Would You Put a QR Code
on Your Car?
The Privacy Risks. And How We Designed Around Every One.

Before we built Wavr, we made a list of every way it could be used to hurt someone. That list had seven items on it. We did not start writing product code until we had an architectural answer to each one. This post is that list, and those answers.

We are publishing this because we believe the strongest trust signal available to a privacy-first product is radical transparency about its threat model. A privacy policy is a legal document. This is a design document. The difference matters.

A stalker could scan a target's tag repeatedly to monitor their movements. Each scan reveals that the vehicle is present at a specific location. Over time, a pattern of scans builds a picture of the owner's routine.

Someone could place a fake sticker over the legitimate tag, redirecting scanners to a phishing page or a different contact channel designed to harvest information from good-faith finders.

QR codes are a known phishing vector. A malicious code can redirect a scanner to a page that downloads malware, harvests credentials, or prompts an app install from an untrusted source.

A scanner could attempt to use the contact session to determine where the owner lives, works, or regularly parks, building a location profile without the owner's awareness.

A bad actor could attempt to manipulate their device fingerprint or GPS signal to avoid being identified, or to impersonate a legitimate scanner such as a parking enforcement officer or emergency responder.

The contact channel itself could be weaponised to send abusive, threatening, or harassing messages to the owner under the cover of a legitimate parking report.

Every privacy claim a product makes falls into one of two categories: things that are enforced architecturally, and things that are enforced by policy. Architectural enforcement means the system cannot do the thing, regardless of what any employee or bad actor attempts. Policy enforcement means the company has promised not to do the thing.

Wavr's core privacy properties are architectural. Your phone number is not stored on the tag because there is no phone number field in the tag schema. Your location is not shared with the scanner because the contact flow has no mechanism to transmit it. These are not commitments we are making. They are descriptions of how the system works.

"A privacy policy is a legal document. What we built is a technical constraint. The difference is that one can be violated and the other cannot."

This does not mean Wavr is perfect. No system that allows strangers to contact each other can guarantee zero misuse. What we can guarantee is that every misuse attempt leaves a forensic record, that the owner retains control at every step, and that the asymmetry between scanner and owner is enforced at the infrastructure level rather than relying on good behaviour.