Privacy

A Hatband QR code is a link to this page with the card after the #. Browsers never send that part to a server; this page reads it with JavaScript, in your browser, and shows it. It makes no requests of its own: its Content-Security-Policy forbids them.

What the host sees is what any web server sees when a page is requested: your IP address, your browser's user agent and the time. Never the card, never who is on it.