What we have shipped, newest first. Only released changes appear here.
QR studio: shaped codes, halftone art, ring frames, scan check
Platform
Shape masks (Pro & Enterprise): render your QR code inside a heart, star, paw, flower, apple, or cloud with an optional outline — the scannable code always sits on a protected quiet zone, so styling never breaks scanning.
Halftone art (Pro & Enterprise): upload a logo or artwork and it blends into the code itself, with an adjustable dot size to balance branding and scannability.
Ring frames (free): circular codes can add a printed ring with curved rim text — great for stickers and packaging.
Scan check: the preview is decoded in your browser after every change and shows a pass/warn badge, so you know a styled code still scans before you download it (Chrome, Edge, and Android browsers).
Everything renders in your browser and exports to PNG, SVG, PDF, and WebP — no upload required.
Scan map: a world map of where your codes are scanned, on Reports and every link's analytics page, built from city-level scan locations (IP-based, captured from August 2026 onward).
Conversion funnel: scans → tracked clicks → conversions → revenue on Reports, with revenue per link and per campaign.
Unique visitors: privacy-safe unique, new, and returning scanner counts — no cookies, no fingerprinting stored, just a keyed one-way hash.
Custom date ranges and filters: pick any window in the last year and filter Reports by link, country, or device; exports honor the same filters.
JSON export: both the dashboard and API scan exports now support format=json and include click ID, region, and coordinates.
Anomaly alerts: hourly spike/drop detection per link with email alerts and a signed link.anomaly webhook event.
MCP: get_analytics now honors granularity and timezone and returns the scan trend; new get_report, get_referrers, and get_funnel tools.
Bot transparency: crawler hits are counted separately and shown as “bot scans blocked” — they never inflate your analytics.
Digital business cards
Platform
Business cards: create hosted digital business cards from the dashboard — a scannable QR code opens a branded card page with one-tap contact save (vCard).
Included in Pro (5 cards, one per seat) and Enterprise (unlimited); edit the card anytime and every printed code shows the update.
Scan analytics: business card scans appear in the dashboard like any other dynamic link.
Reliability: fixed an edge-router bug where micro-page short links returned an error instead of the page.
Password reset, QR exports, trial, and API entitlements
Platform
Password reset: self-serve password reset flow.
QR exports: true 1024px PNG/PDF output and a new WebP format.
Billing: 7-day free trial for first-time subscribers at checkout.
API: plan entitlement now checked on every API/MCP request (keys are kept on downgrade and reactivate on upgrade).
Category leadership foundations
Phase D
Campaigns: group links into folders, filter the links table by campaign, and see a per-campaign scan rollup.
Destination safety check: every link is screened on create and update; dangerous schemes and private or internal hosts are flagged and served behind a warning page instead of silently breaking.
Live view: a dashboard page that streams your most recent scans and refreshes automatically.
Print Kit: generate a printable PDF sheet of QR codes and short URLs for a campaign or a selected set of links, rendered entirely in your browser.
Reserved short IDs: custom back-halves that collide with a site route (for example "status") are now rejected at creation, so a custom link can never resolve to the wrong page.
Enterprise procurement foundations
Phase C
Viewer role: invite read-only members who can see links and analytics but cannot change them.
Scoped API keys: restrict a key to specific permissions such as read-only or analytics-only access.
Scan-data retention: set a retention window after which old scan events become purge-eligible.
Honest single sign-on and a trust pack that documents our security posture without overstating it.
Redirect quality of service
Phase B
Faster redirects: hot links are cached, so repeat scans resolve with less database work.
Reliable webhooks: failed scan webhooks are retried with signed, verifiable payloads.
Public status page at /status with a real database connectivity check.
Bot filtering: known crawlers no longer inflate your scan counts or burn a scan limit.
Trust, authorization, and correctness
Phase A
Closed authorization gaps so every link, scan, and export is scoped to your workspace.
Hardened destination handling to reject script-executing URL schemes across every create path.
Correctness fixes to scan accounting and link protection (password, expiry, scan limit).
Viewer-local time
Analytics
Dashboard timestamps now render in your timezone instead of server UTC.
Analytics charts bucket by viewer-local days, so daily totals line up with your calendar.