Rule-based dynamic QR codes, explained

Each rule can test the signals a scan actually carries. You combine as many as you need on a single rule.

All four signals come from the request the phone makes, not from anything you install or ask the reader to consent to. That is why rule-based routing works with no app, no SDK and no cookie — and also why it can only ever be as accurate as the request itself.

When several rules could match, the highest priority wins; ties fall back to the oldest rule. Put specific rules above broad ones so a precise match is not swallowed by a catch-all.

Think of the list as a decision order rather than a set of filters. Each rule is asked in turn and the first one that matches is applied — rules below it are never even evaluated, so a broad rule placed too high makes everything under it dead code.

Detection is an estimate. Some scans carry no country, unusual devices report nothing, and browsers send surprising languages. The default destination is what keeps those scans useful.

Without a default, an unmatched scan has nowhere to go — and the failures are invisible, because nothing in the dashboard reports 'a scan arrived that matched nothing' unless you deliberately test for it.

Conditions on one rule are combined with AND: a rule requiring Germany and iOS matches only a German iPhone, not a German Android and not an American iPhone. That precision is useful, but it multiplies quickly.

Four countries times two platforms is eight combinations, and each one is a rule to write, order and test. Prefer a few broad rules with a good default over a matrix that tries to name every case — the matrix is harder to keep correct and its gaps are exactly where real visitors land.

Knowing where the signals fail is what makes a rule set predictable. Country detection comes from IP geolocation: reliable on fixed lines and most mobile networks, wrong for VPN users, travellers on roaming SIMs and anyone behind a corporate gateway that egresses in another country.

Device and OS come from the user agent, which browsers and privacy tools increasingly trim or standardise to avoid fingerprinting — so a tablet may report as a desktop, and an unknown browser may report nothing at all. Language is the browser's stated preference, which is frequently the language of the operating system rather than the language the person reads comfortably.