web address is refused outright, and so is anything pointing inside a private network.

Questions

Someone is using a code to scam people. What do I do?

Report it. There is a report link on every "code is gone" page and a public endpoint anyone can call — no account needed, because the person best placed to report a malicious code is the stranger who just scanned it. Reports go to a staffed queue, and an upheld one revokes the code permanently.

What happens to my dynamic codes if I stop paying?

They stop redirecting and a scan returns a "this code is no longer active" page. Nothing is deleted, and re-subscribing brings them straight back. Static codes are unaffected for ever — they do not depend on us at all, which is exactly why they are free.