Print the code
Design the QR in the portal — colors, quiet zone, error correction, your logo — and export it as print-ready SVG for a boarding pass, receipt, seatback card or poster.
SVG · vector · press-ready- Funded by
- Promoter
- Verified by
- Publisher
- Settled in
- Coins
Pay for signups,
not for scans.
Print a QR code on anything. When someone scans it they land inside a partner publisher’s app, and coins leave your campaign budget only after that publisher confirms a real signup — at the guest rate until they verify the person, at your full rate once they do.
Fund a budget, print a code, and watch it draw down. No spend until a scan converts.
Redemptions postingExample data
Each row is one scan that resolved: the campaign it came from, the publisher that verified the user, and the coins debited from the promoter’s budget. Guest rows are partial rewards awaiting verification.
Debited from campaign budgets · this view173 coins
128kscans routed to a publisher
41ksignups confirmed and settled
4checkpoints every scan clears before a coin moves
0coins spent before a publisher confirms a real signup
How it works
One scan, four checkpoints.
Nothing is charged to you until the fourth. Every stage is a checkpoint the scan has to clear, and the money only moves at the end.
Someone scans it
The platform checks the code is live, unexpired, under its use cap and inside budget, then sends the phone straight to the publisher’s store listing. Nothing redeemable travels with it. A blocked scan says which rule stopped it.
GET /r/{code} → App Store · PlayThe install is matched
After the user signs up in the app, the publisher’s server asks whether that install traces back to a scan — by Play install referrer on Android, by a short-window device match on iOS. Server to server, no code ever touches the app.
POST /v1/attribution/claimThe fee posts from budget
One database transaction moves the agreed marketing fee out of your campaign budget and into the publisher’s account. Double-entry, append-only. Whatever the publisher gives its new user is its own bonus, on its own terms.
Ledger · double-entryPricing model
Two rates for the same signup.
A publisher can hand coins to anyone who signs up, but you should not pay full price for a stranger. So a scan settles at one of two rates you set yourself — and the difference is held, not lost.
Guest
held10 of 50 coins
Somebody scanned and signed up, but the publisher has not vouched for who they are. They get the guest rate now, and the remaining 40 coins sit as pending_coins against a deadline.
Grace window set per partnership · default 7 days
Verified
posted50 of 50 coins
The publisher cleared the user against its own bar and said so. The held-back difference is released in a single idempotent call, so a retry cannot pay the same person twice.
Released after the deadline? Refused — the budget keeps the difference.
Promoter budget50
Publisher0
Never verified, never released — the 40 stays in the budget.
500verified signups, at most
2,500if none are ever verified
40coins held per signup, until verified
208installs the same budget buys at 120 coins each
Same budget, 292 more users — and every one of them is a signup a publisher has confirmed, not an install somebody reported.
Guest rate shown at the 20% default — you set the real one per partnership. Either way the funded budget is the ceiling: it draws down, it never overdraws.
How this differs
Priced on the signup, not the click.
Every row below is about what a pricing model bills you for and what it can prove. None of it is a claim about any particular network’s conduct.
What you pay forThis platformA signup the publisher has confirmedCPI networkA reported installAffiliate linkA click, or a claimed conversion
Who vouches for the userThis platformThe publisher, at its own barCPI networkThe network that bills youAffiliate linkNobody
Spend ceilingThis platformThe balance you funded — it draws down, never overdrawsCPI networkA daily cap, reconciled on an invoiceAffiliate linkUncapped
If the creative leaksThis platformVoid the batch; every later scan is refusedCPI networkPause the campaign and dispute afterwardsAffiliate linkThe link keeps working
Where the money is recordedThis platformDouble-entry ledger, append-onlyCPI networkA monthly statementAffiliate linkA monthly statement
Unverified usersThis platformBilled at the guest rate; the rest is heldCPI networkBilled in fullAffiliate linkBilled in full
What the code itself unlocksThis platformNothing — it opens a store listingCPI networkn/aAffiliate linkWhatever the link carries
Which side are you on
Two accounts, one ledger.
A promoter funds and prints. A publisher delivers and verifies. Every coin that moves between them is one entry on the same double-entry ledger.
For promoters
You have somewhere to print — a boarding pass, a receipt, a poster — and you want installs you only pay for when they are real.
- Fund a budget; it is the hard ceiling on spend
- Design and export print-ready codes
- Void a print run that leaks, instantly
- Watch the budget draw down per confirmed signup
For publishers
You have the audience and your own bar for what counts as a real user. Bring both, and set your own price for a verified signup.
- Set where scans land — Play, App Store, or web
- Confirm signups through the Partner API
- Verify on your own terms, at your own bar
- Earn the agreed fee straight from the budget
Who scans land in
The apps on the other side of the code.
A scan is only worth funding if it ends somewhere the person actually wanted to go. Publishers bring the destination; you bring the print run.
Travel appsFintechGrocery deliveryRide hailingStreamingTicketingLoyalty programsMarketplaces
Placeholder — replace with a real promoter quote about paying only for confirmed signups.
Placeholder — replace with a real publisher quote about setting its own verification bar.
Placeholder — replace with a real quote about voiding a leaked print run, or delete this card.
Money controls
The controls on a code you can’t recall.
A code in the wild is a spending instrument you cannot take back. These are the controls that keep a lost print run from becoming a lost budget.
- Budget is the ceiling
- A campaign spends only what you funded. When the budget runs dry, scans stop earning fees instead of quietly overdrawing.
- Hard stop
- The QR unlocks nothing
- A scan carries no token, key or code into the app — it opens a store listing, and the install is matched afterwards server-to-server. There is no path here that could unlock in-app content, which is what keeps it clear of App Store 3.1.1.
- By design
- Codes expire
- Every code is time-bound at creation. Set your own window, or zero for a code that never expires.
- Default 30 days
- Codes can be use-bound
- Unlimited by default, or single-use for a one-per-customer print run. The claim is atomic, so two simultaneous scans cannot both win the last use.
- max_uses
- Void a print run
- A batch goes missing or gets photographed and reposted — void those codes and every future scan on them is refused.
- Promoter action
- You can tighten, never loosen
- Shortening an expiry or lowering a cap is self-service. Extending one is a platform-admin action that lands in the audit log, so nobody quietly widens a money control.
- Admin override
- Suspension is immediate
- Offboarding an organization kills its live sessions and revokes its API key on the spot, rather than waiting for a session to time out.
- Not at token expiry
Before you fund
The questions that come first.
Six answers about what you are charged for, what stops a leaked print run, and what each side has to build.
When exactly do I get charged?
Only when a publisher confirms a signup that traces back to one of your scans. A scan on its own costs nothing — neither does an install that never signs up, or a signup the publisher cannot match to a scan.
What stops a photographed code from draining the budget?
Four things, stacked: the funded budget is a hard ceiling, codes expire (30 days by default), a code can be capped at max_uses, and you can void a whole print run so every future scan on it is refused.
Does this survive App Store review?
The QR unlocks nothing. It opens a store listing, and the install is matched afterwards server-to-server — no token, key or code ever travels into the app, which is what keeps it clear of App Store guideline 3.1.1.
How is an install matched on iOS, without a referrer?
By carrying the same reference Android carries, along a route that survives the install. Register an App Clip and iOS hands it to your app in a shared container, silently. Without one, the hand-off screen puts it on the clipboard when the scanner taps Continue and your app reads it at first open. Both name one exact scan — nothing is guessed from the device, which Apple does not permit.
What does the publisher have to build?
One server call. When a scanned user signs up, POST to the Partner API; call it again when the user clears your own verification bar. Both are idempotent, so a retry cannot pay for the same person twice.
What happens to the held coins if verification never comes?
They stay with your budget. The release call is refused after the grace window closes — 7 days by default, set per partnership — so an unverified user costs you the guest rate and nothing more.
Ready to print?
Create a promoter account, request a partnership with a publisher, fund a campaign, and design your first code. The budget you fund is the most you can ever spend.