Give the staging database its own name

The staging database now runs as qrmaster_test instead of reusing the production name. Container and volume already kept the two apart, but a hand-typed psql session against two databases both called `qrmaster` looks identical on either side - the distinct name is what makes the wrong window obvious before a DELETE lands in it. The base compose file hardcodes `pg_isready -d qrmaster` in the db healthcheck, so the overlay has to override the probe as well. Without it the container stays unhealthy and web never starts, because it waits on service_healthy. Verified against `docker compose config`: staging resolves to qrmaster_test in POSTGRES_DB, DATABASE_URL and the healthcheck, while production still resolves to qrmaster. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Ignore .env.test
2026-08-12 22:20:30 +02:00 · 2026-08-12 22:14:01 +02:00 · 2026-08-12 22:09:56 +02:00 · 2026-08-12 19:44:08 +02:00 · 2026-08-12 19:01:14 +02:00 · 2026-08-11 23:35:57 +02:00
744 changed files with 412141 additions and 28207 deletions
--- a/.agents/pricing-strategy.md
+++ b/.agents/pricing-strategy.md
@@ -0,0 +1,234 @@
+# QR Master — Pricing Strategy
+*Erstellt: April 2026 | Basiert auf Marktforschung, Competitor-Scraping & SaaS-Benchmarks*
+
+---
+
+## 1. Marktkontext
+
+### QR-Code-Markt 2025/2026
+| Metrik | Wert |
+|--------|------|
+| Globale Marktgröße | $15,3 Mrd. (2025) |
+| CAGR bis 2030 | 16,1% |
+| US-Smartphone-User die QR scannen | 100+ Mio. monatlich |
+| Business-Adoption | 50% der Unternehmen nutzen QR-Codes aktiv |
+
+**Fazit:** Wachstumsmarkt mit noch großem Potenzial, besonders im KMU-Segment.
+
+---
+
+## 2. Wettbewerbs-Pricing-Map
+
+### Vollständige Marktübersicht (aus Firecrawl-Recherche)
+
+| Tool | Preis/Monat | Analytics | Dynamic | Bulk | Branding | Positionierung |
+|------|------------|-----------|---------|------|----------|----------------|
+| TQRCG | $5 | ✅ | ✅ | ❌ | ✅ | Value-Leader |
+| QRStuff | $5 | ❌ | ❌ | ✅ | ❌ | Budget |
+| ViralQR | $1,49 | ✅ | ✅ | ❌ | ✅ | Ultra-Budget |
+| Beaconstac | $5–24 | ✅ | ✅ | ✅ | ✅ | SMB–Enterprise |
+| Bitly QR | $10 | ✅ | ✅ | ❌ | ✅ | Mid-Market |
+| Unitag | $10 | ❌ | ✅ | ✅ | ✅ | Mid-Market |
+| ZebraQR | $9 | ✅ | ✅ | ❌ | ✅ | Hospitality-Nische |
+| QR Tiger | $12–15 | ✅ | ✅ | ✅ | ✅ | Mid-Market+ |
+| Hovercode | $15 | ✅ | ✅ | ✅ | ✅ | Growth-Fokus |
+| Flowcode | $10–15 | ✅ | ✅ | ❌ | ✅ | Design-Fokus |
+| Scanova | $20 | ✅ | ✅ | ✅ | ✅ | Premium |
+| QR Code Chimp | $20 | ✅ | ✅ | ✅ | ✅ | Premium-Design |
+| Uniqode | $10–30 | ✅ | ✅ | ✅ | ✅ | Enterprise |
+| QRFY | $25 | ✅ | ✅ | ✅ | ✅ | Premium-Flat |
+| QR Code Generator Pro | $15–29 | ✅ | ✅ | ✅ | ✅ | Agency |
+
+### Marktlücke für QR Master
+> **Kein einziges Tool unter $12 bietet Analytics + Bulk + Custom Branding + DSGVO gleichzeitig.**
+> Das ist exakt QR Masters Sweet Spot.
+
+---
+
+## 3. SaaS-Benchmark-Daten (Industrie)
+
+| Metrik | Benchmark | Quelle |
+|--------|-----------|--------|
+| Median Entry-Level Preis (SaaS) | $29/mo | Monetizely 2025 |
+| Free-to-Paid Conversion | ~5% | RevenueCat 2026 |
+| Anteil Jahres-Abos (vs. Monatlich) | 68% annual / 32% monthly | RevenueCat 2026 |
+| ARPU (Subscription Apps) | ~$30 | RevenueCat 2026 |
+| Freemium-Anteil unter SaaS | 38% der Unternehmen | Monetizely 2025 |
+| Hybrid-Pricing-Adoption | 61% | Monetizely 2025 |
+| SaaS Churn (SMB) | 3–5%/Monat | Benchmark |
+
+**Key Insight:** 68% der Subscriber wählen Jahrestarife. Das ist der wichtigste Hebel für Cashflow und Churn-Reduktion.
+
+---
+
+## 4. Value Metric Empfehlung
+
+### Aktuelles Modell: Anzahl dynamischer QR-Codes
+**Bewertung: Gut, aber optimierbar.**
+
+Die Anzahl dynamischer Codes skaliert mit dem wahrgenommenen Wert (mehr Codes = mehr Kampagnen = mehr Wert). Jedoch:
+- Limit von 8 FREE / 50 PRO / 500 BUSINESS ist nicht intuitiv kommuniziert
+- Kunden denken in "Projekten" oder "Kampagnen", nicht in "Codes"
+
+### Empfehlung: Hybrid-Metric einführen
+Primär-Metric behalten (Dynamic Codes), aber mit Sekundär-Metriken ergänzen:
+
+| Tier | Primär-Metric | Sekundär-Metriken |
+|------|--------------|-------------------|
+| FREE | 8 Dynamic Codes | 1 User, Basic Analytics, 30 Tage History |
+| PRO | 50 Dynamic Codes | 1–3 User, Full Analytics, 1 Jahr History, Custom Domain |
+| BUSINESS | 500 Dynamic Codes | Unlimitierte User, Advanced Analytics, Bulk, API |
+
+---
+
+## 5. Empfohlene Pricing-Struktur
+
+### Tier-Empfehlung (Monatlich / Jährlich)
+
+#### FREE — Kostenlos, für immer
+- **8 dynamische QR-Codes** (klar kommuniziert als "8 Kampagnen")
+- Unlimitierte statische Codes
+- Basis-Analytics (Scans, Datum)
+- QR Master Branding (nicht entfernbar)
+- **Ziel:** Acquisition, Habit-Building, Virality durch Branding
+
+#### PRO — €9/Monat (monatlich) | **€7/Monat (jährlich = €84/Jahr)**
+*Empfohlen für: Restaurants, lokale Unternehmen, Marketing-Einsteiger*
+- **50 dynamische QR-Codes**
+- Custom Branding (kein QR Master Logo)
+- Vollständige Analytics (Device, Location, OS, UTM)
+- 1 Jahr Analytics-History
+- Custom Domain für Redirects
+- Prioritäts-Support
+- **Rationale:** $7–9 liegt im bewiesenen Sweet Spot ($5–$10) für diese Zielgruppe. Beaconstac Starter bei $5 hat nur 100 Scans — wir haben keine Scan-Limits.
+
+#### BUSINESS — €24/Monat (monatlich) | **€19/Monat (jährlich = €228/Jahr)**
+*Empfohlen für: Agenturen, Retail-Chains, Event-Organisatoren*
+- **500 dynamische QR-Codes**
+- Bulk-Upload (Excel/CSV bis 1.000 Zeilen)
+- API-Zugriff
+- Team-Management (bis 5 User)
+- Erweiterte Analytics + Export (CSV, PDF)
+- White-Label Option
+- DSGVO-Compliance-Report
+- **Rationale:** $19–24 ist der Bereich wo Scanova ($20), Hovercode ($15) und QR Code Chimp ($20) spielen — aber keiner hat DSGVO + Bulk + Analytics zusammen.
+
+#### ENTERPRISE — Auf Anfrage (ab €99/Monat)
+*Für: Corporations, Franchise-Ketten*
+- Unlimitierte Codes
+- Dedizierter Account Manager
+- Custom SLA
+- SSO / SAML
+- On-Premise Option (optional)
+
+---
+
+## 6. Psychologische Preisgestaltung
+
+### Anchoring-Strategie
+Reihenfolge auf Pricing-Page: **BUSINESS → PRO → FREE** (von teuer nach günstig)
+→ PRO wirkt dadurch als "vernünftiger Kompromiss"
+
+### Decoy-Effekt
+PRO muss der offensichtliche "Best Deal" sein:
+- BUSINESS ist 2,7× teurer als PRO aber hat 10× mehr Codes → Nur für Power-User
+- FREE hat 6× weniger Codes als PRO → Upgrade liegt nahe
+
+### Jahres-Pricing-Push
+- Monatlich: €9 / €24
+- Jährlich: €7 / €19 (sparst 22% / 21%)
+- **Wichtig:** Jahrespreis prominent anzeigen mit "Spare 2 Monate" statt Prozent
+- Default-Toggle: **Jährlich** (da 68% aller Subscriber Jahrestarife wählen)
+
+### Charm vs. Round Pricing
+- PRO: **€9** (nicht €10) → Charm Pricing für Conversion
+- BUSINESS: **€24** (nicht €25) → Knapp unter psychologischer Grenze
+- Jahrestarife: **€84/Jahr** und **€228/Jahr** (rund → Premium-Signal)
+
+---
+
+## 7. Jahres-Discount-Strategie
+
+| Tier | Monatlich | Jährlich | Ersparnis |
+|------|-----------|----------|-----------|
+| PRO | €9/Mo | €84/Jahr (€7/Mo) | 22% / 2 Monate gratis |
+| BUSINESS | €24/Mo | €228/Jahr (€19/Mo) | 21% / 2,5 Monate gratis |
+
+**Kommunikation:** "2 Monate kostenlos bei jährlicher Zahlung" schlägt "20% Rabatt" in A/B-Tests regelmäßig.
+
+---
+
+## 8. Free-Tier-Optimierung
+
+### Ziel des Free-Tiers
+Nicht monetarisieren — **qualifizieren und konvertieren**.
+
+### Empfohlene Trigger für Upgrade-Prompts
+1. **Code-Limit erreicht** → "Du hast 8/8 Codes verwendet. Upgrade auf PRO für 50 Codes."
+2. **Analytics-Feature geklickt** → "Detaillierte Location-Analytics nur in PRO."
+3. **Custom Branding versucht** → "Entferne das QR Master Logo — upgrade auf PRO."
+4. **Bulk-Upload versucht** → "Bulk-Upload ist nur in BUSINESS verfügbar."
+5. **Nach 7 Tagen aktive Nutzung** → In-App Prompt: "Du nutzt QR Master aktiv — hole mehr raus."
+
+### Virality-Mechanismus
+- FREE-Codes enthalten subtiles "Made with QR Master" in Metadaten
+- QR-Code-Landing-Pages (bei Dynamic Redirects) zeigen "Powered by QR Master" Footer
+- Jeder Scan ist eine potenzielle Akquisition
+
+---
+
+## 9. Positioning Statement je Tier
+
+**FREE:**
+> "Starte kostenlos mit 8 professionellen QR-Codes — keine Kreditkarte erforderlich."
+
+**PRO:**
+> "Für Restaurants, lokale Geschäfte und Marketer: Unbegrenzte Änderungen, echte Analytics, dein Branding — für weniger als ein Mittagessen pro Monat."
+
+**BUSINESS:**
+> "Für Agenturen und Retail-Chains: Erstelle 500 Codes auf einmal, per Excel-Upload — DSGVO-konform, skalierbar, professionell."
+
+---
+
+## 10. Pricing Page Struktur (Empfehlung)
+
+### Elemente above the fold
+1. **Toggle: Monatlich / Jährlich** (Default: Jährlich)
+2. **3 Tier-Karten** in Reihenfolge: FREE → PRO (highlighted "Beliebteste Wahl") → BUSINESS
+3. **CTA je Tier:** "Kostenlos starten" / "14 Tage gratis testen" / "Jetzt upgraden"
+4. **Trust-Signal:** "Keine Kreditkarte für Free • DSGVO-konform • Jederzeit kündbar"
+
+### Weitere Sektionen
+- Feature-Vergleichstabelle (vollständig)
+- ROI-Rechner: "Wie viel sparst du durch dynamische QR-Codes vs. Neudruck?"
+- FAQ (Objections aus Product-Marketing-Context)
+- Testimonials-Sektion (Platzhalter für spätere echte Reviews)
+- Enterprise-CTA am Ende
+
+---
+
+## 11. Kurzfristige Maßnahmen (Quick Wins)
+
+| Priorität | Maßnahme | Impact |
+|-----------|----------|--------|
+| 🔴 Hoch | Jahrestarif als Default auf Pricing-Page setzen | +20–30% ARPU sofort |
+| 🔴 Hoch | "2 Monate gratis" Kommunikation (statt %) | +Conversion |
+| 🟡 Mittel | Upgrade-Prompts bei Feature-Gates einbauen | +Free-to-Paid |
+| 🟡 Mittel | 14-Tage PRO Trial (kreditkartenlos) | +Trial Signups |
+| 🟢 Niedrig | BUSINESS Jahrespreis auf €228 festlegen | Cashflow |
+| 🟢 Niedrig | Enterprise-Kontaktformular ergänzen | Upmarket |
+
+---
+
+## 12. Risiken & Gegenmaßnahmen
+
+| Risiko | Wahrscheinlichkeit | Gegenmaßnahme |
+|--------|-------------------|---------------|
+| ViralQR mit $1,49 unterbietbar | Mittel | Auf Analytics + DSGVO differenzieren, nicht Preis |
+| FREE-User konvertieren nicht | Hoch | Smarte Feature-Gates + E-Mail-Nurturing |
+| BUSINESS-Preis zu hoch für KMU | Mittel | Jährlich-Preis betonen: €19/mo fühlt sich zugänglich an |
+| Konkurrenten senken Preise | Niedrig | Value-Story stärken, nicht mitziehen |
+
+---
+
+*Datenbasis: Firecrawl-Scraping von 5+ Competitor-Seiten, QR Marktstatistiken 2026, RevenueCat State of Subscription Apps 2026, Monetizely SaaS Benchmark 2025, Product Marketing Context QR Master.*
--- a/.agents/product-marketing-context.md
+++ b/.agents/product-marketing-context.md
@@ -0,0 +1,98 @@
+# Product Marketing Context
+
+*Last updated: 03. März 2026*
+
+## Product Overview
+**One-liner:** Professionelle dynamische QR-Codes mit Fokus auf Analytics, Bulk-Erstellung und Datenschutz.
+**What it does:** QR Master ermöglicht es Unternehmen und Marketern, QR-Codes zu erstellen, deren Zieladresse auch nach dem Druck geändert werden kann (Dynamic QRs). Es bietet detaillierte Scan-Statistiken, Bulk-Generierung für große Mengen und spezifische Tools für WiFi, Menüs, vCards etc.
+**Product category:** QR Code Management Platform / Marketing Analytics Tool.
+**Product type:** SaaS (Next.js/Prisma Stack).
+**Business model:** Freemium (Abonnement-Modell über Stripe).
+- **FREE:** 8 dynamische Codes, unlimitierte statische Codes.
+- **PRO:** 50 dynamische Codes, Custom Branding, erweiterte Analytics.
+- **BUSINESS:** 500 dynamische Codes, Bulk-Upload, API-Zugriff.
+
+## Target Audience
+**Target companies:** Gastronomie (Restaurants, Cafés), Marketing-Agenturen, Event-Veranstalter, Einzelhandel (Packaging/Labels).
+**Decision-makers:** Marketing Manager, Restaurant-Inhaber, Betriebsleiter, IT-Verantwortliche (wegen DSGVO/Security).
+**Primary use case:** Aktualisierbare QR-Codes für Print-Materialien, um Druckkosten bei Änderungen zu sparen.
+**Jobs to be done:**
+- "Ersetze meine gedruckte Speisekarte digital, ohne bei jeder Preisänderung neu drucken zu müssen."
+- "Miss den Erfolg meiner Flyer-Kampagne durch genaue Scan-Daten."
+- "Erstelle 1.000 individuelle QR-Codes für meine Produktverpackungen in einem Rutsch."
+**Use cases:**
+- Digitale Speisekarten (PDF QR).
+- Kontaktlose Vernetzung (vCard).
+- WLAN-Zugang für Kunden (WiFi QR).
+- Marketing-Kampagnen mit Tracking (UTM-Support).
+
+## Personas
+| Persona | Cares about | Challenge | Value we promise |
+|---------|-------------|-----------|------------------|
+| Restaurant-Inhaber | Kosten, Einfachheit | Menüänderungen erfordern Neudruck | Ein QR-Code für immer, Menü online ändern |
+| Marketing Manager | Daten, ROI | Erfolg von Print-Kampagnen ist schwer messbar | Detaillierte Analytics (Scans, Location, Device) |
+| Logistik/Retail | Skalierung, Zeit | Tausende Codes manuell erstellen | Bulk-Generierung via Excel/CSV (bis 1.000 Stk.) |
+| IT-Sicherheitsbeauftragter | Datenschutz, DSGVO | Tracking von IPs ist rechtlich kritisch | Hashed IPs & Anonymisierung (GDPR-ready) |
+
+## Problems & Pain Points
+**Core problem:** Statische QR-Codes sind nach dem Druck "tot", wenn sich der Link ändert. Das führt zu teuren Nachdrucken und Müll.
+**Why alternatives fall short:**
+- Viele kostenlose Generatoren leiten nach einiger Zeit auf Werbung um oder verlangen plötzlich Geld.
+- Enterprise-Lösungen (Beaconstac etc.) sind für KMUs oft zu teuer und überladen.
+- Mangelnder Datenschutz bei vielen US-Anbietern.
+**What it costs them:** Zeit für manuelle Erstellung, hohe Druckkosten bei Fehlern, verlorene Tracking-Daten.
+**Emotional tension:** Stress bei Fehlern im Druck; Sorge vor Abmahnungen (Datenschutz).
+
+## Competitive Landscape
+**Direct:** QR-Code-Generator.com, Beaconstac, Flowcode.
+**Secondary:** Canva (QR Feature), Adobe Express.
+**Indirect:** Linktree, NFC-Tags.
+**Unterschied:** QR Master ist spezialisierter als Design-Tools, aber preiswerter und datenschutzfreundlicher als US-Enterprise-Lösungen.
+
+## Differentiation
+**Key differentiators:**
+- **Privacy-First:** Hashed IPs (DSGVO-konform), kein PII-Storage.
+- **Bulk-Power:** Excel/CSV-Import bis zu 1.000 Zeilen im Business Plan.
+- **Nischen-Tools:** Hochspezialisierte Generatoren für WiFi, Crypto, Feedback etc.
+**How we do it differently:** Wir trennen die Erstellung (Tools) klar vom Management (Dashboard) und bieten für beides optimierte Flows.
+**Why that's better:** Nutzer finden sofort das richtige Tool für ihr Problem und können später nahtlos ins Management-System wechseln.
+
+## Objections
+| Objection | Response |
+|-----------|----------|
+| "Warum für QR-Codes bezahlen?" | Statische sind kostenlos, aber dynamische sparen Druckkosten bei Link-Änderungen und bieten Tracking. |
+| "Ist Tracking erlaubt?" | Ja, wir nutzen Hashed IPs und IP-Anonymisierung, um DSGVO-konform zu bleiben. |
+| "Was passiert, wenn ich kündige?" | Statische Codes bleiben ewig aktiv. Dynamische werden pausiert, können aber jederzeit reaktiviert werden. |
+
+## Switching Dynamics
+**Push:** Frust über teure Nachdrucke oder unzuverlässige Gratis-Generatoren.
+**Pull:** Wunsch nach professionellen Analytics und einfacher Bulk-Verarbeitung.
+**Habit:** "Wir drucken einfach neue Flyer" (Teuer und ineffizient).
+**Anxiety:** Sorge, dass QR-Codes nach dem Wechsel nicht mehr funktionieren.
+
+## Customer Language
+**How they describe the problem:**
+- "Link ändern nach Druck"
+- "QR-Code Tracking DSGVO"
+- "Bulk QR Code erstellen Excel"
+**Words to use:** "Dynamisch", "Trackbar", "DSGVO-konform", "Änderbar nach Druck", "Bulk-Power".
+**Words to avoid:** "Permanent" (wenn dynamisch gemeint ist), "Tracking" (ohne Datenschutz-Hinweis).
+
+## Brand Voice
+**Tone:** Professionell, vertrauenswürdig, effizient.
+**Style:** Direkt, technisch versiert, aber einfach verständlich.
+**Personality:** Der zuverlässige Partner für moderne Print-Digital-Workflows.
+
+## Proof Points
+**Metrics:** Bis zu 1.000 Codes pro Upload, 8 kostenlose dynamische QRs.
+**Testimonials:** (Noch zu ergänzen basierend auf User-Feedback)
+**Value themes:**
+| Theme | Proof |
+|-------|-------|
+| Kosten sparen | Reprint-Calculator zeigt Ersparnis bei dynamischen Codes. |
+| Datenschutz | Hashed IP Implementation im Codebase (`src/lib/hash.ts`). |
+| Skalierung | Bulk-Feature im Business Plan (`src/app/(main)/(app)/bulk-creation`). |
+
+## Goals
+**Business goal:** Erhöhung der PRO- und BUSINESS-Abonnements.
+**Conversion action:** Account-Erstellung (Signup) oder Start eines Free-Trials.
--- a/.claude/hooks/check-gstack.sh
+++ b/.claude/hooks/check-gstack.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+# Block skill usage when gstack is not installed globally.
+if [ ! -d "$HOME/.claude/skills/gstack/bin" ]; then
+  cat >&2 <<'MSG'
+BLOCKED: gstack is not installed globally.
+gstack is required for AI-assisted work in this repo.
+
+Install it:
+git clone --depth 1 https://github.com/garrytan/gstack.git ~/.claude/skills/gstack
+cd ~/.claude/skills/gstack && ./setup --team
+
+Then restart your AI coding tool.
+MSG
+  echo '{"permissionDecision":"deny","message":"gstack is required but not installed. See stderr for install instructions."}'
+  exit 0
+fi
+
+echo '{}'
--- a/.claude/launch.json
+++ b/.claude/launch.json
@@ -0,0 +1,17 @@
+{
+  "version": "0.0.1",
+  "configurations": [
+    {
+      "name": "dev",
+      "runtimeExecutable": "npm",
+      "runtimeArgs": ["run", "dev"],
+      "port": 3050
+    },
+    {
+      "name": "dev-node",
+      "runtimeExecutable": "node",
+      "runtimeArgs": ["node_modules/next/dist/bin/next", "dev", "-p", "3050"],
+      "port": 3050
+    }
+  ]
+}
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -0,0 +1,15 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Skill",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/check-gstack.sh\""
+          }
+        ]
+      }
+    ]
+  }
+}
--- a/.claude/settings.local.json
+++ b/.claude/settings.local.json
@@ -1,33 +1,35 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(docker-compose:*)",
-      "Bash(docker container prune:*)",
-      "Bash(npx prisma migrate dev:*)",
-      "Bash(npx prisma:*)",
-      "Bash(npm run dev)",
-      "Bash(timeout:*)",
-      "Bash(taskkill:*)",
-      "Bash(npx kill-port:*)",
-      "Bash(docker compose:*)",
-      "Bash(curl -I https://fonts.googleapis.com)",
-      "Bash(wsl:*)",
-      "Read(//c/Users/a931627/.ssh/**)",
-      "Bash(ssh-keygen:*)",
-      "Bash(cat:*)",
-      "Bash(git remote add:*)",
-      "Bash(git push:*)",
-      "Bash(git remote set-url:*)",
-      "Bash(npm install:*)",
-      "Bash(npm run build:*)",
-      "Bash(ls:*)",
-      "Bash(curl:*)",
-      "Bash(echo \"\n\n## CSRF Debug aktiviert!\n\nBitte teste jetzt:\n1. Browser zu http://localhost:3050/create\n2. Dynamic QR Code erstellen versuchen\n3. Server-Logs zeigen jetzt [CSRF Debug] Output\n\nIch sehe dann:\n- Ob headerToken vorhanden ist\n- Ob cookieToken vorhanden ist  \n- Ob sie übereinstimmen\n\n---\n\nStripe Portal 500 Error ist separates Problem:\nhttps://dashboard.stripe.com/test/settings/billing/portal\n→ Customer Portal Configuration muss erstellt werden\n\")",
-      "Bash(pkill:*)",
-      "Skill(shadcn-ui)",
-      "Bash(find:*)"
-    ],
-    "deny": [],
-    "ask": []
-  }
-}
+{
+  "permissions": {
+    "allow": [
+      "Bash(docker-compose:*)",
+      "Bash(docker container prune:*)",
+      "Bash(npx prisma migrate dev:*)",
+      "Bash(npx prisma:*)",
+      "Bash(npm run dev)",
+      "Bash(timeout:*)",
+      "Bash(taskkill:*)",
+      "Bash(npx kill-port:*)",
+      "Bash(docker compose:*)",
+      "Bash(curl -I https://fonts.googleapis.com)",
+      "Bash(wsl:*)",
+      "Read(//c/Users/a931627/.ssh/**)",
+      "Bash(ssh-keygen:*)",
+      "Bash(cat:*)",
+      "Bash(git remote add:*)",
+      "Bash(git push:*)",
+      "Bash(git remote set-url:*)",
+      "Bash(npm install:*)",
+      "Bash(npm run build:*)",
+      "Bash(ls:*)",
+      "Bash(curl:*)",
+      "Bash(echo \"\n\n## CSRF Debug aktiviert!\n\nBitte teste jetzt:\n1. Browser zu http://localhost:3050/create\n2. Dynamic QR Code erstellen versuchen\n3. Server-Logs zeigen jetzt [CSRF Debug] Output\n\nIch sehe dann:\n- Ob headerToken vorhanden ist\n- Ob cookieToken vorhanden ist  \n- Ob sie übereinstimmen\n\n---\n\nStripe Portal 500 Error ist separates Problem:\nhttps://dashboard.stripe.com/test/settings/billing/portal\n→ Customer Portal Configuration muss erstellt werden\n\")",
+      "Bash(pkill:*)",
+      "Skill(shadcn-ui)",
+      "Bash(find:*)",
+      "Bash(ls -la \"/c/Users/User/Documents/QR-master/src/app/\\(main\\)/\\(marketing\\)/\")",
+      "Bash(npx tsc:*)"
+    ],
+    "deny": [],
+    "ask": []
+  }
+}
--- a/.codex/hooks.json
+++ b/.codex/hooks.json
@@ -0,0 +1,15 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Skill",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "'C:\\Users\\timo\\Documents\\qrmaster\\QR-master\\.codex\\hooks\\check-gstack.sh'"
+          }
+        ]
+      }
+    ]
+  }
+}
--- a/.codex/hooks/check-gstack.sh
+++ b/.codex/hooks/check-gstack.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+# Block skill usage when gstack is not installed globally.
+if [ ! -d "$HOME/.claude/skills/gstack/bin" ]; then
+  cat >&2 <<'MSG'
+BLOCKED: gstack is not installed globally.
+gstack is required for AI-assisted work in this repo.
+
+Install it:
+git clone --depth 1 https://github.com/garrytan/gstack.git ~/.claude/skills/gstack
+cd ~/.claude/skills/gstack && ./setup --team
+
+Then restart your AI coding tool.
+MSG
+  echo '{"permissionDecision":"deny","message":"gstack is required but not installed. See stderr for install instructions."}'
+  exit 0
+fi
+
+echo '{}'
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,55 +1,55 @@
-# Dependencies
-node_modules
-npm-debug.log
-yarn-error.log
-pnpm-debug.log
-
-# Testing
-coverage
-.nyc_output
-
-# Next.js
-.next
-out
-dist
-build
-
-# Environment files
-.env
-.env.local
-.env.development.local
-.env.test.local
-.env.production.local
-
-# IDEs
-.vscode
-.idea
-*.swp
-*.swo
-*~
-
-# OS
-.DS_Store
-Thumbs.db
-
-# Git
-.git
-.gitignore
-
-# Docker
-Dockerfile
-docker-compose*.yml
-.dockerignore
-
-# Misc
-README.md
-.prettierrc
-.eslintrc.json
-*.md
-
-# Logs
-logs
-*.log
-
-# Prisma
-prisma/migrations
+# Dependencies
+node_modules
+npm-debug.log
+yarn-error.log
+pnpm-debug.log
+
+# Testing
+coverage
+.nyc_output
+
+# Next.js
+.next
+out
+dist
+build
+
+# Environment files
+.env
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+
+# IDEs
+.vscode
+.idea
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Git
+.git
+.gitignore
+
+# Docker
+Dockerfile
+docker-compose*.yml
+.dockerignore
+
+# Misc
+README.md
+.prettierrc
+.eslintrc.json
+*.md
+
+# Logs
+logs
+*.log
+
+# Prisma
+# prisma/migrations  # Now included in Docker image for deployment
--- a/.editorconfig
+++ b/.editorconfig
@@ -1,14 +1,14 @@
-root = true
-
-[*]
-charset = utf-8
-end_of_line = lf
-insert_final_newline = true
-trim_trailing_whitespace = true
-
-[*.{js,jsx,ts,tsx,json,css,scss,md}]
-indent_style = space
-indent_size = 2
-
-[*.md]
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.{js,jsx,ts,tsx,json,css,scss,md}]
+indent_style = space
+indent_size = 2
+
+[*.md]
 trim_trailing_whitespace = false
--- a/.env.example
+++ b/.env.example
@@ -1,12 +1,37 @@
-NODE_ENV=production
-PORT=3000
-DATABASE_URL=postgresql://postgres:postgres@db:5432/qrmaster?schema=public
-DIRECT_URL=postgresql://postgres:postgres@db:5432/qrmaster?schema=public
-NEXTAUTH_URL=http://localhost:3000
-NEXTAUTH_SECRET=CHANGE_ME
-NEXT_PUBLIC_APP_URL=http://localhost:3000
-GOOGLE_CLIENT_ID=
-GOOGLE_CLIENT_SECRET=
-REDIS_URL=redis://redis:6379
-IP_SALT=CHANGE_ME_SALT
-ENABLE_DEMO=true
+# Database credentials (used by both db and web services in docker-compose.yml)
+POSTGRES_USER=postgres
+POSTGRES_PASSWORD=postgres
+POSTGRES_DB=qrmaster
+
+# Note: DATABASE_URL and DIRECT_URL are auto-generated from POSTGRES_* vars in docker-compose.yml
+# You don't need to set them here when using Docker Compose
+NODE_ENV=production
+PORT=3000
+NEXTAUTH_URL=http://localhost:3000
+NEXTAUTH_SECRET=CHANGE_ME
+NEXT_PUBLIC_APP_URL=http://localhost:3000
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+REDIS_URL=redis://redis:6379
+IP_SALT=CHANGE_ME_SALT
+ENABLE_DEMO=true
+
+# SMTP (for welcome + retention emails via nodemailer)
+SMTP_HOST=smtp.qrmaster.net
+SMTP_PORT=465
+SMTP_USER=timo@qrmaster.net
+SMTP_PASS=
+
+# Cron job protection — generate with: openssl rand -base64 32
+CRON_SECRET=
+
+# TikTok OAuth / posting (server-side only)
+# Source of truth for cron posting: QRMaster server .env
+# Production example: https://qrmaster.net/api/tiktok/callback
+# Local dev example: http://localhost:3000/api/tiktok/callback
+# Tokens are saved in the DB after the OAuth callback; do not store access tokens here.
+TIKTOK_CLIENT_KEY=
+TIKTOK_CLIENT_SECRET=
+TIKTOK_REDIRECT_URI=https://qrmaster.net/api/tiktok/callback
+TIKTOK_ADMIN_KEY=
+TIKTOK_EXPECTED_OPEN_ID=
--- a/.eslintrc.json
+++ b/.eslintrc.json
@@ -0,0 +1,6 @@
+{
+  "extends": [
+    "next/core-web-vitals",
+    "next/typescript"
+  ]
+}
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -0,0 +1,39 @@
+## Summary
+
+- 
+
+## Change Type
+
+- [ ] QRMaster SEO page
+- [ ] QRMaster landing/tool page
+- [ ] QRMaster conversion/pricing change
+- [ ] GreenLens content/ASO workflow
+- [ ] Bug fix
+- [ ] Other
+
+## SEO / Content Review
+
+- [ ] Primary search intent is clear.
+- [ ] Metadata is present and specific.
+- [ ] Exactly one H1 is rendered for each new or changed page.
+- [ ] Internal links are added to relevant money pages.
+- [ ] CTA is specific to the page/use case.
+- [ ] Duplicate or thin content risk was checked.
+- [ ] Schema/structured data was added or intentionally skipped.
+
+## Verification
+
+- [ ] Build passes.
+- [ ] Lint passes.
+- [ ] Links/CTAs checked.
+- [ ] Screenshots or notes included for UI changes.
+
+## Codex Review Prompt
+
+For QRMaster SEO/page changes, run:
+
+```text
+Use docs/automations/qrmaster-pr-seo-review.md and review this PR for SEO,
+conversion, internal linking, duplicate content, schema, and build/lint risk.
+```
+
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,26 +1,26 @@
-name: CI
-
-on: [push]
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    
-    steps:
-      - uses: actions/checkout@v4
-      
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          
-      - name: Install dependencies
-        run: npm ci
-        
-      - name: Generate Prisma Client
-        run: npx prisma generate
-        
-      - name: Build application
-        run: npm run build
-        
-      - name: Run linter
-        run: npm run lint
+name: CI
+
+on: [push, pull_request]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    
+    steps:
+      - uses: actions/checkout@v4
+      
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          
+      - name: Install dependencies
+        run: npm ci
+        
+      - name: Generate Prisma Client
+        run: npx prisma generate
+        
+      - name: Build application
+        run: npm run build
+        
+      - name: Run linter
+        run: npm run lint
--- a/.gitignore
+++ b/.gitignore
@@ -1,51 +1,96 @@
-# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
-
-# dependencies
-/node_modules
-/.pnp
-.pnp.js
-
-# testing
-/coverage
-
-# next.js
-/.next/
-/out/
-
-# production
-/build
-
-# misc
-.DS_Store
-*.pem
-
-# debug
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-
-# local env files
-.env*.local
-.env
-
-# vercel
-.vercel
-
-# typescript
-*.tsbuildinfo
-next-env.d.ts
-
-# prisma
-
-
-# docker
-docker-compose.override.yml
-*.sql
-/backups/
-
-# logs
-logs
-*.log
-
-# local dev script
-dev-server.js
+# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
+
+# dependencies
+/node_modules
+/.pnp
+.pnp.js
+
+# testing
+/coverage
+
+# next.js
+/.next/
+/.next-stale-module-cache/
+/out/
+
+# production
+/build
+
+# misc
+.DS_Store
+*.pem
+
+# debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# local env files
+.env*.local
+.env
+.env.test
+
+# vercel
+.vercel
+
+# typescript
+*.tsbuildinfo
+next-env.d.ts
+
+# prisma
+# /prisma/migrations/  # Now tracked in Git for deployment
+
+# docker
+docker-compose.override.yml
+*.sql
+!prisma/migrations/**/*.sql
+# Hand-applied schema changes and analysis queries belong in history.
+# Backup dumps land in the repo root, so they stay ignored.
+!sql/**/*.sql
+/backups/
+
+# logs
+logs
+*.log
+
+# project-specific
+Leads/
+/marketing/
+output/
+remotion/
+
+# local dev script
+dev-server.js
+.gstack/
+
+# atom-eve agent build/runtime artifacts
+/.output/
+/.eve/
+/.workflow-data/
+
+.env.meta   
+
+# Local temporary files, test scripts, and reports
+tmp/
+.codex-temp/
+*.report.html
+*.report.json
+tmp_*.js
+test_email.py
+meta-fix.js
+read-inbox.mjs
+quora_antwort_statisch_dynamisch.txt
+
+# Local blog audit reports and temporary snapshots
+scratch_blog_analysis.json
+scratch_scored_blog_posts.json
+src/lib/blog-data.snapshot-*.ts
+
+# Local developer-package workspaces and unreferenced generated media
+/packages/
+/public/Events/
+/public/Gyms/
+/public/Hotels/
+/public/Real Estate/
+/public/restaurant/
+/.qr-master-api-health-state
--- a/.hermes/desktop-attachments/dataset_tiktok-scraper_2026-07-08_18-16-32-878-2.json
+++ b/.hermes/desktop-attachments/dataset_tiktok-scraper_2026-07-08_18-16-32-878-2.json
--- a/.hermes/desktop-attachments/dataset_tiktok-scraper_2026-07-08_18-16-32-878.csv
+++ b/.hermes/desktop-attachments/dataset_tiktok-scraper_2026-07-08_18-16-32-878.csv
--- a/.hermes/desktop-attachments/dataset_tiktok-scraper_2026-07-08_18-16-32-878.json
+++ b/.hermes/desktop-attachments/dataset_tiktok-scraper_2026-07-08_18-16-32-878.json
--- a/.hermes/plans/2026-07-13_151727-qr-master-decision-content-and-market-proof.md
+++ b/.hermes/plans/2026-07-13_151727-qr-master-decision-content-and-market-proof.md
@@ -0,0 +1,219 @@
+# QR Master: Decision-Content + Market-Proof Implementation Plan
+
+> **For Hermes:** Execute only after Timo explicitly asks to implement. Do not create a page cluster before the hub has real search/conversion signals.
+
+**Goal:** Ship one German decision page for the *static vs. dynamic QR code* decision, instrument it with existing analytics, then test the exact message with real DACH restaurants/cafés before expanding SEO content.
+
+**Architecture:** Reuse the existing localized, data-driven use-case route `src/app/de/[slug]/page.tsx` and `UseCasePageTemplate`. Add one German content object to `src/lib/growth-pages-de.ts`; the route already creates static params, self-canonical metadata, hreflang pairs, Breadcrumb/FAQ schema and CTA tracking. Do not touch the English restaurant page: it already owns the restaurant-menu intent at `/restaurants`, and the old English use-case route redirects there.
+
+**Tech Stack:** Next.js App Router, TypeScript, existing `UseCasePageTemplate`, PostHog (`MarketingPageTracker` / `TrackedCtaLink`), npm.
+
+---
+
+## Current repo facts
+
+- German localized use-cases are generated from `src/lib/growth-pages-de.ts:29` through `src/app/de/[slug]/page.tsx:14-108`.
+- The route gives each item a self-canonical and creates static params from the data object (`src/app/de/[slug]/page.tsx:14-38`).
+- The existing template already tracks page views as `landing_page_viewed` and CTA clicks as `cta_clicked` (`src/components/marketing/MarketingAnalytics.tsx:28-93`). Do **not** create parallel events until the funnel’s actual setup/signup events are located.
+- `/use-cases/restaurant-menu-qr-codes` is a permanent redirect to `/restaurants` (`next.config.mjs:89-92`). The `/restaurants` page already owns English menu/PDF/reprint copy (`src/app/(main)/(marketing)/restaurants/page.tsx:34-69`).
+- No German restaurant/speisekarte page exists in `src/lib/growth-pages-de.ts` today.
+
+## Non-goals
+
+- No ten-page pSEO rollout.
+- No bespoke template, calculator, schema type, A/B framework, or new tracking architecture.
+- No claim of guaranteed savings, GDPR compliance, or “instant” changes unless product behaviour and legal wording are verified.
+- No customer-story or dashboard screenshot presented as proof until it is real.
+
+---
+
+### Task 1: Lock the positioning and page boundary
+
+**Objective:** Ensure this page wins a new decision query instead of competing with generic generator or restaurant-menu pages.
+
+**Files:**
+- No code change.
+- Review: `src/app/(marketing-de)/qr-code-erstellen/page.tsx:26-87`
+- Review: `src/app/(main)/(marketing)/restaurants/page.tsx:34-170`
+- Review: `next.config.mjs:63-97`
+
+**Step 1: Adopt the exact target user and job**
+
+- Segment: DACH restaurant/café operators with printed table tents, menus, takeaway flyers, or window signs.
+- Job: Decide *before printing* whether a QR destination needs to stay editable.
+- Primary query family: `statischer oder dynamischer qr code`, `unterschied statischer dynamischer qr code`, `qr code link später ändern`.
+- Explicit exclusion: do not target the generic “free QR generator” query or try to become a restaurant POS/menu-builder page.
+
+**Step 2: Define the content angle**
+
+Use this hero content:
+
+- H1: `Statischer oder dynamischer QR-Code? Entscheide vor dem Druck.`
+- Intro: `Wenn sich dein Link, Menü, PDF oder Angebot später ändern könnte, brauchst du einen QR-Code, dessen Ziel du ohne Neudruck aktualisieren kannst.`
+- Primary CTA: `Dynamischen QR-Code erstellen`
+- Secondary CTA: `Zum QR-Code-Generator`
+
+**Step 3: Define the one-sentence decision rule**
+
+`Bleibt das Ziel garantiert unverändert, reicht ein statischer QR-Code. Kann sich Ziel, PDF, Menü, Aktion oder Platzierung ändern, ist ein dynamischer QR-Code die sichere Wahl vor dem Druck.`
+
+**Acceptance criteria:** The page is clearly a decision hub, not another restaurant-menu landing page; it contains the decision within the first viewport.
+
+---
+
+### Task 2: Add one localized use-case record
+
+**Objective:** Publish exactly one data-backed German page at `/de/statischer-vs-dynamischer-qr-code` through the current route/template.
+
+**Files:**
+- Modify: `src/lib/growth-pages-de.ts` (inside `useCasePagesDe`, before the closing object)
+
+**Step 1: Add the record shape**
+
+Add a `UseCasePageContentDe` record with:
+
+```ts
+'statischer-vs-dynamischer-qr-code': {
+  enSlug: 'dynamic-qr-code-generator',
+  slug: 'statischer-vs-dynamischer-qr-code',
+  href: '/de/statischer-vs-dynamischer-qr-code',
+  title: 'Statischer oder dynamischer QR-Code?',
+  cluster: 'qr-code-basics',
+  parentHref: '/dynamic-qr-code-generator',
+  parentTitle: 'Dynamischer QR-Code-Generator',
+  ctaLabel: 'Dynamischen QR-Code erstellen',
+  eyebrow: 'Vor dem Druck entscheiden',
+  titleSuffix: 'vor dem Druck',
+  metaDescription: 'Statischer oder dynamischer QR-Code? Vergleiche Änderbarkeit, Druckrisiko und Tracking – und entscheide vor Flyer, Speisekarte oder Tischaufsteller.',
+  // remaining template fields in the following steps
+}
+```
+
+**Step 2: Write unique decision content—not token substitutions**
+
+Populate the template fields with these content requirements:
+
+- `answer`: the exact decision rule from Task 1.
+- `whenToUse`: three observable conditions: destination cannot change; a PDF/menu/offer might change; scans must be measured by placement.
+- `comparisonItems`: only concrete trade-offs, e.g. destination after print, response to a changed PDF, scan measurement. Validate the template’s left/right presentation before wording the boolean values.
+- `howToSteps`: create a dynamic code → print it once → change the destination later in the dashboard.
+- `workflowCards`: one realistic café example (30 table tents, new menu PDF), one flyer/event example, one separate-placement tracking example.
+- `checklist`: test print size/contrast, use a descriptive scan CTA, point to a mobile target, keep a dynamic target when it can change.
+- `supportLinks`: `/dynamic-qr-code-generator`, `/qr-code-tracking`, `/reprint-calculator`, `/qr-code-print-size-guide` after verifying every target resolves.
+- `faq`: 3–4 factual FAQs such as “Kann ich den Link eines statischen QR-Codes später ändern?” and “Wann lohnt sich ein dynamischer QR-Code für eine Speisekarte?”
+
+**Step 3: Avoid fictional proof**
+
+Set no `heroImage` unless a real product/dashboard or verified purpose-built illustration exists. If the template needs an image visually, use a clearly labelled product workflow asset—not a fake customer outcome or fabricated dashboard state.
+
+**Acceptance criteria:** `generateStaticParams` includes the slug; the page has unique German title, description, H1, intro, FAQ and internal-link context.
+
+---
+
+### Task 3: Verify rendered SEO and conversion path
+
+**Objective:** Confirm the new route is indexable, non-cannibalizing, and sends users into a working generator flow.
+
+**Files:**
+- Verify: `src/app/de/[slug]/page.tsx:18-52`
+- Verify: `src/components/marketing/UseCasePageTemplate.tsx:440-526`
+- Verify: `src/app/sitemap.ts`
+
+**Step 1: Run static checks**
+
+Run from repository root:
+
+```bash
+npm run lint
+npm run build
+```
+
+Expected: both commands exit `0`.
+
+**Step 2: Run the local smoke test**
+
+Start the app with `npm run dev`, then inspect:
+
+- `http://localhost:3050/de/statischer-vs-dynamischer-qr-code`
+- page source/rendered HTML contains one H1
+- canonical is `https://www.qrmaster.net/de/statischer-vs-dynamischer-qr-code`
+- page has language alternates generated by `buildLanguageAlternates`
+- primary CTA reaches the German setup/generator flow actually intended for conversion
+- all related-resource URLs return a valid page (not redirects to irrelevant pages or 404)
+- mobile: H1, decision rule, and primary CTA fit/appear before excessive scrolling; comparison is readable
+
+**Step 3: Verify tracking rather than inventing event names**
+
+Use the existing PostHog events first:
+
+- `landing_page_viewed` with `landing_page_slug=/de/statischer-vs-dynamischer-qr-code`
+- `cta_clicked` with `cta_location=hero_primary` and this use case slug
+
+Before adding `qr_setup_started` or `signup_completed`, locate their real implementation. If no downstream events exist, add them only after documenting the actual generator/signup handoff and preserving no-PII tracking.
+
+**Acceptance criteria:** build passes, canonical and CTA are correct, events appear in PostHog (or the tracking limitation is explicitly documented), and there is no new page aimed at `/restaurants`’ restaurant-menu keyword set.
+
+---
+
+### Task 4: Run a 7-day manual market test in parallel
+
+**Objective:** Test whether the language describes a costly current problem, not merely whether people say they like the page.
+
+**Files:**
+- No product code required.
+- Create a local working sheet only if Timo asks; do not automate outreach first.
+
+**Step 1: Build a 20-prospect list (45 minutes max)**
+
+Collect 20 independent restaurants/cafés in one local area. Criteria:
+
+- visible printed menu/table-tent/window QR in Google photos, Instagram, or own site;
+- a current menu PDF, ordering page, seasonal offer, or booking link;
+- reachable email, Instagram, or contact form.
+
+**Step 2: Send 10 short research-first messages**
+
+Use this wording, adapted with the venue’s name and observed QR use:
+
+> Hi [Name], kurze Frage – ich schaue mir gerade an, wie Restaurants QR-Codes auf Tischaufstellern und Speisekarten nutzen. Musstet ihr den Link, die PDF-Speisekarte oder Preise nach dem Druck schon einmal ändern? Was habt ihr dann gemacht? Ich verkaufe dir gerade nichts; ich will den Ablauf verstehen.
+
+Do not pitch QR Master in the first message.
+
+**Step 3: Follow up only with a relevant offer**
+
+If they mention an actual recent issue, reply:
+
+> Danke, genau diesen Fall untersuche ich. Ich baue ein Setup, bei dem der gedruckte QR-Code bleibt und du nur das Ziel aktualisierst. Wenn du willst, richte ich dir den nächsten Code testweise ein und prüfe vorher kostenlos, ob euer aktueller Code überhaupt update-sicher ist.
+
+**Step 4: Record proof, not compliments**
+
+For every reply capture: last incident, workaround, print/time cost, current QR tool, decision-maker, and whether they agree to a test/pilot. Strong evidence is a real past case, a follow-up call, a current QR audit, or a pilot—not “klingt gut”.
+
+**Acceptance criteria:** at least 10 contacts sent and one of these evidence types captured: concrete past incident, audit request, pilot, call, trial, or explicit rejection with reason.
+
+---
+
+### Task 5: Make the expansion/kill decision after 7–14 days
+
+**Objective:** Prevent a content factory before a signal exists.
+
+**Decision table:**
+
+| Signal | Decision |
+| --- | --- |
+| Search impressions/query relevance + CTA clicks | Build exactly one follow-up: `/de/qr-code-nach-druck-aendern` focused on recovery intent. |
+| At least 2 concrete restaurant incidents or 1 pilot | Improve the restaurant-specific proof/CTA or ship a German restaurant page only after title/canonical mapping against `/restaurants`. |
+| No relevant queries, replies, CTA clicks, or incidents | Do not create more pages. Change segment/message (e.g. flyers/events/real-estate) and repeat outreach. |
+
+**Do not expand to** flyer, business-card, event, packaging, PDF, and restaurant subpages simultaneously. One successful page/message earns one sibling.
+
+---
+
+## Final Definition of Done
+
+1. One live, unique German decision page—not a page cluster.
+2. `npm run lint` and `npm run build` pass.
+3. Canonical, hreflang, CTA and tracking are verified on the rendered route.
+4. Ten manual research contacts are sent.
+5. A seven-day review contains real proof: Search Console query data, PostHog CTA data, replies, calls, audits, trials, or payments.
+6. Only then decide whether `/de/qr-code-nach-druck-aendern` deserves implementation.
--- a/.impeccable-live.json
+++ b/.impeccable-live.json
@@ -0,0 +1 @@
+{"pid":23720,"port":8400,"token":"99ca8ad6-3aa6-44f6-9b64-25921f55724b"}
--- a/.mcp.json
+++ b/.mcp.json
@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "apify": {
+      "type": "sse",
+      "url": "https://mcp.apify.com/sse",
+      "headers": {
+        "Authorization": "Bearer apify_api_0D7RWI6eW1H9LETBuLY7PHNpAErxL72ua6lo"
+      }
+    }
+  }
+}
--- a/.npmrc
+++ b/.npmrc
@@ -1,2 +1,2 @@
-registry=https://registry.npmjs.org/
+registry=https://registry.npmjs.org/
 legacy-peer-deps=true
--- a/.planning/industry-pages-batch2.md
+++ b/.planning/industry-pages-batch2.md
--- a/.prettierrc
+++ b/.prettierrc
@@ -1,8 +1,8 @@
-{
-  "semi": true,
-  "trailingComma": "es5",
-  "singleQuote": true,
-  "printWidth": 80,
-  "tabWidth": 2,
-  "useTabs": false
+{
+  "semi": true,
+  "trailingComma": "es5",
+  "singleQuote": true,
+  "printWidth": 80,
+  "tabWidth": 2,
+  "useTabs": false
 }
--- a/.vercelignore
+++ b/.vercelignore
@@ -1,10 +1,10 @@
-node_modules
-.next
-.git
-*.log
-.env
-.env.local
-.vercel
-*.sql
-/backups/
-.npmrc
+node_modules
+.next
+.git
+*.log
+.env
+.env.local
+.vercel
+*.sql
+/backups/
+.npmrc
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -1,3 +1,3 @@
-{
-    "codium.codeCompletion.enable": false
+{
+    "codium.codeCompletion.enable": false
 }
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -0,0 +1,318 @@
+# Universal AI Coding Agent Workflow (Codex / Gemini / Claude)
+
+## Workflow Orchestration
+
+### 1. Plan Mode Default
+- Enter planning mode for ANY non-trivial task (3+ steps or architecture decisions)
+- Analyze the codebase before making changes
+- Break problems into clear subtasks
+- Produce an implementation plan before writing code
+- If assumptions are uncertain, inspect files or run tools first
+- Prefer incremental progress over large rewrites
+
+Plan format:
+
+PLAN
+1. Understand the task
+2. Identify affected files
+3. Design the implementation
+4. Implement step-by-step
+5. Verify results
+
+
+---
+
+# Multi-Agent Strategy
+
+### 2. Agent Decomposition
+
+Use specialized agents for complex work.
+
+Core roles:
+
+- Orchestrator Agent
+- Research Agent
+- Implementation Agent
+- Test Agent
+- Code Review Agent
+- Debug Agent
+- Documentation Agent
+
+Rules:
+- One responsibility per agent
+- Prefer parallel execution
+- Agents should operate on independent files when possible
+- The orchestrator coordinates execution
+
+
+---
+
+# Agent Responsibilities
+
+### Orchestrator Agent
+- analyzes the user request
+- creates task list
+- assigns tasks to agents
+- merges results
+
+### Research Agent
+- scans repository
+- searches dependencies
+- analyzes architecture
+- produces context summary
+
+### Implementation Agent
+- writes code
+- edits files
+- follows project conventions
+- implements features
+
+### Test Agent
+- writes tests
+- verifies functionality
+- checks edge cases
+
+### Code Review Agent
+- reviews diffs
+- checks maintainability
+- suggests improvements
+
+### Debug Agent
+- analyzes logs
+- identifies root causes
+- implements fixes
+
+### Documentation Agent
+- updates docs
+- writes README sections
+- explains new features
+
+
+---
+
+# Execution Pipeline
+
+### 3. Execution Phases
+
+PHASE 1 — Discovery
+- explore repository
+- load relevant files
+- understand architecture
+
+PHASE 2 — Planning
+- generate implementation plan
+- break plan into tasks
+
+PHASE 3 — Task Creation
+
+Create tasks like:
+
+[ ] analyze codebase  
+[ ] implement feature  
+[ ] add tests  
+[ ] review code  
+[ ] update documentation  
+
+PHASE 4 — Implementation
+- execute tasks sequentially or in parallel
+- commit progress
+
+PHASE 5 — Verification
+- run tests
+- check logs
+- verify feature works
+
+PHASE 6 — Review
+- review code quality
+- refactor if necessary
+
+PHASE 7 — Documentation
+- document changes
+
+
+---
+
+# Verification System
+
+### 4. Verification Before Done
+
+Never mark a task complete without proof.
+
+Checks:
+- code compiles
+- feature works
+- tests pass
+- no new errors introduced
+
+Ask:
+
+"Would a senior engineer approve this implementation?"
+
+
+---
+
+# Autonomous Debugging
+
+### 5. Autonomous Bug Fixing
+
+When encountering a bug:
+
+1. analyze error message
+2. inspect stack trace
+3. identify root cause
+4. implement fix
+5. verify with tests
+
+Rules:
+- Never apply random fixes
+- Always understand the root cause first
+
+
+---
+
+# Context Management
+
+### 6. Context Awareness
+
+Before implementing anything:
+
+- load relevant files
+- inspect dependencies
+- understand architecture
+- read configuration files
+
+Always maintain awareness of:
+
+- system architecture
+- data flow
+- dependencies
+
+
+---
+
+# Memory System
+
+### 7. Persistent Memory
+
+Store long-term knowledge in:
+
+memory/
+- project_summary.md
+- architecture.md
+- lessons.md
+- coding_standards.md
+
+This prevents repeated mistakes.
+
+
+---
+
+# Learning Loop
+
+### 8. Self-Improvement
+
+After errors or corrections:
+
+Update:
+
+tasks/lessons.md
+
+Include:
+- mistake pattern
+- root cause
+- prevention rule
+
+Example:
+
+Lesson:  
+Always validate API responses before processing them.
+
+
+---
+
+# Safety Rules
+
+### 9. Safety
+
+Never perform dangerous actions automatically.
+
+Rules:
+
+- never delete files without confirmation
+- avoid modifying production configuration automatically
+- create backups before large refactors
+- avoid irreversible operations
+
+
+---
+
+# Iteration Control
+
+### 10. Infinite Loop Protection
+
+If the same error happens more than 3 times:
+
+STOP
+
+- re-evaluate the strategy
+- re-plan the solution
+- choose a different debugging approach
+
+
+---
+
+# Core Engineering Principles
+
+### Simplicity First
+Prefer the simplest solution that works.
+
+### Root Cause Fixes
+Always fix the underlying problem, not symptoms.
+
+### Minimal Impact
+Touch the smallest amount of code possible.
+
+### Maintainability
+Code should remain readable and maintainable.
+
+
+---
+
+# Final Rule
+
+Before delivering a solution ask:
+
+Is this solution correct, maintainable, and verifiable?
+
+If not:
+
+Refine it before presenting it.
+
+
+---
+
+# Recommended File Usage
+
+You can place this workflow in one of the following files:
+
+AGENT_WORKFLOW.md  
+CLAUDE.md  
+AGENTS.md  
+
+This allows it to be used by:
+
+- Claude Code Agent Teams
+- Codex CLI
+- Gemini Code Assist
+- Cursor Agents
+
+---
+
+# gstack
+
+This repo also uses the global `gstack` skill pack for AI-assisted work.
+
+- Claude Code: install to `~/.claude/skills/gstack` and run `./setup --team`
+- Codex: gstack skills are installed globally under `~/.codex/skills/gstack-*`
+- Prefer gstack skills for structured work when they fit the task, especially `/browse`, `/review`, `/investigate`, `/qa`, `/ship`, and `/cso`
+- Do not reference vendored repo paths for gstack; use the global install path instead
--- a/AI-SEO-CONTENT-PRIORITIES.md
+++ b/AI-SEO-CONTENT-PRIORITIES.md
@@ -0,0 +1,48 @@
+# AI SEO Content Priorities
+
+Last updated: 2026-04-14
+
+Purpose: prioritize the next content pass after the raw rollout, visible freshness fix, and `llms.txt` expansion.
+
+## Priority 1
+
+1. `qr-code-scan-statistics-2026`
+Reason: strongest citation potential because statistics pages are the easiest source type for LLMs to quote.
+Next move: verify every stat has a current primary source and an explicit inline citation in the article body.
+
+2. `qr-code-analytics`
+Reason: high commercial intent and strong fit for QR Master's differentiation around measurement and ROI.
+Next move: sharpen answer blocks around scan metrics, dashboards, and campaign decisions.
+
+3. `qr-code-marketing`
+Reason: bridges informational and product-intent queries around campaign ROI, CTAs, and tracking.
+Next move: tighten the first-screen answer and add more comparative guidance for common campaign use cases.
+
+4. `free-vs-paid-qr-generator`
+Reason: strong comparison intent and a natural path into dynamic QR, tracking, and upgrade logic.
+Next move: strengthen side-by-side comparison blocks and source any claims about reliability or limits.
+
+## Priority 2
+
+5. `best-qr-code-generator-2026`
+Reason: "best" queries are heavily represented in AI answers but need balanced, defensible comparisons.
+Next move: review neutrality, keep claims sourced, and make evaluation criteria more explicit.
+
+6. `bulk-qr-code-generator-excel`
+Reason: strong workflow intent and direct fit with a high-value product capability.
+Next move: improve step extraction and source support for operational best practices where possible.
+
+7. `qr-code-events`
+Reason: clear use-case page with practical intent and good overlap with tracking and dynamic QR value.
+Next move: add stronger answer passages around tickets, check-in, UTMs, and event ROI.
+
+8. `qr-code-security`
+Reason: security content earns citations when it is current, specific, and source-heavy.
+Next move: validate the quishing data points and make safe-deployment recommendations easier to quote.
+
+## Review Criteria
+
+- The first 40 to 60 words should answer the core query directly.
+- Major claims should point to a primary source, not an unsourced assertion.
+- Comparison and checklist content should prefer tables or tightly structured blocks over long prose.
+- Posts that support product evaluation should link clearly into the relevant QR Master marketing pages.
--- a/AI-SEO-TOP5-REWRITE-PLAN.md
+++ b/AI-SEO-TOP5-REWRITE-PLAN.md
@@ -0,0 +1,419 @@
+# AI SEO Top 5 Rewrite Plan
+
+Last updated: 2026-04-14
+
+Method: `ai-seo`
+
+Goal: define the exact AEO/GEO rewrite moves for the five blog posts with the strongest combination of keyword demand, product fit, and AI citation potential.
+
+## 1. `dynamic-vs-static-qr-codes`
+
+File reference: [src/lib/blog-data.ts](/abs/path/C:/Users/a931627/Documents/QRMASTER/src/lib/blog-data.ts:707)
+
+### Target queries
+
+- `dynamic qr code`
+- `dynamic qr code generator`
+- `create dynamic qr code`
+- `static qr codes`
+- `editable qr code`
+
+### What already works
+
+- Strong `quickAnswer`
+- Clear FAQ intent
+- Good internal link path into tracking and comparison content
+- Sources already exist
+
+### Exact sections to change
+
+1. Replace the opening body paragraph with a direct definition + decision summary.
+Current issue: the intro starts with a conversational framing instead of a highly extractable answer block.
+Change to: a 40 to 60 word paragraph that answers:
+"A static QR code cannot be edited after printing. A dynamic QR code can be updated, tracked, and reused. For business campaigns, menus, and promotions, dynamic QR codes are usually the better choice because they prevent reprints and enable analytics."
+
+2. Add an early comparison table directly after the intro.
+New section:
+`## Static vs Dynamic QR Code Comparison`
+Include rows for:
+- editable after printing
+- analytics
+- best use case
+- risk of reprint cost
+- ideal for marketing
+- ideal for permanent utility use
+
+3. Add a decision section that maps user intent to format choice.
+New section:
+`## When To Use Static QR Codes`
+New section:
+`## When To Use Dynamic QR Codes`
+Each section should open with a one-sentence answer, then 3 to 5 bullets.
+
+4. Add a cost/risk section.
+New section:
+`## Why Dynamic QR Codes Save Money`
+This should translate product value into a business outcome:
+- changed menu URL
+- campaign landing page update
+- print correction avoidance
+
+5. Expand FAQ to cover high-intent objections.
+Add:
+- "Are dynamic QR codes worth paying for?"
+- "Can a dynamic QR code become inactive?"
+- "Is a static QR code ever better than a dynamic one?"
+
+### AEO focus
+
+- Make the first screen answer self-contained.
+- Prefer table + decision logic over generic prose.
+- Keep the distinction between "editable" and "trackable" explicit in every major section.
+
+### Authority upgrades
+
+- Add at least one explicit sourced statement in the intro or first comparison section.
+- Where possible, cite original sources for adoption or tracking claims rather than broad vendor summaries.
+
+### Internal linking
+
+- Link to `/dynamic-qr-code-generator`
+- Link to `/qr-code-tracking`
+- Link to `/pricing`
+- Keep links to `trackable-qr-codes` and `free-vs-paid-qr-generator`
+
+## 2. `qr-code-tracking-guide-2025`
+
+File reference: [src/lib/blog-data.ts](/abs/path/C:/Users/a931627/Documents/QRMASTER/src/lib/blog-data.ts:653)
+
+### Target queries
+
+- `qr code tracking`
+- `track qr scans`
+- `dynamic qr code analytics`
+- `google analytics qr`
+- `utm qr codes`
+
+### What already works
+
+- High commercial relevance
+- Strong `quickAnswer`
+- Good `keySteps`
+- FAQ already aligned to the query
+
+### Exact sections to change
+
+1. Replace `Why Track QR Codes?` with a sharper query-matching heading.
+Rename to:
+`## What Is QR Code Tracking?`
+The first paragraph should define tracking in one extractable block:
+"QR code tracking means measuring what happens after a scan. With a dynamic QR code, you can log scan time, device type, location, and destination performance. If you also add UTM parameters, you can measure campaign attribution in tools like GA4."
+
+2. Split "tracking" and "analytics" clearly.
+New section:
+`## QR Code Tracking vs QR Code Analytics`
+Reason: this is already in the FAQ and deserves a visible answer block because it is highly citable.
+
+3. Add a metrics section with a structured list.
+New section:
+`## What Metrics Should You Track?`
+Use a table with:
+- total scans
+- unique scans
+- scan time
+- device type
+- location
+- landing page conversions
+- cost per conversion
+
+4. Add an implementation section for GA4 and UTMs.
+New section:
+`## How To Track QR Codes In Google Analytics 4`
+Keep it procedural:
+- create dynamic QR destination
+- append UTM parameters
+- define conversion event in GA4
+- compare placements
+
+5. Add a limitations section.
+New section:
+`## What QR Tracking Can And Cannot Measure`
+This improves trust and helps citation because it sounds more rigorous.
+
+### AEO focus
+
+- The first H2 should match the core query exactly.
+- One section should answer "Can I track a static QR code?" before the FAQ.
+- Use one metric table instead of only prose.
+
+### Authority upgrades
+
+- Keep Bitly and Google Analytics references, but tighten them around specific claims.
+- If scan or attribution claims are broad, attach dates and exact measurement context.
+
+### Internal linking
+
+- Link to `/qr-code-tracking`
+- Link to `utm-parameter-qr-codes`
+- Link to `qr-code-analytics`
+- Link to `/dynamic-qr-code-generator`
+
+## 3. `bulk-qr-code-generator-excel`
+
+File reference: [src/lib/blog-data.ts](/abs/path/C:/Users/a931627/Documents/QRMASTER/src/lib/blog-data.ts:759)
+
+### Target queries
+
+- `bulk qr code generator`
+- `qr code generator bulk`
+- `qr code generator excel`
+- `qr codes from excel`
+- `csv qr code generator`
+
+### What already works
+
+- Strong workflow intent
+- Good step list
+- Good FAQ coverage
+- Strong product fit for a paid/business feature
+
+### Exact sections to change
+
+1. Rewrite the intro to answer the exact workflow query faster.
+Current issue: the intro starts with narrative scale examples before the direct instruction.
+Change to:
+"To generate bulk QR codes from Excel, prepare a spreadsheet with one row per QR destination, export it as CSV, upload it to a bulk QR generator, and download the generated batch. This is the standard workflow for product labels, badges, inventory, and large campaigns."
+
+2. Add a file format section.
+New section:
+`## Excel vs CSV: Which Format Do You Actually Need?`
+This should explicitly explain that CSV is usually the upload format even when users say Excel.
+
+3. Add a required-column section.
+New section:
+`## Recommended Spreadsheet Columns`
+Use a table:
+- `url`
+- `label`
+- `campaign`
+- `utm_source`
+- `utm_medium`
+- `utm_campaign`
+- optional `filename`
+
+4. Add a common-errors section.
+New section:
+`## Common Bulk QR Upload Errors`
+Include:
+- broken URLs
+- inconsistent columns
+- spaces in headers
+- mixed protocols
+- untested redirect destinations
+
+5. Add a dynamic-vs-static decision block for batches.
+New section:
+`## Should Bulk QR Codes Be Static Or Dynamic?`
+This should explicitly tie bulk use cases to tracking, editing, and reprint risk.
+
+6. Add a QA checklist before production.
+New section:
+`## Pre-Print Quality Check`
+Use a numbered list with 5 to 7 checks.
+
+### AEO focus
+
+- This post should behave like a procedural answer, not a generic guide.
+- The column table and error list are likely the most citable parts.
+- Make "Excel" and "CSV" relationship explicit because users search for Excel but often need CSV.
+
+### Authority upgrades
+
+- Existing sources are serviceable, but add at least one stronger operational source if available.
+- Where no authoritative external source exists, use precise first-party workflow guidance without overclaiming.
+
+### Internal linking
+
+- Link to `/bulk-qr-code-generator`
+- Link to `qr-code-print-size-guide`
+- Link to `qr-code-tracking-guide-2025`
+- Link to `dynamic-vs-static-qr-codes`
+
+## 4. `vcard-qr-code-generator`
+
+File reference: [src/lib/blog-data.ts](/abs/path/C:/Users/a931627/Documents/QRMASTER/src/lib/blog-data.ts:504)
+
+### Target queries
+
+- `vcard qr code generator`
+- `vcard qr code`
+- `vcard generator`
+- `vcard qr`
+- `create vcard qr code`
+
+### What already works
+
+- Good keyword fit
+- Good query-to-tool match
+- Strong utility use case
+
+### Exact sections to change
+
+1. Tighten the opening definition.
+The first paragraph should answer:
+"A vCard QR code stores contact details such as name, phone number, email, company, and website. When someone scans it, they can save the contact directly to their phone without typing."
+
+2. Add a static-vs-dynamic contact section.
+New section:
+`## Static vs Dynamic vCard QR Codes`
+Cover:
+- when static is enough
+- when dynamic is better
+- when tracking matters
+
+3. Add a field breakdown section.
+New section:
+`## What Information Can A vCard QR Code Include?`
+Use a compact list or table:
+- full name
+- phone
+- email
+- company
+- job title
+- website
+- address
+- social profile
+
+4. Add a use-case section.
+New section:
+`## Best Use Cases For vCard QR Codes`
+Examples:
+- business cards
+- trade shows
+- packaging inserts
+- storefronts
+- service professionals
+
+5. Add a scannability and contact-save section.
+New section:
+`## Best Practices For High Save Rates`
+Focus on CTA language:
+- scan to save contact
+- add me instantly
+- connect without typing
+
+### AEO focus
+
+- Treat this as a definitional + use-case post, not just a tool page.
+- The definition block and field list are the most important extractable components.
+
+### Authority upgrades
+
+- If current sources are weak or missing, add at least one standards-oriented or platform-oriented source.
+- Avoid unsupported claims around conversion unless sourced.
+
+### Internal linking
+
+- Link to the vCard tool page
+- Link to `business-card-qr-code`
+- Link to `dynamic-vs-static-qr-codes`
+- Link to `/pricing` if dynamic/contact-management features are relevant
+
+## 5. `qr-code-print-size-guide`
+
+File reference: [src/lib/blog-data.ts](/abs/path/C:/Users/a931627/Documents/QRMASTER/src/lib/blog-data.ts:604)
+
+### Target queries
+
+- `minimum qr code size`
+- `qr code print size`
+- `qr code size guide`
+- `qr code scanning distance`
+
+### What already works
+
+- Very strong query structure
+- Excellent snippet potential
+- Good `quickAnswer`
+- Good FAQ fit
+
+### Exact sections to change
+
+1. Keep the 10:1 rule, but make it the first body paragraph in exact answer form.
+Suggested phrasing:
+"The standard starting rule for QR print size is 10:1: the code should be about one-tenth of the expected scanning distance. A QR code scanned from 2 meters away should usually be around 20 centimeters wide."
+
+2. Add a distance-to-size table immediately after the intro.
+New section:
+`## QR Code Size Chart By Scanning Distance`
+Include examples for:
+- 20 cm
+- 50 cm
+- 1 m
+- 2 m
+- 5 m
+
+3. Add format-specific minimums.
+New section:
+`## Minimum QR Code Sizes For Common Print Formats`
+Use rows for:
+- business card
+- flyer
+- poster
+- packaging
+- menu stand
+- window signage
+
+4. Add a density warning section.
+New section:
+`## Why More Data Requires A Larger QR Code`
+Cover:
+- long URLs
+- vCard payloads
+- WiFi payloads
+- error correction tradeoffs
+
+5. Add a print-production checklist.
+New section:
+`## Print Checklist Before You Go Live`
+Include:
+- SVG preferred
+- 300 DPI minimum for raster
+- quiet zone intact
+- strong contrast
+- test in real lighting
+- test with average phones, not only flagship devices
+
+### AEO focus
+
+- This post should be built around tables and formulas, not narrative.
+- The size chart is likely the strongest snippet and AI Overview asset.
+- Keep measurements concrete and example-heavy.
+
+### Authority upgrades
+
+- If possible, support the 10:1 rule with an external reference or state it clearly as an operational best-practice baseline.
+- Avoid over-precision if it is based on heuristics rather than a standard.
+
+### Internal linking
+
+- Link to `business-card-qr-code`
+- Link to `qr-code-restaurant-menu`
+- Link to `bulk-qr-code-generator-excel`
+- Link to relevant tool or generator pages
+
+## Execution Order
+
+1. `dynamic-vs-static-qr-codes`
+2. `qr-code-tracking-guide-2025`
+3. `bulk-qr-code-generator-excel`
+4. `qr-code-print-size-guide`
+5. `vcard-qr-code-generator`
+
+## Acceptance Criteria
+
+- The first paragraph on each post answers the target query directly.
+- Each post includes at least one visibly structured block that is easy to quote:
+  table, checklist, comparison block, or metric summary.
+- Claims that imply data, performance, or market adoption are tied to a source.
+- The post clearly routes users into the relevant QR Master product or feature page.
--- a/BLOG-IDEEN-BACKLOG.md
+++ b/BLOG-IDEEN-BACKLOG.md
@@ -0,0 +1,177 @@
+# Blog-Ideen-Backlog qrmaster.net
+
+Erstellt: 2026-08-04 · Datenbasis: GSC-Export 2026-08-03 (1.001 Suchanfragen, letzte 3 Monate)
+
+Alle Themen unten haben **belegte Nachfrage aus deinen eigenen Impressionen** — keine Keyword-Tool-Schätzungen. Die Impressionszahl ist, was qrmaster.net in drei Monaten bereits ausgespielt bekam, fast durchgehend bei 0 Klicks, weil die Positionen zwischen 35 und 70 liegen.
+
+Nach Abzug der Marken-Suchanfragen (`qr master`, `qrmaster` etc.) und der bereits abgedeckten Themen bleiben **8.018 Impressionen über 263 Suchanfragen** ohne passenden Blogpost.
+
+---
+
+## Canonical & Zweitverwertung
+
+Du wolltest die Posts auch anderswo veröffentlichen können. Die Reihenfolge entscheidet, ob das hilft oder schadet.
+
+**Regel: qrmaster.net veröffentlicht zuerst und bleibt das Original.**
+
+1. Post auf qrmaster.net veröffentlichen. Die Blogseiten setzen bereits einen korrekten Self-Canonical (`https://www.qrmaster.net/blog/<slug>`) — geprüft, nichts zu tun.
+2. **Warten, bis Google die Seite indexiert hat.** In der Search Console unter „URL-Prüfung" nachsehen. Erst wenn die Seite im Index ist, syndizieren. Wer gleichzeitig veröffentlicht, riskiert, dass die stärkere Domain zuerst indexiert wird und als Original gilt.
+3. Dann erst auf Drittplattformen stellen, jeweils mit Canonical zurück auf qrmaster.net.
+
+| Plattform | Canonical setzen | Hinweis |
+|---|---|---|
+| DEV.to | Feld `canonical_url` im Frontmatter | Sauber unterstützt, beste Option für die technischen Posts |
+| Hashnode | Einstellung „Original article URL" | Sauber unterstützt |
+| Medium | „Import story" statt manuellem Einfügen | Setzt Canonical automatisch; manuelles Einfügen tut das **nicht** |
+| LinkedIn Artikel | Nicht möglich | Kein Canonical-Support — dort nur Auszug plus Link posten, nie den Volltext |
+| Reddit | Nicht möglich | Kein Volltext, sondern eigenständiger Beitrag mit Link |
+
+**Wichtig:** Ein Canonical ist ein Hinweis, keine Anweisung. Wenn die Kopie deutlich mehr Links bekommt, kann Google sie trotzdem bevorzugen. Deshalb Schritt 2 nicht überspringen.
+
+**Praktischer Hinweis zu den technischen Posts:** `qr-code-api-documentation`, `bulk-qr-code-generator-excel`, `custom-qr-code-design`, `qr-code-print-size-guide` und `location-qr-code` enthalten Code, Formate und Spezifikationsdetails — die funktionieren auf DEV.to. Die reinen Marketing-Posts eher nicht.
+
+---
+
+## Priorität 1 — Höchstes Volumen (Woche 1–8)
+
+### 1. Twitter/X QR Codes
+**591 Impressionen** · `twitter qr code generator` (140, Pos. 38,9), `twitter qr code` (135, Pos. 53), `qr code for twitter` (86), `how to scan twitter qr code` (43)
+Winkel: X hat den eigenen QR-Code aus der App weitgehend entfernt — genau deshalb die Suchanfragen. Erklären, wie man stattdessen einen Profil-Link-QR baut, und `how to scan twitter qr code` als eigenes H2 beantworten.
+
+### 2. Facebook QR Codes
+**609 Impressionen** · `facebook qr code generator` (113, Pos. 49,9), `qr code for facebook page free` (33), `facebook page qr code generator` (29), `code generator facebook` (45)
+Winkel: Unterscheidung Seite vs. Profil vs. Gruppe vs. Event — vier verschiedene URL-Formate, die unterschiedlich funktionieren. Achtung: `code generator facebook` meint teils Facebooks Login-Code-Generator, also andere Intention. Im Text abgrenzen.
+
+### 3. URL- und Redirect-Grundlagen
+**787 Impressionen** · `create a qr code for a url` (58), `url qr code` (53), `redirect qr code` (47), `create qr code from url` (30), `turn url into qr code` (26)
+Winkel: Der größte Cluster überhaupt und rein instruktiv. Ein sauberer Grundlagen-Post, der auf alle Spezialfälle weiterverlinkt — wird zur internen Verteilerseite.
+
+### 4. Beaconstac-Alternative
+**718 Impressionen** · `beaconstac` (96), `beaconstac qr code generator` (75), `beaconstac vs popl` (67), `beaconstac vs mobilo` (57), `blinq vs beaconstac` (42), `beaconstac alternative` (34)
+Winkel: Hohe Kaufintention. Deckt sich mit dem `/vs/`-Backlog in CLAUDE.md. Die `X vs Y`-Anfragen sind Vergleiche zwischen **Wettbewerbern untereinander** — dort taucht QR Master als dritte Option auf.
+
+### 5. Krypto- und Wallet-QR-Codes
+**441 Impressionen** · `usdt qr code generator` (85, **Pos. 13,1**), `blockchain secure qr code generator` (48), `bitcoin qr code generator` (46), `crypto qr code generator` (37), `trust wallet qr code generator` (6)
+Winkel: Rankt bereits am besten von allen ungedeckten Themen. Substanz: Adressformate je Netzwerk, warum eine falsche Netzwerkwahl Geld vernichtet, Prüfsummen. Sicherheitskritisch — sorgfältig recherchieren.
+
+### 6. PayPal- und Zahlungs-QR-Codes
+**430 Impressionen** · `paypal qr code generator` (50), `qr-code zahlungen` (50), `qr code for payment generator` (19), `create paypal qr code` (19), `all in one qr code for payment` (7)
+Winkel: PayPal.Me-Linkformat, Abgrenzung zu EPC/GiroCode im EU-Raum, was rechtlich zu beachten ist.
+
+### 7. SMS-QR-Codes
+**330 Impressionen** · `sms qr code generator` (51), `sms qr code` (48), `qr code sms generator` (27), `create sms qr code` (22)
+Winkel: Das `SMSTO:`-Format und die vorbefüllte Nachricht — technisch dieselbe Präzision wie beim WhatsApp-Post, dieselbe Fehlerquelle bei der Nummernformatierung.
+
+### 8. QR Codes für Immobilien
+**326 Impressionen** · `qr code real estate signs` (41), `qr code generator for real estate` (41), `real estate signs with qr codes` (24), `qr for real estate` (21)
+Winkel: Schilder im Freien — Größe für Lesung aus Autoentfernung, Wetterfestigkeit, dynamische Codes für Objektwechsel. Verweist auf den Print-Size-Guide.
+
+---
+
+## Priorität 2 — Mittleres Volumen (Woche 9–18)
+
+### 9. Flowcode-Alternative
+**246 Impressionen** · `flowcode alternative` (51, **Pos. 18,3**), `flowcode qr competitors` (47), `flowcode competitors` (38), `flowcode pricing` (21)
+Steht bereits auf Position 18 — kürzester Weg auf Seite 1 im Wettbewerbsumfeld.
+
+### 10. Bearbeitbare QR Codes / Ziel ändern
+**217 Impressionen** · `changeable qr code` (63), `dynamic qr code editing` (51), `editable qr code` (25), `convert static qr code to dynamic` (59)
+Winkel: Beantwortet die Frage „kann ich einen gedruckten Code noch ändern" direkt. Ehrliche Antwort: statisch nein, dynamisch ja — und was man tut, wenn schon statisch gedruckt wurde.
+
+### 11. TikTok QR Codes
+**209 Impressionen** · `tiktok qr code generator` (113, Pos. 25,4), `qr code generator tiktok` (27), `free tiktok qr code generator` (23)
+Es gibt bereits `/tools/tiktok-qr-code` (465 Impr., 9 Klicks) — der Post wäre Support-Content dafür.
+
+### 12. Zoom QR Codes
+**200 Impressionen** · `zoom qr code generator` (56, Pos. 28,8), `qr code for zoom meeting` (23), `create qr code from zoom link` (12)
+Winkel: Wie der Teams-Post — welcher Meeting-Link haltbar ist, Sicherheit bei sichtbaren Codes.
+
+### 13. YouTube QR Codes
+**196 Impressionen** · `youtube qr code generator` (67), `qr code youtube generator` (25), `youtube channel qr code generator` (14), `youtube playlist qr code` (7)
+`youtube-qr-code-guide` existiert bereits (936 Wörter, 0 Impressionen) — **prüfen statt neu schreiben**, warum er nicht ausgespielt wird.
+
+### 14. Verpackung und Produkt-QR
+**196 Impressionen** · `qr code packaging` (38), `qr codes for wine labels` (25), `qr code for wine bottle` (25), `qr code retail` (19), `qr code for product tracking` (10)
+Winkel: Gebogene Flächen, Materialeinflüsse, GS1 Digital Link als Zukunftsformat.
+
+### 15. Hotel-QR-Codes
+**159 Impressionen** · `hotel info via qr code` (63), `qr code for hotel` (23), `hotel qr code` (21), `hotel check in qr code` (5)
+Auch `system qr dla hoteli` (72, Polnisch) — Nachfrage besteht international.
+
+### 16. E-Mail-QR-Codes
+**117 Impressionen** · `qr code generator for email` (18), `qr code email generator` (18), `free email qr code generator` (12), `qr code to email` (3)
+Winkel: `mailto:`-Format mit vorbefülltem Betreff und Text, URL-Encoding — kurzer, technisch präziser Post.
+
+### 17. Café- und Gastronomie-QR
+**122 Impressionen** · `qr code cafe` (48), `cafe qr code` (25), `qr cafe` (21), `qr code holder for restaurant` (6)
+Achtung: Überschneidung mit `/restaurants`. Abgrenzen oder dorthin verlinken statt Kannibalisierung erzeugen.
+
+### 18. Flyer und Print-Kampagnen
+**118 Impressionen** · `qr codes on flyers` (58), `how to track qr code scans from a print campaign` (43, **Pos. 9,9**), `how to put qr code on flyer` (4)
+Die Print-Kampagnen-Anfrage steht schon auf Position 9,9 und ist bereits als H2 im Tracking-Guide. Ein eigener Post wäre die Vertiefung.
+
+### 19. Kalender- und Termin-QR
+**97 Impressionen** · `qr code for calendar event` (22), `free qr code generator calendar event` (13), `create qr code calendar event` (11)
+Winkel: Das iCal/VEVENT-Format direkt im Code — funktioniert offline, deshalb der stärkste Event-Anwendungsfall.
+
+---
+
+## Priorität 3 — Nischen mit klarer Intention (Woche 19–30)
+
+### 20. Kirchen, Schulen, Bibliotheken
+**77 Impressionen** · `qr for schools` (16), `qr code for church` (13), `qr code library` (10), `church donation qr code` (9), `campus qr code` (5)
+
+### 21. Gesundheitswesen, Versicherung, Kanzleien
+**50 Impressionen** · `qr code insurance industry` (18), `qr codes for legal services` (8), `qr code for dental clinics` (8), `qr codes for healthcare patient intake forms` (6)
+Winkel: Datenschutz und Einwilligung bei Patientenformularen — Thema, das andere meiden.
+
+### 22. Bitly als Alternative
+**57 Impressionen** · `bitly qr code` (16), `bitly qr code alternative` (12), `bitly vs beaconstac qr codes` (18, **Pos. 14,9**), `bit.ly qr code generator` (6)
+
+### 23. WLAN-QR-Codes
+**11 Impressionen im Export**, aber `/tools/wifi-qr-code` hat 70 Impressionen bei Position 22,4
+Winkel: Das `WIFI:`-Format, WPA vs. WPA2, Sonderzeichen im Passwort — kurzer technischer Post mit hoher Praxisrelevanz.
+
+### 24–30. Weitere belegte Einzelthemen
+- **Stadien und Veranstaltungsorte** — `qr code in sports stadium` (17, Pos. 20,2), `qr codes for stadiums` (9)
+- **Flughäfen** — `airport qr code` (10, Pos. 19,9), `qr code airport` (9)
+- **Friseure und Barbershops** — `qr barber` (13, **Pos. 8,9**), `barber business cards with qr code` (4)
+- **Fitness und Yoga** — `yoga qr code` (5), `short code for yoga studios` (7)
+- **Foodtrucks** — `food truck qr code` (3, Pos. 46)
+- **Schmuck und Inventar** — `jewelry inventory qr code solutions` (6), `bijuterii qr code` (8)
+- **Messen und Networking** — `qr codes for event networking` (7, Pos. 15), `qr codes at trade shows` (7)
+
+---
+
+## Deutscher Markt — separate Entscheidung
+
+**400 Impressionen**, alle bei 0 Klicks und Position 55–103:
+`qr code erstellen gratis` (109, Pos. 100,4), `kostenlos qr code erstellen` (66, Pos. 102,7), `qr-code zahlungen` (50), `dynamische qr-codes` (45), `qr visitenkarte` (11), `qr code visitenkarte` (9)
+
+Positionen über 100 bedeuten: Google kennt die Seiten, hält sie aber für die schlechteste verfügbare Antwort. Die 13 `/de/`-Seiten haben zusammen 194 Impressionen und **0 Klicks**.
+
+Das ist keine Content-Frage, sondern die offene Grundsatzentscheidung aus dem Umsetzungsplan: eine echte deutsche Sektion mit hreflang und eigenständigen Texten, oder deindexieren. Einzelne deutsche Blogposts ohne diese Entscheidung verschärfen das Problem nur.
+
+---
+
+## Reihenfolge-Empfehlung
+
+Nicht streng nach Impressionen gehen. Diese vier zuerst, weil sie am nächsten an Seite 1 stehen:
+
+1. **Flowcode-Alternative** — Position 18,3
+2. **Krypto/USDT** — Position 13,1
+3. **TikTok** — Position 25,4
+4. **Zoom** — Position 28,8
+
+Danach die Volumen-Themen aus Priorität 1. Ein Post auf Position 25 auf Seite 1 zu heben bringt kurzfristig mehr als ein Post auf Position 55 mit dreifachem Volumen.
+
+## Format-Vorlage
+
+Die 22 überarbeiteten Posts folgen einem Muster, das sich bewährt hat und für neue übernommen werden sollte:
+
+- Direkte Antwort im ersten Absatz, keine Einleitung über die Geschichte des QR-Codes
+- Ein konkretes Format, Feld oder Zahlenbeispiel, das man ohne Tool nachbauen kann
+- Eine Tabelle, die zwei Optionen ehrlich gegenüberstellt — inklusive der Zeile, in der die kostenlose Variante gewinnt
+- Ein Abschnitt „was schiefgeht" mit benannten Fehlermodi statt allgemeiner Tipps
+- Interne Links auf die passende Tool- oder Money-Page
+- Quellen, die keine Wettbewerber sind
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,187 +0,0 @@
-# Changelog - PostgreSQL Migration
-
-## [2.0.0] - 2024-10-13
-
-### 🎉 Major Changes - Supabase to PostgreSQL Migration
-
-#### Removed
- ❌ **Supabase dependency** - Removed all Supabase-specific configurations
- ❌ **DIRECT_URL** - Removed connection pooling URL (Supabase-specific)
- ❌ **External database dependency** - Now fully self-hosted
-
-#### Added
- ✅ **PostgreSQL 16 in Docker** - Local PostgreSQL database with Docker support
- ✅ **Redis 7** - Caching and rate limiting with Redis
- ✅ **Adminer** - Database management UI (http://localhost:8080)
- ✅ **Docker Compose setups** - Both development and production configurations
- ✅ **Database initialization** - Automated database setup with extensions
- ✅ **Complete documentation** - Multiple guides for setup and migration
- ✅ **Setup scripts** - Automated setup for both Linux/Mac and Windows
- ✅ **npm scripts** - Convenient Docker commands via npm
-
-#### Modified Files
- 📝 `prisma/schema.prisma` - Removed directUrl field
- 📝 `src/lib/env.ts` - Removed DIRECT_URL, updated DATABASE_URL default
- 📝 `docker-compose.yml` - Complete rewrite with PostgreSQL, Redis, and networking
- 📝 `Dockerfile` - Enhanced with proper PostgreSQL support
- 📝 `package.json` - Added Docker scripts and tsx dependency
- 📝 `README.md` - Updated with new setup instructions
-
-#### New Files
- 📄 `docker-compose.dev.yml` - Development environment (database only)
- 📄 `docker/init-db.sh` - PostgreSQL initialization script
- 📄 `docker/README.md` - Docker-specific documentation
- 📄 `DOCKER_SETUP.md` - Comprehensive Docker setup guide
- 📄 `MIGRATION_FROM_SUPABASE.md` - Step-by-step migration guide
- 📄 `env.example` - Environment variable template
- 📄 `.dockerignore` - Docker build optimization
- 📄 `scripts/setup.sh` - Quick setup script (Linux/Mac)
- 📄 `scripts/setup.ps1` - Quick setup script (Windows)
- 📄 `CHANGELOG.md` - This file
-
-### 📦 Docker Services
-
-#### PostgreSQL Database
- **Image**: postgres:16-alpine
- **Port**: 5432
- **Features**: 
-  - Health checks
-  - Volume persistence
-  - UTF-8 encoding
-  - Extensions: uuid-ossp, pg_trgm
-
-#### Redis Cache
- **Image**: redis:7-alpine
- **Port**: 6379
- **Features**:
-  - AOF persistence
-  - 256MB max memory with LRU eviction
-  - Health checks
-
-#### Next.js Application
- **Port**: 3000
- **Features**:
-  - Multi-stage build
-  - Production optimization
-  - Health checks
-  - Automatic Prisma generation
-
-#### Adminer (Development)
- **Port**: 8080
- **Features**:
-  - Database management UI
-  - Optional (dev profile)
-  - Pre-configured for PostgreSQL
-
-### 🚀 Quick Start
-
-#### Development Mode
-```bash
-npm run docker:dev    # Start database
-npm run db:migrate    # Run migrations
-npm run dev           # Start app
-```
-
-#### Production Mode
-```bash
-npm run docker:prod   # Start all services
-```
-
-### 📚 Documentation
-
- **README.md** - Main documentation with quick start
- **DOCKER_SETUP.md** - Complete Docker guide with troubleshooting
- **MIGRATION_FROM_SUPABASE.md** - Migration guide from Supabase
- **docker/README.md** - Docker commands and operations
- **env.example** - Environment variable reference
-
-### 🔧 New npm Scripts
-
-```bash
-# Docker commands
-npm run docker:dev         # Start development services
-npm run docker:dev:stop    # Stop development services
-npm run docker:prod        # Start production stack
-npm run docker:stop        # Stop all services
-npm run docker:logs        # View all logs
-npm run docker:db          # PostgreSQL CLI
-npm run docker:redis       # Redis CLI
-npm run docker:backup      # Backup database
-```
-
-### 🔐 Environment Variables
-
-#### Required
- `DATABASE_URL` - PostgreSQL connection string
- `NEXTAUTH_SECRET` - NextAuth.js secret (generate with openssl)
- `NEXTAUTH_URL` - Application URL
- `IP_SALT` - Salt for IP hashing (generate with openssl)
-
-#### Optional
- `GOOGLE_CLIENT_ID` - Google OAuth client ID
- `GOOGLE_CLIENT_SECRET` - Google OAuth secret
- `REDIS_URL` - Redis connection string
- `ENABLE_DEMO` - Enable demo mode
-
-### 🎯 Benefits
-
-1. **Full Control** - Own your data and infrastructure
-2. **No Vendor Lock-in** - Standard PostgreSQL
-3. **Lower Latency** - Local network speed
-4. **Cost Effective** - No monthly database fees
-5. **Privacy** - Data stays on your infrastructure
-6. **Development** - Easy local testing
-7. **Offline Capable** - Works without internet
-
-### 🔄 Migration Path
-
-1. Backup Supabase data
-2. Update codebase
-3. Start local PostgreSQL
-4. Restore data or run migrations
-5. Update environment variables
-6. Deploy
-
-See [MIGRATION_FROM_SUPABASE.md](MIGRATION_FROM_SUPABASE.md) for detailed steps.
-
-### ⚠️ Breaking Changes
-
- `DIRECT_URL` environment variable removed
- Database now requires Docker or local PostgreSQL
- Supabase-specific features removed
-
-### 📊 Performance Improvements
-
- Local database reduces latency
- Redis caching improves response times
- Connection pooling via Prisma
- Optimized Docker images
-
-### 🐛 Bug Fixes
-
- Fixed database connection handling
- Improved error messages
- Better health checks
-
-### 🔜 Future Enhancements
-
- [ ] PostgreSQL replication for HA
- [ ] Redis Sentinel for failover
- [ ] Automated backup scripts
- [ ] Monitoring and alerting
- [ ] Database performance tuning
- [ ] Multi-region deployment
-
-### 📝 Notes
-
- Default PostgreSQL password should be changed in production
- Always backup data before migration
- Review security settings before deployment
- Set up automated backups in production
-
---
-
-**Migration completed successfully!** 🎉
-
-For support, see documentation or open an issue on GitHub.
-
--- a/CHECKLISTE_UMSETZUNG_2026-07-27.md
+++ b/CHECKLISTE_UMSETZUNG_2026-07-27.md
@@ -0,0 +1,131 @@
+# Checkliste - Stand nach der Umsetzung
+
+27. Juli 2026. 118 Dateien, 0 Syntaxfehler, Prisma-Schema valide, beide i18n-JSONs valide, keine langen Striche.
+
+---
+
+## FERTIG
+
+### `/create` - Limit-Moment
+
+- [x] Redirect auf `/pricing` entfernt, Formularzustand überlebt den 403
+- [x] `UpgradeModal.tsx` mit drei Anlässen: `limit`, `logo`, `shapes`
+- [x] Direkt-Checkout mit `returnPath` (pfadvalidiert gegen offene Redirects)
+- [x] Option "bestehenden Code pausieren", danach Auto-Retry des Speicherns
+- [x] Option "als statischen Code weitermachen"
+- [x] Scan-Zahlen der letzten 30 Tage je Code, damit die Pausier-Entscheidung informiert ist
+- [x] PostHog-Events für alle vier Ausgänge
+
+### Limit-Logik und gestopfte Löcher
+
+- [x] `POST /api/qrs` und `GET /api/user/stats` zählen nur noch `status: 'ACTIVE'`
+- [x] `GET /api/qrs` liefert `scans30d` je Code
+- [x] `PATCH /api/qrs/[id]` akzeptiert `status` (kannte es vorher nicht, Pausieren wäre wirkungslos gewesen)
+- [x] Reaktivieren prüft gegen das Kontingent (sonst Limit-Umgehung durch pausieren/neu/reaktivieren)
+- [x] `bulk-creation` lädt das Restkontingent serverseitig nach jedem Lauf
+
+### `/bulk-creation`
+
+- [x] Stille Fehler beendet: fehlgeschlagene Zeilen werden gesammelt statt verschluckt
+- [x] Ergebnis-Panel mit Zeilennummer, Titel und Grund je Fehlzeile
+- [x] CSV-Download der fehlenden Zeilen
+- [x] Grüner Toast nur bei vollständigem Lauf
+- [x] Drei deutsche Toasts auf Englisch
+
+### Upgrade-Wege
+
+- [x] Neue Seite `/upgrade` in der `(app)`-Route-Group, Sidebar bleibt
+- [x] Alle 6 In-App-Links umgebogen: AppLayout, Dashboard, Settings (2x), Bulk (2x)
+- [x] `reason`- und `from`-Parameter, `from` geht als `returnPath` in den Checkout
+
+### QR-Design
+
+- [x] Showcase von Canvas auf **SVG** portiert (`lib/qr-shapes.ts`)
+- [x] `StyledQRCode.tsx` für die Live-Vorschau, `lib/render-qr-svg.ts` für Bulk - gemeinsame Shape-Funktionen, können nicht auseinanderlaufen
+- [x] 11 Modulformen, plangestaffelt: Free `square`, Pro 4, Business alle
+- [x] Eye-Frames und Eye-Balls getrennt wählbar
+- [x] Farbverläufe linear und radial, Business
+- [x] Gesperrte Formen sind klickbar: Vorschau zuerst, Modal danach
+- [x] Automatische Anhebung der Fehlerkorrektur bei kritischen Formen und bei Logo, mit sichtbarer Begründung
+- [x] Druckgrößen- und Test-Scan-Hinweis
+- [x] Toter `toPng`-Aufruf im SVG-Download entfernt
+
+### Scanbarkeit - gemessen, nicht geschätzt
+
+Gerendert und mit einem echten Decoder zurückgelesen, 5 Inhalte x mehrere Auflösungen:
+
+- [x] Alle 11 Modulformen 5/5
+- [x] Eye-Balls square, rounded, circle, diamond, hexagon 5/5
+- [x] **star als Eye-Ball 3/5 - entfernt**
+- [x] **Eye-Frames circle, leaf, flower, hexagon 0/15 - entfernt**
+- [x] **Rundungsradius 0.28 0/15, auf 0.10 korrigiert (15/15)**
+- [x] Alle 10 verbleibenden Eye-Kombinationen 30/30
+- [x] Bulk-Renderer separat geprüft, inklusive Verlauf: 12/12
+
+### Design-Vorlagen
+
+- [x] `QRDesignPreset`-Modell in Prisma, Relation am User
+- [x] `GET/POST/DELETE /api/design-presets`, Business-gated, CSRF-geschützt
+- [x] Gleicher Name überschreibt statt Duplikat, Obergrenze 50
+- [x] Speichern und Anwenden in `/create`
+- [x] Preset-Auswahl im Bulk-Flow: ein Design für den ganzen Upload
+
+### Retention-Mails
+
+- [x] Tag-3-Betreff entschärft
+- [x] Tag-7 zur verhaltensbasierten Limit-Mail umgebaut
+- [x] Tabellenzeile `CSV export ✓/✓` gestrichen, `Brand colors` ersetzt (war nach der Farbfreigabe falsch)
+- [x] Neue Erster-Scan-Mail, einziger Trigger ohne Kalender
+- [x] Tag-30 auf eigene Scan-Zahlen, unbelegte Testimonial-Behauptung gestrichen
+- [x] Tag-30 entfällt bei null Scans
+- [x] Cron-Route neu, vier Trigger
+
+### Farben ab Free und Folge-Copy
+
+- [x] `canCustomizeColors = true`, neue Gates `canUseShapes`, `canUseLogo`, `canUseFullDesign`
+- [x] `en.json`, `PricingClient`, Dashboard-Pro-Karte
+- [x] `/alternatives/flowcode`, 5 Stellen
+- [x] `/pricing` FAQ: Bulk-Antwort war noch static-only
+- [x] `competitor-data.ts`: Vergleichszeile führte Farben als Pro
+
+### Formales
+
+- [x] 729 lange Striche ersetzt, keine mehr im Quellcode
+- [x] CRLF-Zeilenenden durchgehend erhalten
+- [x] SQL-Datei aktualisiert: Block 4 ist jetzt Pflicht, nicht optional
+
+---
+
+## NICHT GEBAUT
+
+### Vor dem Deploy zwingend
+
+- [ ] **SQL ausführen** (`sql/2026-07-27_cro_retention_design.txt`), alle sechs Blöcke
+- [ ] **`npx prisma generate`** - ohne das kennt der Client `QRDesignPreset` nicht und `/api/design-presets` wirft zur Laufzeit
+- [ ] **Block 3.2** - sonst geht die Erster-Scan-Mail an die gesamte Bestandsbasis
+- [ ] Entscheidung zu Block 3.1
+
+### Nicht getestet
+
+- [ ] Kein Browser-Durchlauf. Der Renderer ist gegen einen Decoder geprüft, nicht im echten DOM
+- [ ] PNG-Download über `html-to-image` mit dem neuen SVG nicht verifiziert
+- [ ] SVG-Download nicht verifiziert
+- [ ] Logo-Overlay im neuen Renderer nicht visuell geprüft
+- [ ] Stripe-Checkout mit `returnPath` nicht live durchlaufen
+- [ ] Pausieren und Reaktivieren nicht gegen echte Daten
+- [ ] Preset speichern, laden, auf Bulk anwenden nicht gegen echte Daten
+
+### Bewusst weggelassen
+
+- [ ] Rahmen mit Label als Vektor. Die bestehenden Rahmen sind HTML um den QR herum; der SVG-Download fällt dort weiterhin auf PNG zurück und sagt es
+- [ ] Logo-Formen (Punkt, Herz, Blitz, WLAN) aus der Showcase
+- [ ] Eye-Frames circle, leaf, flower, hexagon - Messergebnis 0/15
+- [ ] star als Eye-Ball - 3/5
+
+### Offene inhaltliche Frage
+
+- [ ] Tag-30-Mail: gab es die Gespräche mit Pro-Nutzern über Branding? Bei Ja gehört ein wörtliches Zitat rein
+
+### Vorbehalt zur Messung
+
+Getestet wurde mit OpenCVs Decoder. Der ist strenger als iPhone- und Android-Kameras. Es ist möglich, dass ein Kreis-Eye-Frame auf echten Geräten funktioniert - aber 0 von 15 ist kein Rauschen, und das ist nichts, was man ungetestet auf Druckmaterial loslässt.
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -0,0 +1,351 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+**QR Master** is a production-ready SaaS application for creating and managing QR codes with advanced analytics, Stripe payment integration, and multi-tier subscription plans (FREE, PRO, BUSINESS).
+
+## Tech Stack
+
+- **Frontend**: Next.js 14 (App Router), React 18, TypeScript, Tailwind CSS, Framer Motion
+- **Backend**: Next.js API Routes, Prisma ORM, PostgreSQL
+- **Authentication**: NextAuth.js v4 (Credentials + Google OAuth)
+- **Payments**: Stripe (subscriptions, webhooks)
+- **Cache**: Redis (optional)
+- **Analytics**: PostHog (optional), QR scan tracking with IP hashing
+- **QR Generation**: qrcode, qr-code-styling libraries
+- **Bulk Operations**: Papa Parse (CSV), ExcelJS, JSZip
+- **Storage**: AWS S3 (via @aws-sdk)
+
+## Quick Development Commands
+
+```bash
+# Setup
+npm install
+npm run docker:dev              # Start PostgreSQL & Redis in Docker
+npx prisma migrate dev          # Run migrations
+npm run db:seed                 # Seed demo data
+
+# Development
+npm run dev                      # Start dev server (port 3050)
+npm run lint                     # Run ESLint
+
+# Database
+npm run db:migrate              # Run pending migrations (dev mode)
+npm run db:deploy               # Apply migrations (production)
+npm run db:studio               # Open Prisma Studio UI
+npx prisma migrate reset        # Reset database (drops, recreates, seeds)
+
+# Docker
+npm run docker:prod             # Start full production stack
+npm run docker:dev:stop         # Stop dev services
+npm run docker:logs             # View logs
+npm run docker:db               # PostgreSQL CLI
+npm run docker:redis            # Redis CLI
+npm run docker:backup           # Backup database to SQL file
+
+# Build & Deploy
+npm run build                   # Production build
+npm run start                   # Start production server
+```
+
+## Project Structure
+
+```
+src/
+├── app/
+│   └── (main)/
+│       ├── (app)/              # Authenticated app pages (dashboard, bulk-creation, settings)
+│       ├── (auth)/             # Auth pages (login, signup, forgot-password)
+│       ├── (marketing)/        # Public pages & marketing tools
+│       │   └── tools/          # QR code type-specific generators (20+ tools)
+│       └── api/                # API routes organized by domain
+│           ├── auth/           # Authentication (signin, signup, OAuth, password reset)
+│           ├── qrs/            # QR code CRUD (GET, POST, PATCH, DELETE)
+│           ├── analytics/      # Analytics summary endpoint
+│           ├── stripe/         # Payment webhooks & session management
+│           ├── user/           # User profile, plan, stats, password
+│           ├── newsletter/     # Subscription management
+│           └── [other]/        # admin, feedback, leads, bulk, etc.
+├── components/
+│   ├── ui/                     # Reusable UI primitives (Card, Dialog, Input, etc.)
+│   ├── generator/              # QR code generator components
+│   ├── analytics/              # Charts, maps, data visualization
+│   ├── dashboard/              # Dashboard-specific components
+│   ├── settings/               # Settings & account components
+│   └── SessionProvider.tsx     # NextAuth session provider
+├── lib/
+│   ├── auth.ts                 # NextAuth configuration
+│   ├── db.ts                   # Prisma client
+│   ├── stripe.ts               # Stripe utilities
+│   ├── email.ts                # Email sending (Resend)
+│   ├── qr.ts                   # QR code generation utilities
+│   ├── geo.ts                  # Geolocation utilities
+│   ├── hash.ts                 # IP hashing (privacy)
+│   ├── csrf.ts                 # CSRF token generation/validation
+│   ├── rateLimit.ts            # Rate limiting utilities
+│   ├── schema.ts               # Zod validation schemas
+│   ├── validationSchemas.ts    # Additional validation
+│   └── cookieConfig.ts         # Cookie configuration
+├── hooks/
+│   ├── useCsrf.ts              # CSRF token hook
+│   └── useTranslation.ts       # i18n hook
+└── types/
+    └── analytics.ts            # Analytics type definitions
+```
+
+## Database Architecture
+
+**Key Models** (see `prisma/schema.prisma`):
+
+- **User**: User accounts with Stripe subscription fields
+- **QRCode**: QR code records (static/dynamic, multiple content types)
+- **QRScan**: Analytics data (ts, ipHash, device, os, country, UTM params)
+- **Account/Session**: NextAuth authentication tables
+- **Integration**: Third-party integrations
+- **NewsletterSubscription**: Email subscribers
+- **Lead**: Lead generation data
+
+**QR Code Types**: URL, VCARD, GEO, PHONE, SMS, TEXT, WHATSAPP, PDF, APP, COUPON, FEEDBACK
+
+## API Architecture
+
+### Authentication Flow
+- Credentials-based login/signup via `/api/auth/signup` and `/api/auth/simple-login`
+- Google OAuth via `/api/auth/google`
+- NextAuth.js session management at `/api/auth/[...nextauth]`
+- Password reset: `/api/auth/forgot-password` + `/api/auth/reset-password`
+
+### QR Code Operations
+- **CRUD**: `GET/POST /api/qrs`, `GET/PATCH/DELETE /api/qrs/[id]`
+- **Static Generation**: `POST /api/qrs/static`
+- **Bulk Operations**: `POST /api/bulk/*` for CSV/Excel import
+- **Public Redirect**: `GET /r/[slug]` (redirect + analytics tracking)
+
+### Payments
+- Stripe webhooks: `POST /api/stripe/webhook`
+- Checkout session: `POST /api/stripe/checkout` or `/api/stripe/create-checkout-session`
+- Customer portal: `POST /api/stripe/portal`
+- Subscription sync: `POST /api/stripe/sync-subscription`
+- Cancellation: `POST /api/stripe/cancel-subscription`
+
+### Analytics
+- Summary endpoint: `GET /api/analytics/summary?qrId=<id>`
+- Scan tracking with hashed IP (GDPR-compliant)
+
+## Key Implementation Patterns
+
+### Authentication & Authorization
+- NextAuth.js v4 with Prisma adapter
+- Sessions stored in database
+- CSRF protection on all mutations (check `useCsrf` hook)
+- Password hashing with bcryptjs
+
+### API Security
+- Rate limiting on sensitive endpoints (auth, payments)
+- CSRF tokens validated on POST/PATCH/DELETE
+- IP hashing for privacy (IP_SALT environment variable)
+- DNT header respected for analytics
+
+### Database Operations
+- Prisma ORM for all database access
+- Migrations stored in `prisma/migrations/`
+- Seed script for demo data in `prisma/seed.ts`
+- Database indexes on frequently queried fields (userId, createdAt, etc.)
+
+### QR Code Generation
+- `qrcode` library for basic generation
+- `qr-code-styling` for advanced customization
+- `qrcode.react` for inline React components
+- Canvas/SVG export via `html-to-image`, `jspdf`, `jszip`
+
+### State & Validation
+- Zod schemas in `/lib/schema.ts` for runtime validation
+- TypeScript strict mode enabled
+- Prisma provides type safety at database layer
+
+## Environment Variables
+
+**Required**:
+- `DATABASE_URL` - PostgreSQL connection string
+- `NEXTAUTH_SECRET` - JWT encryption secret
+- `NEXTAUTH_URL` - Application URL (default: `http://localhost:3050`)
+- `IP_SALT` - Salt for IP hashing
+
+**Optional but Important**:
+- `STRIPE_SECRET_KEY`, `STRIPE_WEBHOOK_SECRET`, `NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY`
+- `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET` - OAuth
+- `REDIS_URL` - Redis connection
+- `NEXT_PUBLIC_POSTHOG_KEY`, `NEXT_PUBLIC_POSTHOG_HOST` - Analytics
+- `NEXT_PUBLIC_INDEXABLE` - Set to `true` for production (enables search engine indexing)
+
+**Generate Secrets**:
+```bash
+openssl rand -base64 32  # NEXTAUTH_SECRET and IP_SALT
+```
+
+## Common Tasks
+
+### Adding a New QR Code Type
+1. Add type to `ContentType` enum in `prisma/schema.prisma`
+2. Create generator component in `src/components/generator/` or `src/app/(main)/(marketing)/tools/`
+3. Add validation schema in `src/lib/schema.ts`
+4. Create API endpoint if needed in `src/app/(main)/api/qrs/`
+
+### Creating a New Marketing Tool Page
+1. Create page at `src/app/(main)/(marketing)/tools/[tool-name]/page.tsx`
+2. Create generator component in same directory
+3. Add SEO metadata in page component
+4. Tool should be static (no database) or use public API endpoints
+
+### Adding a New API Endpoint
+1. Create route file in appropriate directory under `src/app/(main)/api/`
+2. Add Zod validation schema in `src/lib/schema.ts`
+3. Check authentication with `getServerSession()` if needed
+4. Implement rate limiting for sensitive operations
+5. Return typed responses with proper status codes
+
+### Database Schema Changes
+1. Update `prisma/schema.prisma`
+2. Run `npx prisma migrate dev --name <migration-name>`
+3. This creates migration file and updates Prisma client
+4. Test with `npm run db:seed` if demo data affected
+
+## Testing & Debugging
+
+- Demo account (after seed): email: `demo@qrmaster.com`, password: `demo123`
+- Prisma Studio: `npm run db:studio` - visual database browser
+- API testing: Check `/src/app/(main)/api/` for examples
+- Frontend: Pages hot-reload on changes during `npm run dev`
+
+## Performance Considerations
+
+- PostgreSQL indexes on `QRCode(userId, createdAt)` and `QRScan(qrId, ts)`
+- Redis optional but recommended for caching analytics
+- Static export for marketing pages when possible
+- Image optimization enabled in `next.config.mjs`
+- Prisma connection pooling recommended for production
+
+## Database Change Policy
+
+**IMPORTANT: No Prisma migrations.** All database schema changes (new columns, new enum values, new tables) must be applied via raw SQL commands directly against the running PostgreSQL instance.
+
+Workflow for schema changes:
+1. Write the raw SQL (e.g. `ALTER TABLE`, `ALTER TYPE ... ADD VALUE`)
+2. Run via Docker: `npm run docker:db` then execute SQL, or use `docker-compose exec db psql -U postgres -d qrmaster -c "..."`
+3. Update `prisma/schema.prisma` to match (so Prisma client types stay in sync)
+4. Run `npx prisma generate` to regenerate the client (no `migrate`)
+
+Example — adding an enum value:
+```sql
+ALTER TYPE "ContentType" ADD VALUE 'BARCODE';
+```
+
+## Common Pitfalls
+
+1. **Database Connection**: If "Can't reach database server", ensure Docker is running (`npm run docker:dev`)
+2. **Prisma Out of Sync**: Run `npx prisma generate` if TypeScript errors appear
+3. **Migration Conflicts**: Use `npx prisma migrate reset` to start fresh
+4. **Port 3050 in Use**: Change port in `package.json` dev script or kill process
+5. **Build Failures**: Check `NODE_OPTIONS='--max-old-space-size=4096'` in build script - set higher if needed
+
+## SEO & Content
+
+- Schema.org structured data implemented for products, organizations, FAQs
+- Breadcrumb navigation for UX/SEO
+- Meta tags configured per page
+- Open Graph images at `/api/og`
+- Sitemap generation via next-sitemap
+- Google Indexing API + IndexNow submission scripts available
+
+## AI SEO / AEO Tracking (AI Answer Engine Visibility)
+
+Ongoing effort to increase QR Master's presence in AI-generated answers (ChatGPT, Perplexity, AI Overviews, etc.) for QR-code-generator-related queries. Update this section after each audit/build cycle so future sessions build on prior findings instead of re-deriving them.
+
+### Baseline audit (2026-07-22)
+
+Query-fanout data (what an AI model searches for while answering a prompt) showed QR Master already being cited in AI-generated answers for 3 of 9 tested query themes: "best QR code generator for marketing campaigns", "QR code generator with analytics and tracking", and "affordable dynamic QR code generator for small business" — positioned as the budget/SMB pick alongside Uniqode, QR TIGER, Bitly, Flowcode, and Hovercode.
+
+No QR Master citation appeared for: "best dynamic QR code generator 2026", "best QR code generator for businesses", "best QR code generator for agencies", "alternatives to QR TIGER", "QR code generator with unlimited scans", "free dynamic QR code generator unlimited scans".
+
+Existing on-site AEO infrastructure found during the audit:
+- `public/llms.txt` present — lists core pages and cornerstone guides for AI retrieval
+- `/alternatives/` pages exist only for: qr-code-generator.com, Flowcode, Beaconstac, Bitly
+- `/vs/` pages exist only for: Beaconstac
+- `/compare/[slug]` dynamic comparison route exists (e.g. `free-vs-paid-qr-code-generator`)
+- Blog cornerstones: best-qr-code-generator-2026, free-vs-paid-qr-generator, qr-code-tracking-guide-2025, dynamic-vs-static-qr-codes, qr-code-small-business, qr-code-scan-statistics-2026, etc.
+
+Pattern observed: QR Master gets cited by AI models only where first-party comparison/guide content already exists on the domain. The fanout queries repeatedly run `site:` searches against Uniqode, QR TIGER (qrcode-tiger.com), Hovercode, Scanova, and QRCodeChimp — none of which currently have a matching QR Master alternatives/vs page.
+
+### Priority backlog (from this audit)
+1. Build `/alternatives/uniqode`, `/alternatives/qr-code-tiger`, `/alternatives/hovercode` (highest fanout frequency, in that order)
+2. Build matching `/vs/uniqode`, `/vs/qr-code-tiger`, `/vs/hovercode` (same format as `/vs/beaconstac`)
+3. New cornerstone guide: "QR code generator for agencies" (white-label, bulk creation, API) — zero QR Master positioning currently exists for this query cluster
+4. Update `public/llms.txt` once the new pages ship, so they enter the AI retrieval list
+5. Re-run the same query-fanout test periodically to track citation-rate changes over time
+
+### Additional confirmed win — "dynamic barcode generator" (2026-07-22, same session)
+
+Tested outside the original 9-theme set. QR Master is cited as the "Best overall option" for this query — credited for trackable/editable dynamic barcodes, bulk generation, unified analytics, and UTM tracking, plus static EAN-13/UPC-A/Code 128 support when editability isn't needed. The AI answer also included a "requirement → recommended format" decision table (dynamic QR vs. EAN-13/UPC-A vs. Code 128 vs. GS1 Digital Link) that maps closely to existing on-site content.
+
+This maps directly to the live `/dynamic-barcode-generator` page and `/tools/barcode-generator` tool, reinforcing the pattern above: dedicated first-party pages targeting a query cluster get cited, gaps without dedicated pages don't. Counts as a 4th confirmed positive theme alongside the original 3 from the baseline audit.
+
+## Deployment Notes
+
+### Docker (Self-Hosted)
+```bash
+npm run docker:prod  # Builds and starts full stack
+docker-compose exec web npx prisma migrate deploy  # Run migrations in container
+```
+
+### Vercel
+- Push to GitHub and import in Vercel dashboard
+- Set environment variables in Vercel settings
+- Requires external PostgreSQL database (Vercel Postgres, Supabase, etc.)
+- Redis is optional
+
+## Additional Resources
+
+- README.md - Detailed setup and feature overview
+- DOCKER_SETUP.md - Complete Docker deployment guide
+- prisma/schema.prisma - Database schema and relationships
+- env.example - Environment variable template
+
+## gstack (REQUIRED — global install)
+
+Before doing any AI-assisted work in this repo, verify gstack is installed globally:
+
+```bash
+test -d ~/.claude/skills/gstack/bin && echo "GSTACK_OK" || echo "GSTACK_MISSING"
+```
+
+If `GSTACK_MISSING`: stop and install it:
+
+```bash
+git clone --depth 1 https://github.com/garrytan/gstack.git ~/.claude/skills/gstack
+cd ~/.claude/skills/gstack && ./setup --team
+```
+
+After install, use gstack skills where appropriate, especially `/browse`, `/review`, `/investigate`, `/qa`, `/ship`, and `/cso`.
+Use `~/.claude/skills/gstack/...` for gstack file paths because this repo does not vendor the pack locally.
+
+## Skill routing
+
+When the user's request matches an available skill, ALWAYS invoke it using the Skill
+tool as your FIRST action. Do NOT answer directly, do NOT use other tools first.
+The skill has specialized workflows that produce better results than ad-hoc answers.
+
+Key routing rules:
+- Product ideas, "is this worth building", brainstorming → invoke office-hours
+- Bugs, errors, "why is this broken", 500 errors → invoke investigate
+- Ship, deploy, push, create PR → invoke ship
+- QA, test the site, find bugs → invoke qa
+- Code review, check my diff → invoke review
+- Update docs after shipping → invoke document-release
+- Weekly retro → invoke retro
+- Design system, brand → invoke design-consultation
+- Visual audit, design polish → invoke design-review
+- Architecture review → invoke plan-eng-review
+- Save progress, checkpoint, resume → invoke checkpoint
+- Code quality, health check → invoke health
--- a/CTR_REWRITE_2026-07-27.md
+++ b/CTR_REWRITE_2026-07-27.md
@@ -0,0 +1,71 @@
+# SERP-CTR Rewrite — 27. Juli 2026
+
+Grundlage: GSC-Export 28 Tage (8.944 Impressionen, 52 Klicks, 0,58% CTR, Ø-Position 33,0)
+Methodik: `direct-response-copywriting` + Positioning Decision vom 26.07.2026 (Direction 1 als Positionierung, Direction 2 als Proof-Layer)
+
+## Ehrliche Einordnung des 5–10%-Ziels
+
+Site-weite CTR von 5–10% ist bei Ø-Position 33 **nicht durch Copy erreichbar**. CTR ist primär eine Funktion der Position:
+
+| Position | Erwartete CTR |
+|---|---|
+| 1 | 28–40% |
+| 3 | 10–11% |
+| 5 | 5–6% |
+| 10 | 2–3% |
+| 15 | 1–2% |
+| 30+ | <0,3% |
+
+Die zwei größten Impression-Seiten (`/dynamic-qr-code-generator` 1.694 Imp @ Pos 33,5 und `/qr-code-tracking` 1.023 Imp @ Pos 34,0) haben 0% CTR. Das ist bei Position 33 **normal** — 31% aller Impressionen der Site liegen auf Seite 4 der SERP. Kein Title der Welt repariert das; das ist ein Ranking-Thema.
+
+**Was Copy realistisch leisten kann:**
+- Seiten auf Pos 1–15 auf ihren Positions-Benchmark heben → aus 52 Klicks werden ca. 90–120
+- Die großen Volumenseiten so vorbereiten, dass sie beim Aufstieg auf Seite 1 sofort auf Benchmark klicken statt bei 2%
+
+5–10% site-weit wird erst realistisch, wenn die Ø-Position unter ~10 liegt. Dann trägt diese Copy den Unterschied.
+
+## Die drei strukturellen Fehler, die behoben wurden
+
+**1. Deutsche Halbsätze in englischen Descriptions.** 97% der Impressionen kommen aus USA/Indien/englischsprachigen Märkten. Trotzdem stand in den Tool-Descriptions „Teams QR Code erstellen", „Zoom QR Code erstellen", „TikTok QR Code erstellen", „Erstelle Bitcoin & Ethereum QR Codes", „Standort teilen leicht gemacht". Für einen englischen Sucher liest sich das wie maschinell übersetzter Spam. Das ist die wahrscheinlichste Ursache für 0,61% CTR auf Pos 10 (`barbershops`) und 0,65% auf Pos 17 (`zoom`).
+
+**2. `| QR Master`-Suffix und 65+ Zeichen lange Titles.** Google schneidet bei ~580px ab. `Free Microsoft Teams QR Code Generator | Join Meetings | QR Master` (66 Zeichen) wurde in der SERP abgeschnitten — der Nutzen verschwand im „…". Alle neuen Titles liegen bei 42–55 Zeichen.
+
+**3. Null Pattern Interruption.** Jedes Ergebnis in dieser SERP sagt „Free QR Code Generator". Die alten Descriptions sagten „Instant and free", „Free & Easy" — die vagesten möglichen Claims. Neu: konkrete, falsifizierbare Spezifika (3 dynamische Codes gratis, 1.000 Codes aus einem Spreadsheet, 42 Zeichen Wallet-Adresse, EAN-13/UPC-A/Code 128).
+
+## Wichtigste Änderungen
+
+| Seite | Imp | CTR | Pos | Kernänderung |
+|---|---|---|---|---|
+| `/` | 1.046 | 4,88% | 4,6 | Title: Mechanismus statt Kategorie. Description: 3 verifizierte Zahlen statt Feature-Liste. H1: „The Link Doesn't Have to Stay Wrong Once It's Printed" |
+| `/qr-code-tracking` | 1.023 | 0% | 34,0 | Title war „QR Code Tracking: Track QR Code Scans" — redundant, kein Nutzenversprechen. Neu: „See Which Placement Drove the Scan" (= Main-Headline-Idee aus Offer Brief §14) |
+| `/dynamic-qr-code-generator` | 1.694 | 0% | 33,5 | Title war schon gut, blieb. Description auf Schmerz + Zahlen umgestellt |
+| `/tools/google-review-qr-code` | 566 | 0,18% | 24,8 | Description führt jetzt mit dem Moment: „while the customer is still standing there" |
+| `/tools/teams-qr-code` | 277 | 3,25% | 9,6 | Title von 66 auf 48 Zeichen, Deutsch raus |
+| `/qr-code-for/barbershops` | 163 | 0,61% | 10,0 | metaTitle war 68 Zeichen → Fallback griff auf generisches „QR Codes for Barbershops \| QR Master". Jetzt 44 Zeichen mit Nutzen |
+| `/learn` | 226 | 0,88% | 11,3 | Zielt auf „qr mastery" (130 Imp @ Pos 5,1). Description führt jetzt mit den Problemen statt mit „Learning Hub" |
+| `/bulk-qr-code-generator` | 296 | 2,36% | 23,1 | Description nennt offen „Output is static — not dynamic or trackable" (Belief 5 / Proof-Layer) |
+
+Zusätzlich überarbeitet: crypto, facebook, url, vcard, instagram, tiktok, twitter, zoom, geolocation, barcode-generator, custom-qr-code-generator, alternatives/beaconstac, blog/microsoft-teams-qr-code.
+
+## Zwei Korrekturen an bestehenden Claims
+
+- **`/alternatives/beaconstac`**: Erster Entwurf enthielt „Not €99+" über Uniqode. Der Offer Brief verifiziert Uniqodes Preis **nicht** (nur „G2-Muster: teuer für kleine Teams"). Behauptung entfernt — genannt werden nur die eigenen, verifizierten Preise €0/€9/€29.
+- **Pricing-Card**: „Bulk QR Creation (up to 1,000)" → „(up to 1,000, static output)" in `en.json`. Das war Immediate Next Action #1 aus dem Offer Brief (A2) und die größte Transparenz-Lücke auf der Seite.
+
+## Was als Nächstes mehr bringt als weitere Copy
+
+1. **Ranking, nicht CTR.** 31% der Impressionen liegen auf Position 30+. Der Hebel dort ist Content/Links, nicht der Title.
+2. **Die Kündigungs-Policy (Offer Brief A3).** ToS §4 sagt „may affect the availability of dynamic QR codes". Für genau diese Zielgruppe ist das das Erkennungszeichen der schlechten Anbieter. Blockiert den gesamten Proof-Layer.
+3. **10–15 unabhängige Reviews auf G2/Capterra.** Laut Offer Brief §8 höher priorisiert als jede Copy-Iteration.
+
+## Messung
+
+In 4 Wochen im GSC vergleichen — **pro Seite und positionsbereinigt**, nicht site-weit:
+
+- `/` — Ziel 7–9% (von 4,88%, bei stabiler Pos ~4,6)
+- `/learn` — Ziel 1,8–2,5% (von 0,88%)
+- `/qr-code-for/barbershops` — Ziel 2,0–2,5% (von 0,61%)
+- `/tools/zoom-qr-code` — Ziel 1,2% (von 0,65%)
+- `/tools/teams-qr-code` — Ziel 4–5% (von 3,25%)
+
+Wenn die Position sich gleichzeitig verändert, ist der Vergleich der Rohwerte wertlos — dann `gsc-ctr-by-position` verwenden.
--- a/DEPLOYMENT_CHECKLIST.md
+++ b/DEPLOYMENT_CHECKLIST.md
@@ -1,269 +0,0 @@
-# 🚀 Deployment Checklist für QR Master
-
-Diese Checkliste enthält alle notwendigen Änderungen vor dem Push nach Gitea und dem Production Deployment.
-
---
-
-## ✅ 1. Environment Variables (.env)
-
-### Basis URLs ändern
-```bash
-# Von:
-NEXT_PUBLIC_APP_URL=http://localhost:3050
-NEXTAUTH_URL=http://localhost:3050
-
-# Zu:
-NEXT_PUBLIC_APP_URL=https://www.qrmaster.net
-NEXTAUTH_URL=https://www.qrmaster.net
-```
-
-### Secrets generieren (falls noch nicht geschehen)
-```bash
-# NEXTAUTH_SECRET (für JWT/Session Encryption)
-openssl rand -base64 32
-
-# IP_SALT (für DSGVO-konforme IP-Hashing)
-openssl rand -base64 32
-```
-
-Bereits generiert:
- ✅ NEXTAUTH_SECRET: `PT8XVydC4v7QluCz/mV1yb7Y3docSFZeFDioJz4ZE98=`
- ✅ IP_SALT: `j/aluIpzsgn5Z6cbF4conM6ApK5cj4jDagkswzfgQPc=`
-
-### Database URLs
-```bash
-# Development (localhost):
-DATABASE_URL="postgresql://postgres:postgres@localhost:5435/qrmaster?schema=public"
-DIRECT_URL="postgresql://postgres:postgres@localhost:5435/qrmaster?schema=public"
-
-# Production (anpassen an deinen Server):
-DATABASE_URL="postgresql://USER:PASSWORD@HOST:5432/qrmaster?schema=public"
-DIRECT_URL="postgresql://USER:PASSWORD@HOST:5432/qrmaster?schema=public"
-```
-
---
-
-## 🔐 2. Google OAuth Configuration
-
-### Redirect URIs in Google Cloud Console hinzufügen
-
-1. Gehe zu: https://console.cloud.google.com/apis/credentials
-2. Wähle deine OAuth 2.0 Client ID: `683784117141-ci1d928jo8f9g6i1isrveflmrinp92l4.apps.googleusercontent.com`
-3. Füge folgende **Authorized redirect URIs** hinzu:
-
-```
-https://www.qrmaster.net/api/auth/callback/google
-```
-
-**Optional** (für Staging/Testing):
-```
-http://localhost:3050/api/auth/callback/google
-https://staging.qrmaster.net/api/auth/callback/google
-```
-
---
-
-## 💳 3. Stripe Configuration
-
-### ⚠️ WICHTIG: Von Test Mode zu Live Mode wechseln
-
-#### Current (Test Mode):
-```bash
-STRIPE_SECRET_KEY=sk_test_51QYL7gP9xM...
-NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_51QYL7gP9xM...
-```
-
-#### Production (Live Mode):
-1. Gehe zu: https://dashboard.stripe.com/
-2. Wechsle von **Test Mode** zu **Live Mode** (Toggle oben rechts)
-3. Hole dir die **Live Keys**:
-   - `API Keys` → `Secret key` (beginnt mit `sk_live_`)
-   - `API Keys` → `Publishable key` (beginnt mit `pk_live_`)
-
-```bash
-# Production Keys:
-STRIPE_SECRET_KEY=sk_live_XXXXX
-NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_live_XXXXX
-```
-
-#### Webhook Secret (Production)
-1. Erstelle einen neuen Webhook Endpoint: https://dashboard.stripe.com/webhooks
-2. Endpoint URL: `https://www.qrmaster.net/api/webhooks/stripe`
-3. Events to listen:
-   - `checkout.session.completed`
-   - `customer.subscription.updated`
-   - `customer.subscription.deleted`
-   - `invoice.payment_succeeded`
-   - `invoice.payment_failed`
-4. Kopiere den **Signing Secret** (beginnt mit `whsec_`)
-
-```bash
-STRIPE_WEBHOOK_SECRET=whsec_XXXXX
-```
-
-#### Price IDs aktualisieren
-Erstelle Produkte und Preise in **Live Mode**:
-1. https://dashboard.stripe.com/products
-2. Erstelle "Pro" und "Business" Pläne
-3. Kopiere die Price IDs (beginnen mit `price_`)
-
-```bash
-STRIPE_PRICE_ID_PRO_MONTHLY=price_XXXXX
-STRIPE_PRICE_ID_PRO_YEARLY=price_XXXXX
-STRIPE_PRICE_ID_BUSINESS_MONTHLY=price_XXXXX
-STRIPE_PRICE_ID_BUSINESS_YEARLY=price_XXXXX
-```
-
---
-
-## 📧 4. Resend Email Configuration
-
-### Domain Verification
-1. Gehe zu: https://resend.com/domains
-2. Füge Domain hinzu: `qrmaster.net`
-3. Konfiguriere DNS Records (SPF, DKIM, DMARC)
-4. Warte auf Verification
-
-### From Email anpassen
-Aktuell verwendet alle Emails: `onboarding@resend.dev` (Resend's Test Domain)
-
-Nach Domain Verification in `src/lib/email.ts` ändern:
-```typescript
-// Von:
-from: 'Timo from QR Master <onboarding@resend.dev>',
-
-// Zu:
-from: 'Timo from QR Master <hello@qrmaster.net>',
-// oder
-from: 'Timo from QR Master <noreply@qrmaster.net>',
-```
-
---
-
-## 🔍 5. SEO Configuration
-
-### Bereits korrekt konfiguriert ✅
-```bash
-NEXT_PUBLIC_INDEXABLE=true  # ✅ Bereits gesetzt
-```
-
-### Sitemap & robots.txt prüfen
- Sitemap: `https://www.qrmaster.net/sitemap.xml`
- Robots: `https://www.qrmaster.net/robots.txt`
-
-Nach Deployment testen!
-
---
-
-## 📊 6. PostHog Analytics (Optional)
-
-Falls du PostHog nutzt:
-```bash
-NEXT_PUBLIC_POSTHOG_KEY=phc_XXXXX
-NEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com
-```
-
---
-
-## 🐳 7. Docker Deployment
-
-### docker-compose.yml prüfen
-Stelle sicher, dass alle ENV Variables korrekt gemappt sind:
-
-```yaml
-environment:
-  NEXTAUTH_URL: https://www.qrmaster.net
-  NEXT_PUBLIC_APP_URL: https://www.qrmaster.net
-  # ... weitere vars
-```
-
-### Deployment Commands
-```bash
-# Build & Deploy
-docker-compose up -d --build
-
-# Database Migration (nach erstem Deploy)
-docker-compose exec web npm run db:migrate
-
-# Logs checken
-docker-compose logs -f web
-
-# Health Check
-curl https://www.qrmaster.net
-```
-
---
-
-## 🔒 8. Security Checklist
-
- [ ] ✅ NEXTAUTH_SECRET ist gesetzt und sicher (32+ Zeichen)
- [ ] ✅ IP_SALT ist gesetzt und sicher
- [ ] ⚠️ Stripe ist auf **Live Mode** umgestellt
- [ ] ⚠️ Google OAuth Redirect URIs enthalten Production URL
- [ ] ⚠️ Resend Domain ist verifiziert
- [ ] ⚠️ Webhook Secrets sind für Production gesetzt
- [ ] ⚠️ Database URLs zeigen auf Production DB
- [ ] ⚠️ Keine Test/Dev Secrets in Production
-
---
-
-## 📝 9. Vor dem Git Push
-
-### Files prüfen
-```bash
-# .env sollte NICHT committet werden!
-git status
-
-# Falls .env in Git ist:
-git rm --cached .env
-echo ".env" >> .gitignore
-```
-
-### Sensible Daten entfernen
- [ ] Keine API Keys im Code
- [ ] Keine Secrets in Config Files
- [ ] `.env` ist in `.gitignore`
-
---
-
-## 🎯 10. Nach dem Deployment testen
-
-### Funktionen testen
-1. **Google OAuth Login**: https://www.qrmaster.net/login
-2. **QR Code erstellen**: https://www.qrmaster.net/create
-3. **Stripe Checkout**: Testprodukt kaufen mit echten Stripe Test Cards
-4. **Email Delivery**: Password Reset testen
-5. **Analytics**: PostHog Events tracken
-
-### Monitoring
-```bash
-# Server Logs
-docker-compose logs -f
-
-# Database Status
-docker-compose exec db psql -U postgres -d qrmaster -c "SELECT COUNT(*) FROM \"User\";"
-
-# Redis Status
-docker-compose exec redis redis-cli PING
-```
-
---
-
-## 📞 Support Kontakte
-
- **Stripe Support**: https://support.stripe.com
- **Google Cloud Support**: https://support.google.com/cloud
- **Resend Support**: https://resend.com/docs
- **Next.js Docs**: https://nextjs.org/docs
-
---
-
-## ✨ Deployment erfolgreich!
-
-Nach erfolgreichem Deployment:
-1. ✅ Teste alle wichtigen Features
-2. ✅ Monitor Logs für Fehler
-3. ✅ Prüfe Analytics Dashboard
-4. ✅ Backup der Production Database erstellen
-
-**Good luck! 🚀**
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -0,0 +1,322 @@
+# Design System Inspired by Stripe
+
+## 1. Visual Theme & Atmosphere
+
+Stripe's website is the gold standard of fintech design -- a system that manages to feel simultaneously technical and luxurious, precise and warm. The page opens on a clean white canvas (`#ffffff`) with deep navy headings (`#061b31`) and a signature purple (`#533afd`) that functions as both brand anchor and interactive accent. This isn't the cold, clinical purple of enterprise software; it's a rich, saturated violet that reads as confident and premium. The overall impression is of a financial institution redesigned by a world-class type foundry.
+
+The custom `sohne-var` variable font is the defining element of Stripe's visual identity. Every text element enables the OpenType `"ss01"` stylistic set, which modifies character shapes for a distinctly geometric, modern feel. At display sizes (48px-56px), sohne-var runs at weight 300 -- an extraordinarily light weight for headlines that creates an ethereal, almost whispered authority. This is the opposite of the "bold hero headline" convention; Stripe's headlines feel like they don't need to shout. The negative letter-spacing (-1.4px at 56px, -0.96px at 48px) tightens the text into dense, engineered blocks. At smaller sizes, the system also uses weight 300 with proportionally reduced tracking, and tabular numerals via `"tnum"` for financial data display.
+
+What truly distinguishes Stripe is its shadow system. Rather than the flat or single-layer approach of most sites, Stripe uses multi-layer, blue-tinted shadows: the signature `rgba(50,50,93,0.25)` combined with `rgba(0,0,0,0.1)` creates shadows with a cool, almost atmospheric depth -- like elements are floating in a twilight sky. The blue-gray undertone of the primary shadow color (50,50,93) ties directly to the navy-purple brand palette, making even elevation feel on-brand.
+
+**Key Characteristics:**
+- sohne-var with OpenType `"ss01"` on all text -- a custom stylistic set that defines the brand's letterforms
+- Weight 300 as the signature headline weight -- light, confident, anti-convention
+- Negative letter-spacing at display sizes (-1.4px at 56px, progressive relaxation downward)
+- Blue-tinted multi-layer shadows using `rgba(50,50,93,0.25)` -- elevation that feels brand-colored
+- Deep navy (`#061b31`) headings instead of black -- warm, premium, financial-grade
+- Conservative border-radius (4px-8px) -- nothing pill-shaped, nothing harsh
+- Ruby (`#ea2261`) and magenta (`#f96bee`) accents for gradient and decorative elements
+- `SourceCodePro` as the monospace companion for code and technical labels
+
+## 2. Color Palette & Roles
+
+### Primary
+- **Stripe Purple** (`#533afd`): Primary brand color, CTA backgrounds, link text, interactive highlights. A saturated blue-violet that anchors the entire system.
+- **Deep Navy** (`#061b31`): `--hds-color-heading-solid`. Primary heading color. Not black, not gray -- a very dark blue that adds warmth and depth to text.
+- **Pure White** (`#ffffff`): Page background, card surfaces, button text on dark backgrounds.
+
+### Brand & Dark
+- **Brand Dark** (`#1c1e54`): `--hds-color-util-brand-900`. Deep indigo for dark sections, footer backgrounds, and immersive brand moments.
+- **Dark Navy** (`#0d253d`): `--hds-color-core-neutral-975`. The darkest neutral -- almost-black with a blue undertone for maximum depth without harshness.
+
+### Accent Colors
+- **Ruby** (`#ea2261`): `--hds-color-accentColorMode-ruby-icon-solid`. Warm red-pink for icons, alerts, and accent elements.
+- **Magenta** (`#f96bee`): `--hds-color-accentColorMode-magenta-icon-gradientMiddle`. Vivid pink-purple for gradients and decorative highlights.
+- **Magenta Light** (`#ffd7ef`): `--hds-color-util-accent-magenta-100`. Tinted surface for magenta-themed cards and badges.
+
+### Interactive
+- **Primary Purple** (`#533afd`): Primary link color, active states, selected elements.
+- **Purple Hover** (`#4434d4`): Darker purple for hover states on primary elements.
+- **Purple Deep** (`#2e2b8c`): `--hds-color-button-ui-iconHover`. Dark purple for icon hover states.
+- **Purple Light** (`#b9b9f9`): `--hds-color-action-bg-subduedHover`. Soft lavender for subdued hover backgrounds.
+- **Purple Mid** (`#665efd`): `--hds-color-input-selector-text-range`. Range selector and input highlight color.
+
+### Neutral Scale
+- **Heading** (`#061b31`): Primary headings, nav text, strong labels.
+- **Label** (`#273951`): `--hds-color-input-text-label`. Form labels, secondary headings.
+- **Body** (`#64748d`): Secondary text, descriptions, captions.
+- **Success Green** (`#15be53`): Status badges, success indicators (with 0.2-0.4 alpha for backgrounds/borders).
+- **Success Text** (`#108c3d`): Success badge text color.
+- **Lemon** (`#9b6829`): `--hds-color-core-lemon-500`. Warning and highlight accent.
+
+### Surface & Borders
+- **Border Default** (`#e5edf5`): Standard border color for cards, dividers, and containers.
+- **Border Purple** (`#b9b9f9`): Active/selected state borders on buttons and inputs.
+- **Border Soft Purple** (`#d6d9fc`): Subtle purple-tinted borders for secondary elements.
+- **Border Magenta** (`#ffd7ef`): Pink-tinted borders for magenta-themed elements.
+- **Border Dashed** (`#362baa`): Dashed borders for drop zones and placeholder elements.
+
+### Shadow Colors
+- **Shadow Blue** (`rgba(50,50,93,0.25)`): The signature -- blue-tinted primary shadow color.
+- **Shadow Dark Blue** (`rgba(3,3,39,0.25)`): Deeper blue shadow for elevated elements.
+- **Shadow Black** (`rgba(0,0,0,0.1)`): Secondary shadow layer for depth reinforcement.
+- **Shadow Ambient** (`rgba(23,23,23,0.08)`): Soft ambient shadow for subtle elevation.
+- **Shadow Soft** (`rgba(23,23,23,0.06)`): Minimal ambient shadow for light lift.
+
+## 3. Typography Rules
+
+### Font Family
+- **Primary**: `sohne-var`, with fallback: `SF Pro Display`
+- **Monospace**: `SourceCodePro`, with fallback: `SFMono-Regular`
+- **OpenType Features**: `"ss01"` enabled globally on all sohne-var text; `"tnum"` for tabular numbers on financial data and captions.
+
+### Hierarchy
+
+| Role | Font | Size | Weight | Line Height | Letter Spacing | Features | Notes |
+|------|------|------|--------|-------------|----------------|----------|-------|
+| Display Hero | sohne-var | 56px (3.50rem) | 300 | 1.03 (tight) | -1.4px | ss01 | Maximum size, whisper-weight authority |
+| Display Large | sohne-var | 48px (3.00rem) | 300 | 1.15 (tight) | -0.96px | ss01 | Secondary hero headlines |
+| Section Heading | sohne-var | 32px (2.00rem) | 300 | 1.10 (tight) | -0.64px | ss01 | Feature section titles |
+| Sub-heading Large | sohne-var | 26px (1.63rem) | 300 | 1.12 (tight) | -0.26px | ss01 | Card headings, sub-sections |
+| Sub-heading | sohne-var | 22px (1.38rem) | 300 | 1.10 (tight) | -0.22px | ss01 | Smaller section heads |
+| Body Large | sohne-var | 18px (1.13rem) | 300 | 1.40 | normal | ss01 | Feature descriptions, intro text |
+| Body | sohne-var | 16px (1.00rem) | 300-400 | 1.40 | normal | ss01 | Standard reading text |
+| Button | sohne-var | 16px (1.00rem) | 400 | 1.00 (tight) | normal | ss01 | Primary button text |
+| Button Small | sohne-var | 14px (0.88rem) | 400 | 1.00 (tight) | normal | ss01 | Secondary/compact buttons |
+| Link | sohne-var | 14px (0.88rem) | 400 | 1.00 (tight) | normal | ss01 | Navigation links |
+| Caption | sohne-var | 13px (0.81rem) | 400 | normal | normal | ss01 | Small labels, metadata |
+| Caption Small | sohne-var | 12px (0.75rem) | 300-400 | 1.33-1.45 | normal | ss01 | Fine print, timestamps |
+| Caption Tabular | sohne-var | 12px (0.75rem) | 300-400 | 1.33 | -0.36px | tnum | Financial data, numbers |
+| Micro | sohne-var | 10px (0.63rem) | 300 | 1.15 (tight) | 0.1px | ss01 | Tiny labels, axis markers |
+| Micro Tabular | sohne-var | 10px (0.63rem) | 300 | 1.15 (tight) | -0.3px | tnum | Chart data, small numbers |
+| Nano | sohne-var | 8px (0.50rem) | 300 | 1.07 (tight) | normal | ss01 | Smallest labels |
+| Code Body | SourceCodePro | 12px (0.75rem) | 500 | 2.00 (relaxed) | normal | -- | Code blocks, syntax |
+| Code Bold | SourceCodePro | 12px (0.75rem) | 700 | 2.00 (relaxed) | normal | -- | Bold code, keywords |
+| Code Label | SourceCodePro | 12px (0.75rem) | 500 | 2.00 (relaxed) | normal | uppercase | Technical labels |
+| Code Micro | SourceCodePro | 9px (0.56rem) | 500 | 1.00 (tight) | normal | ss01 | Tiny code annotations |
+
+### Principles
+- **Light weight as signature**: Weight 300 at display sizes is Stripe's most distinctive typographic choice. Where others use 600-700 to command attention, Stripe uses lightness as luxury -- the text is so confident it doesn't need weight to be authoritative.
+- **ss01 everywhere**: The `"ss01"` stylistic set is non-negotiable. It modifies specific glyphs (likely alternate `a`, `g`, `l` forms) to create a more geometric, contemporary feel across all sohne-var text.
+- **Two OpenType modes**: `"ss01"` for display/body text, `"tnum"` for tabular numerals in financial data. These never overlap -- a number in a paragraph uses ss01, a number in a data table uses tnum.
+- **Progressive tracking**: Letter-spacing tightens proportionally with size: -1.4px at 56px, -0.96px at 48px, -0.64px at 32px, -0.26px at 26px, normal at 16px and below.
+- **Two-weight simplicity**: Primarily 300 (body and headings) and 400 (UI/buttons). No bold (700) in the primary font -- SourceCodePro uses 500/700 for code contrast.
+
+## 4. Component Stylings
+
+### Buttons
+
+**Primary Purple**
+- Background: `#533afd`
+- Text: `#ffffff`
+- Padding: 8px 16px
+- Radius: 4px
+- Font: 16px sohne-var weight 400, `"ss01"`
+- Hover: `#4434d4` background
+- Use: Primary CTA ("Start now", "Contact sales")
+
+**Ghost / Outlined**
+- Background: transparent
+- Text: `#533afd`
+- Padding: 8px 16px
+- Radius: 4px
+- Border: `1px solid #b9b9f9`
+- Font: 16px sohne-var weight 400, `"ss01"`
+- Hover: background shifts to `rgba(83,58,253,0.05)`
+- Use: Secondary actions
+
+**Transparent Info**
+- Background: transparent
+- Text: `#2874ad`
+- Padding: 8px 16px
+- Radius: 4px
+- Border: `1px solid rgba(43,145,223,0.2)`
+- Use: Tertiary/info-level actions
+
+**Neutral Ghost**
+- Background: transparent (`rgba(255,255,255,0)`)
+- Text: `rgba(16,16,16,0.3)`
+- Padding: 8px 16px
+- Radius: 4px
+- Outline: `1px solid rgb(212,222,233)`
+- Use: Disabled or muted actions
+
+### Cards & Containers
+- Background: `#ffffff`
+- Border: `1px solid #e5edf5` (standard) or `1px solid #061b31` (dark accent)
+- Radius: 4px (tight), 5px (standard), 6px (comfortable), 8px (featured)
+- Shadow (standard): `rgba(50,50,93,0.25) 0px 30px 45px -30px, rgba(0,0,0,0.1) 0px 18px 36px -18px`
+- Shadow (ambient): `rgba(23,23,23,0.08) 0px 15px 35px 0px`
+- Hover: shadow intensifies, often adding the blue-tinted layer
+
+### Badges / Tags / Pills
+**Neutral Pill**
+- Background: `#ffffff`
+- Text: `#000000`
+- Padding: 0px 6px
+- Radius: 4px
+- Border: `1px solid #f6f9fc`
+- Font: 11px weight 400
+
+**Success Badge**
+- Background: `rgba(21,190,83,0.2)`
+- Text: `#108c3d`
+- Padding: 1px 6px
+- Radius: 4px
+- Border: `1px solid rgba(21,190,83,0.4)`
+- Font: 10px weight 300
+
+### Inputs & Forms
+- Border: `1px solid #e5edf5`
+- Radius: 4px
+- Focus: `1px solid #533afd` or purple ring
+- Label: `#273951`, 14px sohne-var
+- Text: `#061b31`
+- Placeholder: `#64748d`
+
+### Navigation
+- Clean horizontal nav on white, sticky with blur backdrop
+- Brand logotype left-aligned
+- Links: sohne-var 14px weight 400, `#061b31` text with `"ss01"`
+- Radius: 6px on nav container
+- CTA: purple button right-aligned ("Sign in", "Start now")
+- Mobile: hamburger toggle with 6px radius
+
+### Decorative Elements
+**Dashed Borders**
+- `1px dashed #362baa` (purple) for placeholder/drop zones
+- `1px dashed #ffd7ef` (magenta) for magenta-themed decorative borders
+
+**Gradient Accents**
+- Ruby-to-magenta gradients (`#ea2261` to `#f96bee`) for hero decorations
+- Brand dark sections use `#1c1e54` backgrounds with white text
+
+## 5. Layout Principles
+
+### Spacing System
+- Base unit: 8px
+- Scale: 1px, 2px, 4px, 6px, 8px, 10px, 11px, 12px, 14px, 16px, 18px, 20px
+- Notable: The scale is dense at the small end (every 2px from 4-12), reflecting Stripe's precision-oriented UI for financial data
+
+### Grid & Container
+- Max content width: approximately 1080px
+- Hero: centered single-column with generous padding, lightweight headlines
+- Feature sections: 2-3 column grids for feature cards
+- Full-width dark sections with `#1c1e54` background for brand immersion
+- Code/dashboard previews as contained cards with blue-tinted shadows
+
+### Whitespace Philosophy
+- **Precision spacing**: Unlike the vast emptiness of minimalist systems, Stripe uses measured, purposeful whitespace. Every gap is a deliberate typographic choice.
+- **Dense data, generous chrome**: Financial data displays (tables, charts) are tightly packed, but the UI chrome around them is generously spaced. This creates a sense of controlled density -- like a well-organized spreadsheet in a beautiful frame.
+- **Section rhythm**: White sections alternate with dark brand sections (`#1c1e54`), creating a dramatic light/dark cadence that prevents monotony without introducing arbitrary color.
+
+### Border Radius Scale
+- Micro (1px): Fine-grained elements, subtle rounding
+- Standard (4px): Buttons, inputs, badges, cards -- the workhorse
+- Comfortable (5px): Standard card containers
+- Relaxed (6px): Navigation, larger interactive elements
+- Large (8px): Featured cards, hero elements
+- Compound: `0px 0px 6px 6px` for bottom-rounded containers (tab panels, dropdown footers)
+
+## 6. Depth & Elevation
+
+| Level | Treatment | Use |
+|-------|-----------|-----|
+| Flat (Level 0) | No shadow | Page background, inline text |
+| Ambient (Level 1) | `rgba(23,23,23,0.06) 0px 3px 6px` | Subtle card lift, hover hints |
+| Standard (Level 2) | `rgba(23,23,23,0.08) 0px 15px 35px` | Standard cards, content panels |
+| Elevated (Level 3) | `rgba(50,50,93,0.25) 0px 30px 45px -30px, rgba(0,0,0,0.1) 0px 18px 36px -18px` | Featured cards, dropdowns, popovers |
+| Deep (Level 4) | `rgba(3,3,39,0.25) 0px 14px 21px -14px, rgba(0,0,0,0.1) 0px 8px 17px -8px` | Modals, floating panels |
+| Ring (Accessibility) | `2px solid #533afd` outline | Keyboard focus ring |
+
+**Shadow Philosophy**: Stripe's shadow system is built on a principle of chromatic depth. Where most design systems use neutral gray or black shadows, Stripe's primary shadow color (`rgba(50,50,93,0.25)`) is a deep blue-gray that echoes the brand's navy palette. This creates shadows that don't just add depth -- they add brand atmosphere. The multi-layer approach pairs this blue-tinted shadow with a pure black secondary layer (`rgba(0,0,0,0.1)`) at a different offset, creating a parallax-like depth where the branded shadow sits farther from the element and the neutral shadow sits closer. The negative spread values (-30px, -18px) ensure shadows don't extend beyond the element's footprint horizontally, keeping elevation vertical and controlled.
+
+### Decorative Depth
+- Dark brand sections (`#1c1e54`) create immersive depth through background color contrast
+- Gradient overlays with ruby-to-magenta transitions for hero decorations
+- Shadow color `rgba(0,55,112,0.08)` (`--hds-color-shadow-sm-top`) for top-edge shadows on sticky elements
+
+## 7. Do's and Don'ts
+
+### Do
+- Use sohne-var with `"ss01"` on every text element -- the stylistic set IS the brand
+- Use weight 300 for all headlines and body text -- lightness is the signature
+- Apply blue-tinted shadows (`rgba(50,50,93,0.25)`) for all elevated elements
+- Use `#061b31` (deep navy) for headings instead of `#000000` -- the warmth matters
+- Keep border-radius between 4px-8px -- conservative rounding is intentional
+- Use `"tnum"` for any tabular/financial number display
+- Layer shadows: blue-tinted far + neutral close for depth parallax
+- Use `#533afd` purple as the primary interactive/CTA color
+
+### Don't
+- Don't use weight 600-700 for sohne-var headlines -- weight 300 is the brand voice
+- Don't use large border-radius (12px+, pill shapes) on cards or buttons -- Stripe is conservative
+- Don't use neutral gray shadows -- always tint with blue (`rgba(50,50,93,...)`)
+- Don't skip `"ss01"` on any sohne-var text -- the alternate glyphs define the personality
+- Don't use pure black (`#000000`) for headings -- always `#061b31` deep navy
+- Don't use warm accent colors (orange, yellow) for interactive elements -- purple is primary
+- Don't apply positive letter-spacing at display sizes -- Stripe tracks tight
+- Don't use the magenta/ruby accents for buttons or links -- they're decorative/gradient only
+
+## 8. Responsive Behavior
+
+### Breakpoints
+| Name | Width | Key Changes |
+|------|-------|-------------|
+| Mobile | <640px | Single column, reduced heading sizes, stacked cards |
+| Tablet | 640-1024px | 2-column grids, moderate padding |
+| Desktop | 1024-1280px | Full layout, 3-column feature grids |
+| Large Desktop | >1280px | Centered content with generous margins |
+
+### Touch Targets
+- Buttons use comfortable padding (8px-16px vertical)
+- Navigation links at 14px with adequate spacing
+- Badges have 6px horizontal padding minimum for tap targets
+- Mobile nav toggle with 6px radius button
+
+### Collapsing Strategy
+- Hero: 56px display -> 32px on mobile, weight 300 maintained
+- Navigation: horizontal links + CTAs -> hamburger toggle
+- Feature cards: 3-column -> 2-column -> single column stacked
+- Dark brand sections: maintain full-width treatment, reduce internal padding
+- Financial data tables: horizontal scroll on mobile
+- Section spacing: 64px+ -> 40px on mobile
+- Typography scale compresses: 56px -> 48px -> 32px hero sizes across breakpoints
+
+### Image Behavior
+- Dashboard/product screenshots maintain blue-tinted shadow at all sizes
+- Hero gradient decorations simplify on mobile
+- Code blocks maintain `SourceCodePro` treatment, may horizontally scroll
+- Card images maintain consistent 4px-6px border-radius
+
+## 9. Agent Prompt Guide
+
+### Quick Color Reference
+- Primary CTA: Stripe Purple (`#533afd`)
+- CTA Hover: Purple Dark (`#4434d4`)
+- Background: Pure White (`#ffffff`)
+- Heading text: Deep Navy (`#061b31`)
+- Body text: Slate (`#64748d`)
+- Label text: Dark Slate (`#273951`)
+- Border: Soft Blue (`#e5edf5`)
+- Link: Stripe Purple (`#533afd`)
+- Dark section: Brand Dark (`#1c1e54`)
+- Success: Green (`#15be53`)
+- Accent decorative: Ruby (`#ea2261`), Magenta (`#f96bee`)
+
+### Example Component Prompts
+- "Create a hero section on white background. Headline at 48px sohne-var weight 300, line-height 1.15, letter-spacing -0.96px, color #061b31, font-feature-settings 'ss01'. Subtitle at 18px weight 300, line-height 1.40, color #64748d. Purple CTA button (#533afd, 4px radius, 8px 16px padding, white text) and ghost button (transparent, 1px solid #b9b9f9, #533afd text, 4px radius)."
+- "Design a card: white background, 1px solid #e5edf5 border, 6px radius. Shadow: rgba(50,50,93,0.25) 0px 30px 45px -30px, rgba(0,0,0,0.1) 0px 18px 36px -18px. Title at 22px sohne-var weight 300, letter-spacing -0.22px, color #061b31, 'ss01'. Body at 16px weight 300, #64748d."
+- "Build a success badge: rgba(21,190,83,0.2) background, #108c3d text, 4px radius, 1px 6px padding, 10px sohne-var weight 300, border 1px solid rgba(21,190,83,0.4)."
+- "Create navigation: white sticky header with backdrop-filter blur(12px). sohne-var 14px weight 400 for links, #061b31 text, 'ss01'. Purple CTA 'Start now' right-aligned (#533afd bg, white text, 4px radius). Nav container 6px radius."
+- "Design a dark brand section: #1c1e54 background, white text. Headline 32px sohne-var weight 300, letter-spacing -0.64px, 'ss01'. Body 16px weight 300, rgba(255,255,255,0.7). Cards inside use rgba(255,255,255,0.1) border with 6px radius."
+
+### Iteration Guide
+1. Always enable `font-feature-settings: "ss01"` on sohne-var text -- this is the brand's typographic DNA
+2. Weight 300 is the default; use 400 only for buttons/links/navigation
+3. Shadow formula: `rgba(50,50,93,0.25) 0px Y1 B1 -S1, rgba(0,0,0,0.1) 0px Y2 B2 -S2` where Y1/B1 are larger (far shadow) and Y2/B2 are smaller (near shadow)
+4. Heading color is `#061b31` (deep navy), body is `#64748d` (slate), labels are `#273951` (dark slate)
+5. Border-radius stays in the 4px-8px range -- never use pill shapes or large rounding
+6. Use `"tnum"` for any numbers in tables, charts, or financial displays
+7. Dark sections use `#1c1e54` -- not black, not gray, but a deep branded indigo
+8. SourceCodePro for code at 12px/500 with 2.00 line-height (very generous for readability)
--- a/DOCKER_SETUP.md
+++ b/DOCKER_SETUP.md
@@ -1,461 +1,461 @@
-# 🐳 Docker Setup Guide for QR Master
-
-Complete guide for setting up and running QR Master with Docker and PostgreSQL.
-
-## Prerequisites
-
- Docker Desktop (Windows/Mac) or Docker Engine (Linux)
- Docker Compose V2
- Git
- Node.js 18+ (for local development)
-
-## 🚀 Getting Started
-
-### Option 1: Development Mode (Recommended for Development)
-
-Run only the database services in Docker and the Next.js app on your host machine:
-
-1. **Clone the repository**
-   ```bash
-   git clone <your-repo-url>
-   cd QRMASTER
-   ```
-
-2. **Install dependencies**
-   ```bash
-   npm install
-   ```
-
-3. **Set up environment variables**
-   ```bash
-   cp env.example .env
-   ```
-   Edit `.env` and update the values, especially:
-   - `NEXTAUTH_SECRET` (generate with: `openssl rand -base64 32`)
-   - `IP_SALT` (generate with: `openssl rand -base64 32`)
-
-4. **Start database services**
-   ```bash
-   npm run docker:dev
-   ```
-   This starts PostgreSQL, Redis, and Adminer.
-
-5. **Run database migrations**
-   ```bash
-   npm run db:migrate
-   ```
-
-6. **Seed the database (optional)**
-   ```bash
-   npm run db:seed
-   ```
-
-7. **Start the development server**
-   ```bash
-   npm run dev
-   ```
-
-8. **Access the application**
-   - **App**: http://localhost:3050
-   - **Database UI (Adminer)**: http://localhost:8080
-     - System: PostgreSQL
-     - Server: db
-     - Username: postgres
-     - Password: postgres
-     - Database: qrmaster
-
-### Option 2: Full Production Mode
-
-Run everything in Docker containers:
-
-1. **Clone and configure**
-   ```bash
-   git clone <your-repo-url>
-   cd QRMASTER
-   cp env.example .env
-   ```
-
-2. **Update environment variables in `.env`**
-   Make sure to set strong secrets in production!
-
-3. **Build and start all services**
-   ```bash
-   npm run docker:prod
-   ```
-
-4. **Run migrations inside the container**
-   ```bash
-   docker-compose exec web npx prisma migrate deploy
-   ```
-
-5. **Access the application**
-   - **App**: http://localhost:3050
-
-## 📦 What Gets Installed
-
-### Services
-
-1. **PostgreSQL 16** - Main database
-   - Port: 5432
-   - Database: qrmaster
-   - User: postgres
-   - Password: postgres (change in production!)
-
-2. **Redis 7** - Caching and rate limiting
-   - Port: 6379
-   - Max memory: 256MB with LRU eviction
-   - Persistence: AOF enabled
-
-3. **Next.js App** - The QR Master application
-   - Port: 3000
-   - Built with production optimizations
-
-4. **Adminer** - Database management UI (dev only)
-   - Port: 8080
-   - Lightweight alternative to pgAdmin
-
-## 🗄️ Database Management
-
-### Prisma Commands
-
-```bash
-# Generate Prisma Client
-npm run db:generate
-
-# Create a new migration
-npm run db:migrate
-
-# Deploy migrations (production)
-npm run db:deploy
-
-# Seed the database
-npm run db:seed
-
-# Open Prisma Studio
-npm run db:studio
-```
-
-### Direct PostgreSQL Access
-
-```bash
-# Connect to PostgreSQL
-docker-compose exec db psql -U postgres -d qrmaster
-
-# Backup database
-docker-compose exec db pg_dump -U postgres qrmaster > backup_$(date +%Y%m%d).sql
-
-# Restore database
-docker-compose exec -T db psql -U postgres qrmaster < backup.sql
-```
-
-## 🔧 Docker Commands
-
-### Starting Services
-
-```bash
-# Development mode (database only)
-npm run docker:dev
-# or
-docker-compose -f docker-compose.dev.yml up -d
-
-# Production mode (full stack)
-npm run docker:prod
-# or
-docker-compose up -d --build
-
-# Production with database UI
-docker-compose --profile dev up -d
-```
-
-### Stopping Services
-
-```bash
-# Stop all services
-npm run docker:stop
-# or
-docker-compose down
-
-# Stop and remove volumes (⚠️ deletes data!)
-docker-compose down -v
-```
-
-### Viewing Logs
-
-```bash
-# All services
-docker-compose logs -f
-
-# Specific service
-docker-compose logs -f web
-docker-compose logs -f db
-docker-compose logs -f redis
-```
-
-### Rebuilding
-
-```bash
-# Rebuild the web application
-docker-compose build web
-
-# Rebuild without cache
-docker-compose build --no-cache web
-
-# Rebuild and restart
-docker-compose up -d --build web
-```
-
-## 🌍 Environment Variables
-
-### Required Variables
-
-```env
-# Database (automatically set for Docker)
-DATABASE_URL=postgresql://postgres:postgres@db:5432/qrmaster?schema=public
-
-# NextAuth
-NEXTAUTH_URL=http://localhost:3050
-NEXTAUTH_SECRET=<generate-with-openssl-rand-base64-32>
-
-# Security
-IP_SALT=<generate-with-openssl-rand-base64-32>
-```
-
-### Optional Variables
-
-```env
-# OAuth (Google)
-GOOGLE_CLIENT_ID=
-GOOGLE_CLIENT_SECRET=
-
-# Redis (automatically set for Docker)
-REDIS_URL=redis://redis:6379
-
-# Features
-ENABLE_DEMO=false
-```
-
-### Generating Secrets
-
-```bash
-# On Linux/Mac
-openssl rand -base64 32
-
-# On Windows (PowerShell)
-[Convert]::ToBase64String((1..32 | ForEach-Object { Get-Random -Maximum 256 }))
-```
-
-## 🔍 Health Checks
-
-All services include health checks:
-
-```bash
-# Check status of all services
-docker-compose ps
-
-# Check database health
-docker-compose exec db pg_isready -U postgres
-
-# Check Redis health
-docker-compose exec redis redis-cli ping
-
-# Check web app health
-curl http://localhost:3050
-```
-
-## 🐛 Troubleshooting
-
-### Database Connection Failed
-
-```bash
-# Check database is running
-docker-compose ps db
-
-# Check database logs
-docker-compose logs db
-
-# Restart database
-docker-compose restart db
-
-# Test connection
-docker-compose exec db psql -U postgres -d qrmaster -c "SELECT version();"
-```
-
-### Port Already in Use
-
-```bash
-# Windows - find process using port
-netstat -ano | findstr :3050
-
-# Linux/Mac - find process using port
-lsof -i :3050
-
-# Kill the process or change the port in docker-compose.yml
-```
-
-### Migration Errors
-
-```bash
-# Reset the database (⚠️ deletes all data!)
-docker-compose exec web npx prisma migrate reset
-
-# Or manually
-docker-compose down -v
-docker-compose up -d db redis
-npm run db:migrate
-```
-
-### Container Won't Start
-
-```bash
-# Remove all containers and volumes
-docker-compose down -v
-
-# Remove dangling images
-docker image prune
-
-# Rebuild from scratch
-docker-compose build --no-cache
-docker-compose up -d
-```
-
-### Prisma Client Not Generated
-
-```bash
-# Generate Prisma Client
-npm run db:generate
-
-# Or in Docker
-docker-compose exec web npx prisma generate
-```
-
-## 🔐 Production Checklist
-
-Before deploying to production:
-
- [ ] Change PostgreSQL password
- [ ] Generate strong `NEXTAUTH_SECRET`
- [ ] Generate strong `IP_SALT`
- [ ] Set proper `NEXTAUTH_URL` (your domain)
- [ ] Configure OAuth credentials (if using)
- [ ] Set up database backups
- [ ] Configure Redis persistence
- [ ] Set up monitoring and logging
- [ ] Enable HTTPS/SSL
- [ ] Review and adjust rate limits
- [ ] Set up a reverse proxy (nginx/Traefik)
- [ ] Configure firewall rules
- [ ] Set up automated database backups
-
-## 📊 Monitoring
-
-### Resource Usage
-
-```bash
-# View resource usage
-docker stats
-
-# View specific container
-docker stats qrmaster-web qrmaster-db qrmaster-redis
-```
-
-### Database Size
-
-```bash
-# Check database size
-docker-compose exec db psql -U postgres -d qrmaster -c "
-SELECT 
-    pg_size_pretty(pg_database_size('qrmaster')) as db_size,
-    pg_size_pretty(pg_total_relation_size('\"QRCode\"')) as qrcode_table_size;
-"
-```
-
-### Redis Info
-
-```bash
-# Get Redis info
-docker-compose exec redis redis-cli info
-
-# Get memory usage
-docker-compose exec redis redis-cli info memory
-```
-
-## 🔄 Backup and Recovery
-
-### Automated Backups
-
-Create a backup script `backup.sh`:
-
-```bash
-#!/bin/bash
-BACKUP_DIR="./backups"
-TIMESTAMP=$(date +%Y%m%d_%H%M%S)
-
-mkdir -p $BACKUP_DIR
-
-# Backup database
-docker-compose exec -T db pg_dump -U postgres qrmaster > "$BACKUP_DIR/qrmaster_$TIMESTAMP.sql"
-
-# Backup Redis
-docker-compose exec redis redis-cli BGSAVE
-
-echo "Backup completed: $BACKUP_DIR/qrmaster_$TIMESTAMP.sql"
-```
-
-### Restore from Backup
-
-```bash
-# Stop the web service
-docker-compose stop web
-
-# Restore database
-cat backup_20241013.sql | docker-compose exec -T db psql -U postgres qrmaster
-
-# Restart
-docker-compose start web
-```
-
-## 🚀 Performance Tips
-
-1. **Increase PostgreSQL shared buffers** (in production):
-   Edit `docker-compose.yml`:
-   ```yaml
-   db:
-     command: postgres -c shared_buffers=256MB -c max_connections=100
-   ```
-
-2. **Enable Redis persistence**:
-   Already configured with AOF in docker-compose.yml
-
-3. **Use connection pooling**:
-   Prisma already includes connection pooling
-
-4. **Monitor slow queries**:
-   ```bash
-   docker-compose exec db psql -U postgres -d qrmaster -c "
-   SELECT query, mean_exec_time, calls 
-   FROM pg_stat_statements 
-   ORDER BY mean_exec_time DESC 
-   LIMIT 10;"
-   ```
-
-## 📚 Additional Resources
-
- [Docker Documentation](https://docs.docker.com/)
- [PostgreSQL Documentation](https://www.postgresql.org/docs/)
- [Redis Documentation](https://redis.io/documentation)
- [Prisma Documentation](https://www.prisma.io/docs/)
- [Next.js Documentation](https://nextjs.org/docs)
-
-## 🆘 Getting Help
-
-If you encounter issues:
-
-1. Check the logs: `docker-compose logs -f`
-2. Check service health: `docker-compose ps`
-3. Review this guide
-4. Check the `docker/README.md` for more details
-
---
-
-**Happy coding! 🎉**
-
+# 🐳 Docker Setup Guide for QR Master
+
+Complete guide for setting up and running QR Master with Docker and PostgreSQL.
+
+## Prerequisites
+
+- Docker Desktop (Windows/Mac) or Docker Engine (Linux)
+- Docker Compose V2
+- Git
+- Node.js 18+ (for local development)
+
+## 🚀 Getting Started
+
+### Option 1: Development Mode (Recommended for Development)
+
+Run only the database services in Docker and the Next.js app on your host machine:
+
+1. **Clone the repository**
+   ```bash
+   git clone <your-repo-url>
+   cd QRMASTER
+   ```
+
+2. **Install dependencies**
+   ```bash
+   npm install
+   ```
+
+3. **Set up environment variables**
+   ```bash
+   cp env.example .env
+   ```
+   Edit `.env` and update the values, especially:
+   - `NEXTAUTH_SECRET` (generate with: `openssl rand -base64 32`)
+   - `IP_SALT` (generate with: `openssl rand -base64 32`)
+
+4. **Start database services**
+   ```bash
+   npm run docker:dev
+   ```
+   This starts PostgreSQL, Redis, and Adminer.
+
+5. **Run database migrations**
+   ```bash
+   npm run db:migrate
+   ```
+
+6. **Seed the database (optional)**
+   ```bash
+   npm run db:seed
+   ```
+
+7. **Start the development server**
+   ```bash
+   npm run dev
+   ```
+
+8. **Access the application**
+   - **App**: http://localhost:3050
+   - **Database UI (Adminer)**: http://localhost:8080
+     - System: PostgreSQL
+     - Server: db
+     - Username: postgres
+     - Password: postgres
+     - Database: qrmaster
+
+### Option 2: Full Production Mode
+
+Run everything in Docker containers:
+
+1. **Clone and configure**
+   ```bash
+   git clone <your-repo-url>
+   cd QRMASTER
+   cp env.example .env
+   ```
+
+2. **Update environment variables in `.env`**
+   Make sure to set strong secrets in production!
+
+3. **Build and start all services**
+   ```bash
+   npm run docker:prod
+   ```
+
+4. **Run migrations inside the container**
+   ```bash
+   docker-compose exec web npx prisma migrate deploy
+   ```
+
+5. **Access the application**
+   - **App**: http://localhost:3050
+
+## 📦 What Gets Installed
+
+### Services
+
+1. **PostgreSQL 16** - Main database
+   - Port: 5432
+   - Database: qrmaster
+   - User: postgres
+   - Password: postgres (change in production!)
+
+2. **Redis 7** - Caching and rate limiting
+   - Port: 6379
+   - Max memory: 256MB with LRU eviction
+   - Persistence: AOF enabled
+
+3. **Next.js App** - The QR Master application
+   - Port: 3000
+   - Built with production optimizations
+
+4. **Adminer** - Database management UI (dev only)
+   - Port: 8080
+   - Lightweight alternative to pgAdmin
+
+## 🗄️ Database Management
+
+### Prisma Commands
+
+```bash
+# Generate Prisma Client
+npm run db:generate
+
+# Create a new migration
+npm run db:migrate
+
+# Deploy migrations (production)
+npm run db:deploy
+
+# Seed the database
+npm run db:seed
+
+# Open Prisma Studio
+npm run db:studio
+```
+
+### Direct PostgreSQL Access
+
+```bash
+# Connect to PostgreSQL
+docker-compose exec db psql -U postgres -d qrmaster
+
+# Backup database
+docker-compose exec db pg_dump -U postgres qrmaster > backup_$(date +%Y%m%d).sql
+
+# Restore database
+docker-compose exec -T db psql -U postgres qrmaster < backup.sql
+```
+
+## 🔧 Docker Commands
+
+### Starting Services
+
+```bash
+# Development mode (database only)
+npm run docker:dev
+# or
+docker-compose -f docker-compose.dev.yml up -d
+
+# Production mode (full stack)
+npm run docker:prod
+# or
+docker-compose up -d --build
+
+# Production with database UI
+docker-compose --profile dev up -d
+```
+
+### Stopping Services
+
+```bash
+# Stop all services
+npm run docker:stop
+# or
+docker-compose down
+
+# Stop and remove volumes (⚠️ deletes data!)
+docker-compose down -v
+```
+
+### Viewing Logs
+
+```bash
+# All services
+docker-compose logs -f
+
+# Specific service
+docker-compose logs -f web
+docker-compose logs -f db
+docker-compose logs -f redis
+```
+
+### Rebuilding
+
+```bash
+# Rebuild the web application
+docker-compose build web
+
+# Rebuild without cache
+docker-compose build --no-cache web
+
+# Rebuild and restart
+docker-compose up -d --build web
+```
+
+## 🌍 Environment Variables
+
+### Required Variables
+
+```env
+# Database (automatically set for Docker)
+DATABASE_URL=postgresql://postgres:postgres@db:5432/qrmaster?schema=public
+
+# NextAuth
+NEXTAUTH_URL=http://localhost:3050
+NEXTAUTH_SECRET=<generate-with-openssl-rand-base64-32>
+
+# Security
+IP_SALT=<generate-with-openssl-rand-base64-32>
+```
+
+### Optional Variables
+
+```env
+# OAuth (Google)
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+
+# Redis (automatically set for Docker)
+REDIS_URL=redis://redis:6379
+
+# Features
+ENABLE_DEMO=false
+```
+
+### Generating Secrets
+
+```bash
+# On Linux/Mac
+openssl rand -base64 32
+
+# On Windows (PowerShell)
+[Convert]::ToBase64String((1..32 | ForEach-Object { Get-Random -Maximum 256 }))
+```
+
+## 🔍 Health Checks
+
+All services include health checks:
+
+```bash
+# Check status of all services
+docker-compose ps
+
+# Check database health
+docker-compose exec db pg_isready -U postgres
+
+# Check Redis health
+docker-compose exec redis redis-cli ping
+
+# Check web app health
+curl http://localhost:3050
+```
+
+## 🐛 Troubleshooting
+
+### Database Connection Failed
+
+```bash
+# Check database is running
+docker-compose ps db
+
+# Check database logs
+docker-compose logs db
+
+# Restart database
+docker-compose restart db
+
+# Test connection
+docker-compose exec db psql -U postgres -d qrmaster -c "SELECT version();"
+```
+
+### Port Already in Use
+
+```bash
+# Windows - find process using port
+netstat -ano | findstr :3050
+
+# Linux/Mac - find process using port
+lsof -i :3050
+
+# Kill the process or change the port in docker-compose.yml
+```
+
+### Migration Errors
+
+```bash
+# Reset the database (⚠️ deletes all data!)
+docker-compose exec web npx prisma migrate reset
+
+# Or manually
+docker-compose down -v
+docker-compose up -d db redis
+npm run db:migrate
+```
+
+### Container Won't Start
+
+```bash
+# Remove all containers and volumes
+docker-compose down -v
+
+# Remove dangling images
+docker image prune
+
+# Rebuild from scratch
+docker-compose build --no-cache
+docker-compose up -d
+```
+
+### Prisma Client Not Generated
+
+```bash
+# Generate Prisma Client
+npm run db:generate
+
+# Or in Docker
+docker-compose exec web npx prisma generate
+```
+
+## 🔐 Production Checklist
+
+Before deploying to production:
+
+- [ ] Change PostgreSQL password
+- [ ] Generate strong `NEXTAUTH_SECRET`
+- [ ] Generate strong `IP_SALT`
+- [ ] Set proper `NEXTAUTH_URL` (your domain)
+- [ ] Configure OAuth credentials (if using)
+- [ ] Set up database backups
+- [ ] Configure Redis persistence
+- [ ] Set up monitoring and logging
+- [ ] Enable HTTPS/SSL
+- [ ] Review and adjust rate limits
+- [ ] Set up a reverse proxy (nginx/Traefik)
+- [ ] Configure firewall rules
+- [ ] Set up automated database backups
+
+## 📊 Monitoring
+
+### Resource Usage
+
+```bash
+# View resource usage
+docker stats
+
+# View specific container
+docker stats qrmaster-web qrmaster-db qrmaster-redis
+```
+
+### Database Size
+
+```bash
+# Check database size
+docker-compose exec db psql -U postgres -d qrmaster -c "
+SELECT 
+    pg_size_pretty(pg_database_size('qrmaster')) as db_size,
+    pg_size_pretty(pg_total_relation_size('\"QRCode\"')) as qrcode_table_size;
+"
+```
+
+### Redis Info
+
+```bash
+# Get Redis info
+docker-compose exec redis redis-cli info
+
+# Get memory usage
+docker-compose exec redis redis-cli info memory
+```
+
+## 🔄 Backup and Recovery
+
+### Automated Backups
+
+Create a backup script `backup.sh`:
+
+```bash
+#!/bin/bash
+BACKUP_DIR="./backups"
+TIMESTAMP=$(date +%Y%m%d_%H%M%S)
+
+mkdir -p $BACKUP_DIR
+
+# Backup database
+docker-compose exec -T db pg_dump -U postgres qrmaster > "$BACKUP_DIR/qrmaster_$TIMESTAMP.sql"
+
+# Backup Redis
+docker-compose exec redis redis-cli BGSAVE
+
+echo "Backup completed: $BACKUP_DIR/qrmaster_$TIMESTAMP.sql"
+```
+
+### Restore from Backup
+
+```bash
+# Stop the web service
+docker-compose stop web
+
+# Restore database
+cat backup_20241013.sql | docker-compose exec -T db psql -U postgres qrmaster
+
+# Restart
+docker-compose start web
+```
+
+## 🚀 Performance Tips
+
+1. **Increase PostgreSQL shared buffers** (in production):
+   Edit `docker-compose.yml`:
+   ```yaml
+   db:
+     command: postgres -c shared_buffers=256MB -c max_connections=100
+   ```
+
+2. **Enable Redis persistence**:
+   Already configured with AOF in docker-compose.yml
+
+3. **Use connection pooling**:
+   Prisma already includes connection pooling
+
+4. **Monitor slow queries**:
+   ```bash
+   docker-compose exec db psql -U postgres -d qrmaster -c "
+   SELECT query, mean_exec_time, calls 
+   FROM pg_stat_statements 
+   ORDER BY mean_exec_time DESC 
+   LIMIT 10;"
+   ```
+
+## 📚 Additional Resources
+
+- [Docker Documentation](https://docs.docker.com/)
+- [PostgreSQL Documentation](https://www.postgresql.org/docs/)
+- [Redis Documentation](https://redis.io/documentation)
+- [Prisma Documentation](https://www.prisma.io/docs/)
+- [Next.js Documentation](https://nextjs.org/docs)
+
+## 🆘 Getting Help
+
+If you encounter issues:
+
+1. Check the logs: `docker-compose logs -f`
+2. Check service health: `docker-compose ps`
+3. Review this guide
+4. Check the `docker/README.md` for more details
+
+---
+
+**Happy coding! 🎉**
+
--- a/156
+++ b/156
@@ -1,64 +1,92 @@
-# ---- deps ----
-FROM node:20-alpine AS deps
-# Install OpenSSL for Prisma
-RUN apk add --no-cache openssl
-WORKDIR /app
-COPY package.json package-lock.json* pnpm-lock.yaml* yarn.lock* .npmrc* ./
-# Copy prisma schema for postinstall script
-COPY prisma ./prisma
-RUN \
-  if [ -f pnpm-lock.yaml ]; then \
-    npm i -g pnpm && pnpm i --frozen-lockfile; \
-  elif [ -f yarn.lock ]; then \
-    yarn --frozen-lockfile; \
-  elif [ -f package-lock.json ]; then \
-    npm ci; \
-  else \
-    npm install --legacy-peer-deps; \
-  fi
-
-# ---- builder ----
-FROM node:20-alpine AS builder
-# Install OpenSSL for Prisma
-RUN apk add --no-cache openssl
-WORKDIR /app
-COPY --from=deps /app/node_modules ./node_modules
-COPY . .
-ENV NEXT_TELEMETRY_DISABLED=1
-# Add build-time environment variables with defaults
-ENV DATABASE_URL="postgresql://postgres:postgres@db:5432/qrmaster?schema=public"
-ENV NEXTAUTH_URL="https://www.qrmaster.net"
-ENV NEXTAUTH_SECRET="build-time-secret"
-ENV IP_SALT="build-time-salt"
-ENV STRIPE_SECRET_KEY="sk_test_placeholder_for_build"
-ENV RESEND_API_KEY="re_placeholder_for_build"
-ENV NEXT_PUBLIC_APP_URL="https://www.qrmaster.net"
-# PostHog Analytics - REQUIRED at build time for client-side bundle
-ENV NEXT_PUBLIC_POSTHOG_KEY="phc_97JBJVVQlqqiZuTVRHuBnnG9HasOv3GSsdeVjossizJ"
-ENV NEXT_PUBLIC_POSTHOG_HOST="https://us.i.posthog.com"
-ENV NEXT_PUBLIC_INDEXABLE="true"
-RUN npx prisma generate
-RUN npm run build
-
-# ---- runner ----
-FROM node:20-alpine AS runner
-# Install OpenSSL for Prisma runtime
-RUN apk add --no-cache openssl
-WORKDIR /app
-ENV NODE_ENV=production
-ENV NEXT_TELEMETRY_DISABLED=1
-
-RUN addgroup --system --gid 1001 nodejs
-RUN adduser --system --uid 1001 nextjs
-
-COPY --from=builder /app/node_modules ./node_modules
-COPY --from=builder /app/prisma ./prisma
-COPY --from=builder /app/.next/standalone ./
-COPY --from=builder /app/.next/static ./.next/static
-COPY --from=builder /app/public ./public
-
-USER nextjs
-
-EXPOSE 3000
-
-CMD ["node", "server.js"]
+# ---- deps ----
+FROM node:20-alpine AS deps
+# Install OpenSSL for Prisma
+RUN apk add --no-cache openssl
+WORKDIR /app
+COPY package.json package-lock.json* pnpm-lock.yaml* yarn.lock* .npmrc* ./
+# Copy prisma schema for postinstall script
+COPY prisma ./prisma
+RUN \
+  if [ -f pnpm-lock.yaml ]; then \
+    npm i -g pnpm && pnpm i --frozen-lockfile; \
+  elif [ -f yarn.lock ]; then \
+    yarn --frozen-lockfile; \
+  elif [ -f package-lock.json ]; then \
+    npm ci; \
+  else \
+    npm install --legacy-peer-deps; \
+  fi
+
+# ---- builder ----
+FROM node:20-alpine AS builder
+# Install OpenSSL for Prisma
+RUN apk add --no-cache openssl
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+ENV NEXT_TELEMETRY_DISABLED=1
+# Add build-time environment variables with defaults
+ENV NEXTAUTH_URL="https://www.qrmaster.net"
+ENV NEXTAUTH_SECRET="build-time-secret"
+ENV IP_SALT="build-time-salt"
+ENV STRIPE_SECRET_KEY="sk_test_placeholder_for_build"
+ENV RESEND_API_KEY="re_placeholder_for_build"
+# Marketing host vs app host. NEXT_PUBLIC_WWW_URL must stay on www in production: it is the
+# origin encoded into downloaded QR codes and used for public email links.
+# Declared as ARG so the staging overlay can build the same image pointing at
+# testmodul.qrmaster.net - the defaults keep a plain production build unchanged.
+ARG NEXT_PUBLIC_WWW_URL="https://www.qrmaster.net"
+ENV NEXT_PUBLIC_WWW_URL=$NEXT_PUBLIC_WWW_URL
+ARG NEXT_PUBLIC_APP_URL="https://app.qrmaster.net"
+ENV NEXT_PUBLIC_APP_URL=$NEXT_PUBLIC_APP_URL
+# PostHog Analytics - REQUIRED at build time for client-side bundle
+ENV NEXT_PUBLIC_POSTHOG_KEY="phc_97JBJVVQlqqiZuTVRHuBnnG9HasOv3GSsdeVjossizJ"
+ENV NEXT_PUBLIC_POSTHOG_HOST="https://us.i.posthog.com"
+ENV NEXT_PUBLIC_INDEXABLE="true"
+ENV NEXT_PUBLIC_FACEBOOK_PIXEL_ID="1601718491252690"
+# Umami Analytics - REQUIRED at build time (NEXT_PUBLIC_* is inlined by the compiler)
+ARG NEXT_PUBLIC_UMAMI_SRC=""
+ARG NEXT_PUBLIC_UMAMI_ID=""
+ENV NEXT_PUBLIC_UMAMI_SRC=$NEXT_PUBLIC_UMAMI_SRC
+ENV NEXT_PUBLIC_UMAMI_ID=$NEXT_PUBLIC_UMAMI_ID
+# Shared session cookie across www.* and app.*. Needed at build time too: process.env is
+# inlined into the Edge middleware bundle, so a runtime-only value would leave the
+# middleware and the route handlers disagreeing about the cookie scope.
+ARG COOKIE_DOMAIN=""
+ENV COOKIE_DOMAIN=$COOKIE_DOMAIN
+# Distinct session cookie name for the staging deployment, so its cookie cannot collide
+# with the production one the browser also sends to testmodul.qrmaster.net.
+ARG AUTH_COOKIE_NAME=""
+ENV AUTH_COOKIE_NAME=$AUTH_COOKIE_NAME
+RUN npx prisma generate
+RUN npm run build
+
+# ---- runner ----
+FROM node:20-alpine AS runner
+# Install OpenSSL for Prisma runtime
+RUN apk add --no-cache openssl
+WORKDIR /app
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+
+RUN addgroup --system --gid 1001 nodejs
+RUN adduser --system --uid 1001 nextjs
+
+COPY --from=builder --chown=nextjs:nodejs /app/node_modules ./node_modules
+COPY --from=builder --chown=nextjs:nodejs /app/prisma ./prisma
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+COPY --from=builder --chown=nextjs:nodejs /app/public ./public
+COPY --from=builder --chown=nextjs:nodejs /app/docker/entrypoint.sh ./docker/entrypoint.sh
+
+RUN chmod +x ./docker/entrypoint.sh
+
+# Next writes ISR/prerender artifacts under .next/server/app at runtime.
+RUN mkdir -p /app/.next/cache /app/.next/server/app \
+  && chown -R nextjs:nodejs /app/.next
+
+USER nextjs
+
+EXPOSE 3000
+
+CMD ["./docker/entrypoint.sh"]
--- a/FINAL_DELIVERY_PACKAGE_TIMO.md
+++ b/FINAL_DELIVERY_PACKAGE_TIMO.md
@@ -0,0 +1,157 @@
+# FINAL DELIVERY PACKAGE — QR Master Outreach
+
+> [!IMPORTANT]
+> **Recipient:** knuth.timo@gmail.com
+> **Sender:** Antigravity AI
+> **Date:** 2026-04-13
+>
+> This document contains all the outreach emails, guest post pitches, and corresponding articles prepared for the QR Master SEO and content marketing campaign.
+>
+> **Note:** I cannot send emails directly from this interface. Please copy the content below into your email client to send to the respective targets.
+
+---
+
+## Table of Contents
+1. [Guest Post Pitches & Articles](#1-guest-post-pitches--articles)
+   - [DigitalGpoint](#digitalgpoint)
+   - [Techdee](#techdee)
+   - [SEO Sandwitch](#seo-sandwitch)
+2. [Web 2.0 & Self-Publishing Articles](#2-web-20--self-publishing-articles)
+   - [Medium](#medium)
+   - [LinkedIn Pulse](#linkedin-pulse)
+   - [Substack Series](#substack-series)
+3. [Resource Outreach Emails (10 Targets)](#3-resource-outreach-emails-10-targets)
+
+---
+
+## 1. Guest Post Pitches & Articles
+
+### DigitalGpoint
+**Recipent:** digitalgpoint.webmail@gmail.com  
+**Article Type:** Guest Post
+
+#### Submission Email
+**Subject:** Solving the "print gap" for small businesses
+
+Hi [Name],
+
+I’ve noticed DigitalGpoint covers a lot of practical tools for business growth. One area that often gets overlooked is the bridge between physical marketing (flyers, menus, signage) and digital analytics.
+
+I’ve put together a practical guide on "Managing the Move from Static to Dynamic Print." It explains how small business owners are using dynamic redirect layers to make their physical materials editable after printing—saving them from costly reprints when a URL or price changes.
+
+It’s a straightforward, workflow-focused piece that I believe your readers would find highly actionable.
+
+Would you be open to reviewing a draft for a guest contribution?
+
+Best,
+
+Timo
+(Writer & Strategist)
+
+#### Accompanying Article: "Every Print Order Feels Final (Until You Use a Dynamic Layer)"
+[View full article content in digitalGpoint-dynamic-vs-static-qr-codes.md](file:///c:/Users/a931627/Documents/QRMASTER/articles/digitalGpoint-dynamic-vs-static-qr-codes.md)
+
+---
+
+### Techdee
+**Recipient:** Blayget@gmail.com  
+**Article Type:** Guest Post (Tier 2)
+
+#### Submission Email
+**Subject:** Offline-to-Online marketing workflows
+
+Hi [Name],
+
+I’ve been following Techdee’s tech and marketing tutorials for some time. 
+
+I’m currently finalizing a piece titled: **"Beyond the Scan: 5 Professional QR Strategies for Modern Marketing."**
+
+The article moves past the basic "link a code to a site" approach and explores practical technical workflows: using dynamic redirects to avoid reprints, pulling scan data into GA4 for attribution, and managing bulk physical assets.
+
+It’s a 700-word, list-style tutorial that fits your current format. Is this something you'd like to see for a guest contribution?
+
+Best,
+
+Timo
+(Writer & Strategist)
+
+#### Accompanying Article: "Beyond the Scan: 5 Professional QR Strategies for Modern Marketing"
+[View full article content in techdee-5-qr-code-strategies.md](file:///c:/Users/a931627/Documents/QRMASTER/articles/techdee-5-qr-code-strategies.md)
+
+---
+
+### SEO Sandwitch
+**Recipient:** joydeep@seosandwitch.com  
+**Article Type:** Guest Post (Tier 1 - High Value)
+
+#### Submission Email
+**Subject:** Attribution blind spots in physical marketing
+
+Hi Joydeep,
+
+I’ve been following SEO Sandwitch for a while—your recent piece on AI SEO and GEO was excellent.
+
+I’m reaching out because I’ve been working on a technical deep-dive that explores a massive attribution blind spot: physical marketing campaigns.
+
+The piece, **"QR Codes as an Offline-to-Online Signal,"** breaks down how marketers can pull scan data from flyers, packaging, and OOH materials into GA4 to finally close the loop on offline attribution. 
+
+It covers:
+- Using dynamic redirect layers as an attribution signal.
+- The indirect impact of physical touchpoints on branded search volume.
+- Technical setup for UTM-tagged dynamic codes.
+
+It’s not a superficial "marketing tips" post; it’s a strategist-level look at attribution data.
+
+I have a ~2,000 word draft ready. Would you be open to taking a look for a potential guest contribution?
+
+Best,
+
+Timo
+(Writer & Strategist)
+
+#### Accompanying Article: "QR Codes as an Offline-to-Online Signal"
+[View full article content in seosandwitch-qr-codes-offline-attribution.md](file:///c:/Users/a931627/Documents/QRMASTER/articles/seosandwitch-qr-codes-offline-attribution.md)
+
+---
+
+## 2. Web 2.0 & Self-Publishing Articles
+
+### Medium
+**Target Platform:** Medium.com  
+**Publication:** Self-publish or submit to a marketing pub (e.g., Better Marketing)
+
+#### Article: "Beyond the Menu: 5 Practical Ways to Use QR Codes for Business Growth"
+[View full article content in medium-5-underrated-qr-use-cases.md](file:///c:/Users/a931627/Documents/QRMASTER/articles/medium-5-underrated-qr-use-cases.md)
+
+---
+
+### LinkedIn Pulse
+**Target Platform:** LinkedIn Personal Account  
+
+#### Article: "Why Your Business Card Still Needs a QR Code in 2025"
+[View full article content in linkedin-business-card-qr.md](file:///c:/Users/a931627/Documents/QRMASTER/articles/linkedin-business-card-qr.md)
+
+---
+
+### Substack Series
+**Target Platform:** Substack Newsletter ("The QR Code Playbook")
+
+#### Content: 3-Issue Intro Series
+[View full issues content in substack-playbook-series.md](file:///c:/Users/a931627/Documents/QRMASTER/articles/substack-playbook-series.md)
+
+---
+
+## 3. Resource Outreach Emails (10 Targets)
+
+These are short link-request emails targeting sites that list QR tools or marketing resources.
+
+**Targets & Templates:**
+[View all 10 target details and templates in outreach-seo-emails.md](file:///c:/Users/a931627/Documents/QRMASTER/outreach-seo-emails.md)
+
+---
+
+> [!TIP]
+> **Next Steps:**
+> 1. Start with **Web 2.0 publishing** (Medium, LinkedIn, Substack) to build topical authority.
+> 2. Send the **Guest Post Pitches** (DigitalGpoint, Techdee, SEO Sandwitch) once the Web 2.0 posts are live so editors can see your writing quality.
+> 3. Send the **Resource Outreach** emails in a batch of 5-10 per week.
--- a/40
+++ b/40
@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2025 QR Master
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+MIT License
+
+Copyright (c) 2026 QR Master
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
--- a/MIGRATION_FROM_SUPABASE.md
+++ b/MIGRATION_FROM_SUPABASE.md
@@ -1,321 +0,0 @@
-# Migration Guide: From Supabase to Local PostgreSQL
-
-This guide helps you migrate your QR Master application from Supabase to a local PostgreSQL database with Docker.
-
-## What Changed
-
-### ✅ Removed
- Supabase connection pooling (`DIRECT_URL` environment variable)
- Supabase-specific configurations
- External database dependency
-
-### ✨ Added
- Local PostgreSQL 16 database in Docker
- Redis cache for better performance
- Adminer database management UI
- Complete Docker setup with docker-compose
- Database initialization scripts
- Development and production Docker configurations
-
-## Migration Steps
-
-### 1. Backup Your Supabase Database (IMPORTANT!)
-
-Before making any changes, backup your existing data:
-
-```bash
-# If you have access to Supabase CLI
-supabase db dump > backup_$(date +%Y%m%d).sql
-
-# Or use pg_dump directly with your Supabase credentials
-pg_dump "postgresql://postgres:[PASSWORD]@[PROJECT_REF].supabase.co:5432/postgres" > backup.sql
-```
-
-### 2. Update Your Codebase
-
-Pull the latest changes or update these files:
-
-#### Updated Files:
- ✏️ `prisma/schema.prisma` - Removed `directUrl` field
- ✏️ `src/lib/env.ts` - Removed `DIRECT_URL` variable
- ✏️ `docker-compose.yml` - Updated with PostgreSQL setup
- ✏️ `Dockerfile` - Enhanced with PostgreSQL support
- ✏️ `package.json` - Added Docker scripts and tsx
-
-#### New Files:
- 📄 `docker-compose.dev.yml` - Development setup
- 📄 `docker/init-db.sh` - Database initialization
- 📄 `docker/README.md` - Docker documentation
- 📄 `DOCKER_SETUP.md` - Complete Docker guide
- 📄 `env.example` - Environment template
- 📄 `.dockerignore` - Docker build optimization
-
-### 3. Set Up Environment Variables
-
-1. Remove Supabase-specific variables:
-```bash
-# Remove these from .env:
-# DIRECT_URL=...
-# SUPABASE_URL=...
-# SUPABASE_ANON_KEY=...
-```
-
-2. Update database connection:
-```bash
-# For Docker (default):
-DATABASE_URL=postgresql://postgres:postgres@db:5432/qrmaster?schema=public
-
-# For local development (without Docker):
-DATABASE_URL=postgresql://postgres:postgres@localhost:5432/qrmaster?schema=public
-```
-
-3. Copy from template:
-```bash
-cp env.example .env
-```
-
-4. Generate secure secrets:
-```bash
-# Linux/Mac
-openssl rand -base64 32  # Use for NEXTAUTH_SECRET
-openssl rand -base64 32  # Use for IP_SALT
-
-# Windows PowerShell
-[Convert]::ToBase64String((1..32 | ForEach-Object { Get-Random -Maximum 256 }))
-```
-
-### 4. Start Local PostgreSQL
-
-#### Option A: Development Mode (Recommended)
-
-```bash
-# Start database only (run app on host)
-npm run docker:dev
-
-# Wait for database to be ready
-docker-compose -f docker-compose.dev.yml logs -f db
-```
-
-#### Option B: Full Docker
-
-```bash
-# Start all services
-npm run docker:prod
-
-# Wait for all services to be ready
-docker-compose logs -f
-```
-
-### 5. Restore Your Data
-
-#### Option 1: Using Prisma Migrations (Clean Start)
-
-```bash
-# Generate Prisma client
-npm run db:generate
-
-# Run migrations
-npm run db:migrate
-
-# Seed with demo data
-npm run db:seed
-```
-
-#### Option 2: Restore from Backup (Preserve Data)
-
-```bash
-# Restore your Supabase backup
-cat backup.sql | docker-compose exec -T db psql -U postgres qrmaster
-
-# Or if running locally
-psql -U postgres -d qrmaster < backup.sql
-
-# Then run migrations to update schema
-npm run db:deploy
-```
-
-### 6. Verify Migration
-
-1. **Check Database Connection:**
-```bash
-# Connect to database
-npm run docker:db
-
-# Or manually
-docker-compose exec db psql -U postgres -d qrmaster
-
-# Run test query
-SELECT COUNT(*) FROM "User";
-SELECT COUNT(*) FROM "QRCode";
-```
-
-2. **Access Adminer (Database UI):**
-   - URL: http://localhost:8080
-   - System: PostgreSQL
-   - Server: db
-   - Username: postgres
-   - Password: postgres
-   - Database: qrmaster
-
-3. **Test Your Application:**
-```bash
-# Start the app (if using dev mode)
-npm run dev
-
-# Access: http://localhost:3050
-```
-
-### 7. Update Your Deployment
-
-#### For Docker Production:
-
-```bash
-# Build and deploy
-docker-compose up -d --build
-
-# Run migrations
-docker-compose exec web npx prisma migrate deploy
-
-# Check logs
-docker-compose logs -f web
-```
-
-#### For Other Platforms (Vercel, Railway, etc.):
-
-Update your environment variables in the platform's dashboard:
- Remove: `DIRECT_URL`
- Update: `DATABASE_URL` to your new PostgreSQL connection string
-
-## Troubleshooting
-
-### Issue: Connection Refused
-
-```bash
-# Check if database is running
-docker-compose ps
-
-# Check database logs
-docker-compose logs db
-
-# Restart database
-docker-compose restart db
-```
-
-### Issue: Migration Errors
-
-```bash
-# Reset migrations (⚠️ deletes data!)
-npm run db:migrate reset
-
-# Or manually reset
-docker-compose down -v
-docker-compose up -d db
-npm run db:migrate
-```
-
-### Issue: Prisma Client Not Generated
-
-```bash
-# Regenerate Prisma client
-npm run db:generate
-
-# Or
-npx prisma generate
-```
-
-### Issue: Data Not Migrated
-
-```bash
-# Check if backup was restored correctly
-docker-compose exec db psql -U postgres -d qrmaster -c "
-SELECT 
-  schemaname,
-  tablename,
-  pg_size_pretty(pg_total_relation_size(schemaname||'.'||tablename)) AS size
-FROM pg_tables
-WHERE schemaname = 'public'
-ORDER BY pg_total_relation_size(schemaname||'.'||tablename) DESC;
-"
-```
-
-## Differences: Supabase vs Local PostgreSQL
-
-| Feature | Supabase | Local PostgreSQL |
-|---------|----------|------------------|
-| Hosting | Cloud (managed) | Self-hosted (Docker) |
-| Connection Pooling | Built-in (Supavisor) | Prisma built-in |
-| Database UI | Supabase Studio | Adminer (included) |
-| Backups | Automatic | Manual (or scripted) |
-| Cost | Free tier + paid | Free (infrastructure cost only) |
-| Latency | Internet dependent | Local network |
-| Setup | Account required | Docker only |
-| Scaling | Automatic | Manual |
-
-## Benefits of Local PostgreSQL
-
-✅ **Full Control**: Own your data and infrastructure  
-✅ **No Vendor Lock-in**: Standard PostgreSQL  
-✅ **Lower Latency**: Local network speed  
-✅ **Cost**: No monthly fees  
-✅ **Privacy**: Data stays on your infrastructure  
-✅ **Development**: Easy local testing  
-✅ **Offline**: Works without internet  
-
-## Next Steps
-
-1. ✅ Verify all data migrated correctly
-2. ✅ Test all application features
-3. ✅ Update your CI/CD pipelines
-4. ✅ Set up automated backups:
-```bash
-# Create backup script
-cat > backup.sh << 'EOF'
-#!/bin/bash
-BACKUP_DIR="./backups"
-mkdir -p $BACKUP_DIR
-docker-compose exec -T db pg_dump -U postgres qrmaster > "$BACKUP_DIR/backup_$(date +%Y%m%d_%H%M%S).sql"
-EOF
-
-chmod +x backup.sh
-
-# Run daily backups (cron example)
-# 0 2 * * * /path/to/backup.sh
-```
-
-5. ✅ Monitor your application
-6. ✅ Update documentation
-
-## Rollback Plan
-
-If you need to rollback to Supabase:
-
-1. Keep your Supabase project active during testing
-2. Keep your backup files safe
-3. To rollback, simply change `DATABASE_URL` back to Supabase
-4. Add back `DIRECT_URL` to `prisma/schema.prisma`:
-```prisma
-datasource db {
-  provider  = "postgresql"
-  url       = env("DATABASE_URL")
-  directUrl = env("DIRECT_URL")
-}
-```
-
-## Support
-
-For issues:
-1. Check [DOCKER_SETUP.md](DOCKER_SETUP.md) for detailed Docker help
-2. Check [docker/README.md](docker/README.md) for Docker commands
-3. Review logs: `docker-compose logs -f`
-4. Open an issue on GitHub
-
---
-
-🎉 **Congratulations!** You've successfully migrated from Supabase to local PostgreSQL!
-
-
-
-
-
-
-
--- a/PLAN_APP_SUBDOMAIN_2026-08-12.md
+++ b/PLAN_APP_SUBDOMAIN_2026-08-12.md
@@ -0,0 +1,259 @@
+# Plan: Dashboard auf app.qrmaster.net
+
+Stand: 2026-08-12 · Ziel: die eingeloggte App liegt auf `app.qrmaster.net`, Marketing/SEO bleibt auf `www.qrmaster.net`.
+
+## Status
+
+| Schritt | Stand |
+|---|---|
+| B1 Cookie-Domain | committed + gepusht (`35ea8cc`) |
+| B2–B7 | Code fertig, typecheck + Production-Build grün, **noch nicht deployt** |
+| A4 Google Console | erledigt (beide Redirect-URIs eingetragen) |
+| A1 DNS, A2 Caddy, A3 .env, A6 Deploy | offen bei Timo |
+
+Deploy-Reihenfolge unverändert: B1 zuerst allein live und einen Tag beobachten, dann B2–B7.
+
+Neu gegenüber dem ursprünglichen Plan: `src/lib/hosts.ts` ist die einzige Quelle der Wahrheit
+für die Host-Grenze (`APP_PATH_PREFIXES`, `isAppPath`, `wwwUrl`, `appUrl`, `urlForPath`).
+Middleware, Stripe-Rückkehr-URLs und E-Mail-Links lesen alle daraus, damit sie nicht
+auseinanderdriften.
+
+## Zielarchitektur
+
+**Ein Docker-Image, ein Container, zwei Hostnames.** Caddy routet `www.qrmaster.net` und
+`app.qrmaster.net` auf denselben Upstream. Die Middleware macht Host-basiertes Routing.
+
+**Wichtig: keine Datei zieht um.** Die Next-App serviert auf beiden Hosts weiterhin alle Routen.
+`src/middleware.ts` entscheidet pro Host, welcher Pfad ausgeliefert wird, und 301t den Rest auf den
+jeweils anderen Host. Damit bleiben alle relativen Links (`router.push('/dashboard')`,
+`<Link href="/settings">`) unverändert korrekt, weil sie innerhalb desselben Hosts aufgelöst werden.
+
+```
+qrmaster.net        --301-->  www.qrmaster.net              (bleibt wie heute)
+www.qrmaster.net    ->  Marketing, /login, /signup, /r/*, /api/*
+app.qrmaster.net    ->  /dashboard /create /analytics /settings /bulk-creation
+                        /integrations /qr/* /upgrade /onboarding, /api/*
+```
+
+## Fixierte Entscheidungen
+
+| Frage | Entscheidung | Begründung |
+|---|---|---|
+| Hosting | Docker + Caddy auf eigenem Server | Bestand |
+| `/login`, `/signup` | **bleiben auf www** | Alle 82 Marketing-CTAs zeigen auf `/signup`, `/signup` hat ein hartes Canonical auf www und trägt Ad-Traffic. Umzug wäre teuer ohne Nutzen. |
+| `/onboarding` | zieht auf app | Reiner Logged-in-Flow, kein SEO-Wert |
+| Host-Wechsel | genau **einmal**, nach erfolgreichem Login/Signup | einzige Cross-Host-Stelle im ganzen Flow |
+| DB | keine Änderung | — |
+
+## Teil A — Deine Aufgaben (Timo)
+
+Reihenfolge beachten: A1–A2 **vor** dem Deploy von Schritt B5, sonst zeigt die Subdomain ins Leere.
+
+### A1. DNS
+CNAME `app` → auf denselben Zielhost wie `www` (bzw. A-Record auf dieselbe Server-IP).
+Kein Proxy-Only-Sonderfall nötig, Caddy holt das Cert selbst.
+
+### A2. Caddyfile auf dem Server
+`app.qrmaster.net` in den bestehenden Site-Block aufnehmen, damit Caddy automatisch ein
+Let's-Encrypt-Cert zieht:
+
+```caddyfile
+www.qrmaster.net, app.qrmaster.net {
+    reverse_proxy qrmaster-web:3000
+}
+```
+
+Danach `caddy reload`. Prüfen: `curl -sI https://app.qrmaster.net` muss 200 oder 301 liefern,
+kein TLS-Fehler.
+
+### A3. `.env` auf dem Server ergänzen
+Zwei Variablen statt einer. Die Trennung ist der Kern des ganzen Umbaus:
+
+Für **Deploy 1** reicht:
+
+```dotenv
+COOKIE_DOMAIN=.qrmaster.net
+```
+
+Für **Deploy 2** kommen dazu:
+
+```dotenv
+NEXT_PUBLIC_WWW_URL=https://www.qrmaster.net
+NEXT_PUBLIC_APP_URL=https://app.qrmaster.net
+```
+
+`NEXT_PUBLIC_APP_URL` erst zu Deploy 2 umstellen - vorher zeigt es auf www und muss dort
+bleiben. Fehlen die Werte, greifen die Produktions-Fallbacks in `src/lib/hosts.ts`; ein
+localhost-Wert kann damit nicht in gedruckte QR-Codes gelangen.
+
+`NEXTAUTH_URL` bleibt `https://www.qrmaster.net` (wird nur noch von
+`api/social-assets/route.ts` gelesen, kein Auth-Bezug mehr).
+
+### A4. Google Cloud Console
+Bei den OAuth-Credentials als **Authorized redirect URI** zusätzlich eintragen:
+
+```
+https://app.qrmaster.net/api/auth/google
+```
+
+Die alte www-URI **nicht löschen** – sie wird während der Übergangszeit noch von
+Sessions genutzt, die den Flow auf www gestartet haben.
+
+### A5. Nichts zu tun bei Stripe und TikTok
+- Stripe-Webhook zeigt auf `www.qrmaster.net/api/stripe/webhook` und bleibt gültig
+  (`/api/*` wird auf beiden Hosts weiter bedient, siehe B5).
+- TikTok `redirect_uri` bleibt auf `qrmaster.net` – verifizierte Domain, nicht anfassen.
+
+### A6. Deploy
+`npm run docker:prod` (Rebuild ist zwingend – `NEXT_PUBLIC_*` wird zur Build-Zeit ins
+Client-Bundle inlined, ein reiner Container-Restart genügt **nicht**).
+
+## Teil B — Meine Aufgaben (Code), in Diff-Reihenfolge
+
+### B1. Cookie-Domain teilen — muss zuerst live sein
+Ohne das ist auf `app.qrmaster.net` jeder ausgeloggt: das `userId`-Cookie ist heute host-only.
+
+- `src/lib/cookieConfig.ts:11` — `getAuthCookieOptions()`: `domain: process.env.COOKIE_DOMAIN` in Prod, in Dev `undefined` (localhost verträgt keine Punkt-Domain)
+- `src/lib/cookieConfig.ts:24` — `getCsrfCookieOptions()`: dito
+- `src/middleware.ts:34` — Attribution-Cookie: dito
+- `src/app/(main)/api/auth/logout/route.ts:7` — **kritisch**: löscht heute host-only. Nach der
+  Umstellung existieren bei Bestandsnutzern beide Varianten (alt host-only + neu domain-scoped).
+  Logout muss **beide** überschreiben, sonst bleibt ein Zombie-Cookie und der Nutzer ist nicht
+  wirklich ausgeloggt. Gilt für `userId`, `newsletter-admin` und das Attribution-Cookie.
+- `src/app/(main)/api/auth/google/route.ts:53,62` — OAuth-State + Post-Auth-Redirect-Cookie
+
+Kein Forced-Logout nötig: beide Cookie-Varianten tragen denselben signierten Wert, der Server
+akzeptiert jede. `verifySignedUserIdEdge` prüft die Signatur, das Teilen über eigene Subdomains
+ist unkritisch.
+
+**Dieser Schritt kann allein auf www deployt werden, bevor die Subdomain existiert** — nach außen
+unsichtbar, und wenn app.* dann live geht, funktionieren Sessions sofort.
+
+### B2. `NEXT_PUBLIC_APP_URL` entflechten
+Die Variable bedient heute App- **und** öffentliche URLs. Jede Fundstelle einzeln zuordnen:
+
+**Muss auf `WWW_URL` (öffentlich, teils in QR-Codes kodiert):**
+- `src/components/dashboard/QRCodeCard.tsx:82` — **höchstes Risiko im ganzen Umbau**: Basis für
+  die in den QR-Code kodierte `/r/<slug>`-URL. Bleibt das auf `APP_URL`, zeigen alle neu
+  heruntergeladenen und gedruckten Codes auf die Subdomain.
+- `src/app/(main)/r/[slug]/route.ts:50,61,84,89` — Landing-Basis vcard/text/coupon/feedback
+- `src/lib/email.ts:56,562`, `src/lib/marketingEmail.ts:30` — Mail-Links auf Marketing-Inhalte
+- `src/app/(main)/api/auth/signup/route.ts:20` — Verify-Mail-Link
+- `src/app/(main)/api/stripe/checkout/route.ts:64` — `cancel_url` → `/pricing`
+- `src/lib/metaConversions.ts:44`, `src/app/(main)/api/auth/signup/route.ts:150` — Event-Source-URLs
+
+**Bleibt/wird `APP_URL` (eingeloggt):**
+- `src/app/(main)/api/stripe/checkout/route.ts:63` — `success_url` → `/dashboard`
+- `src/app/(main)/api/stripe/create-checkout-session/route.ts:112,128` — `appUrl` + returnPath
+- `src/app/(main)/api/stripe/portal/route.ts:59` — `return_url` → `/settings`
+- `src/lib/email.ts:505` — hartcodiertes `https://www.qrmaster.net/dashboard` im Mail-Footer
+- `src/app/(main)/api/auth/google/route.ts:40,97` — `redirect_uri` (deckt A4 ab)
+
+### B3. Post-Auth-Sprung auf app.*
+Die einzige Cross-Host-Stelle. `sanitizeRedirectPath` (`src/lib/auth-flow.ts:4`) erlaubt bewusst
+nur relative Pfade — bleibt so, ich baue den Host separat davor:
+
+- `src/app/(main)/(auth)/login/ClientPage.tsx:56` und `login/LoginClient.tsx:65`
+- `src/app/(main)/(auth)/signup/ClientPage.tsx:70`
+- `src/app/(main)/api/auth/google/route.ts:224,228` — Server-Redirect
+- `src/app/(main)/api/auth/verify-email/route.ts:38` — setzt Cookie und redirected
+- `src/lib/auth-flow.ts:46` — `getPostOnboardingDestination`
+
+Muster: relativen Zielpfad wie heute bestimmen, dann `new URL(path, APP_URL)`. Weil das
+Auth-Cookie nach B1 auf `.qrmaster.net` gilt, ist der Nutzer nach dem Sprung sofort eingeloggt —
+kein Token-Handover über die URL nötig.
+
+### B4. Onboarding-Checkliste
+`src/components/dashboard/OnboardingChecklist.tsx:141` verlinkt `/onboarding` mit
+`redirect=/dashboard`. Beide Pfade liegen nach dem Umzug auf app.* → bleibt relativ, keine
+Änderung. Nur verifizieren.
+
+### B5. Middleware: Host-Routing
+`src/middleware.ts` — Kern des Umbaus. Der bestehende Apex-Redirect (Zeile 49) bleibt unberührt.
+Neu, direkt danach:
+
+- Host `app.qrmaster.net`:
+  - `/api/*`, `/_next/*`, statische Dateien: durchlassen (Stripe-Webhook, CSRF, alles)
+  - `protectedPaths` (Zeile 145) + `/upgrade` + `/onboarding`: bedienen wie heute
+  - alles andere: 301 auf `WWW_URL` + gleicher Pfad
+  - `/r/*`: 301 auf www — QR-Redirects gehören nicht auf die App-Subdomain
+- Host `www.qrmaster.net`:
+  - `protectedPaths` + `/upgrade` + `/onboarding`: 301 auf `APP_URL` + Pfad + Query
+    (damit alte Bookmarks und der Mail-Footer-Link weiter funktionieren)
+- Auth-Fail-Redirect (Zeile 166): zeigt auf `/signup` — das liegt auf www, also absolut
+  auf `WWW_URL` umstellen, `redirect`-Param bleibt relativ
+
+`/login` und `/signup` bleiben in `publicPaths` und werden nur auf www bedient.
+
+### B6. Indexierung der Subdomain dichtmachen
+`app.*` darf nicht in den Index, sonst Duplicate Content.
+
+- `src/middleware.ts`: auf Host `app.*` `X-Robots-Tag: noindex, nofollow` auf alle Responses
+- `public/robots-app.txt` neu anlegen (`User-agent: * / Disallow: /`), Middleware rewritet
+  `/robots.txt` auf app.* dorthin. `src/app/robots.ts` bleibt für www unverändert.
+- `/sitemap.xml` auf app.* → 301 auf www
+
+Gute Nachricht: `/dashboard`, `/create`, `/settings` sind in `src/app/robots.ts:7` bereits
+disallowed und nicht in der Sitemap → **kein Ranking-Verlust durch den Umzug.** Die Canonicals
+sind ohnehin hart auf www verdrahtet (`src/app/(main)/layout.tsx:13`).
+
+### B7. Docker-Env-Kette
+`NEXT_PUBLIC_*` wird zur Build-Zeit inlined **und** zur Laufzeit serverseitig gelesen. Beide
+Stellen müssen übereinstimmen, sonst gibt es Bugs, die nur im Client oder nur im Server auftreten:
+
+- `Dockerfile:34` — `NEXT_PUBLIC_APP_URL` auf `https://app.qrmaster.net`, neu
+  `ENV NEXT_PUBLIC_WWW_URL="https://www.qrmaster.net"`
+- `docker-compose.yml:58` — `NEXT_PUBLIC_WWW_URL` und `COOKIE_DOMAIN` ins `environment` des
+  `web`-Service durchreichen
+- `env.example` + `.env.example` — neue Variablen dokumentieren
+- `src/lib/env.ts` — optional, das Schema kennt `NEXT_PUBLIC_*` bisher gar nicht
+
+## Deploy-Choreografie
+
+Zwei Deploys, nicht einer. Das entkoppelt das Cookie-Risiko vom Routing-Risiko:
+
+1. **Deploy 1 (nur B1):** Cookie-Domain auf `.qrmaster.net`. Nur www ist live, nach außen
+   unsichtbar. 24 h beobachten: Login, Logout, Checkout müssen normal laufen.
+2. **A1 + A2 + A4:** DNS, Caddy, Google Console. `app.qrmaster.net` antwortet, serviert aber
+   noch dieselbe App wie www — unkritisch, weil noch nicht verlinkt und dank B6 noch nicht
+   indexierbar.
+3. **Deploy 2 (B2–B7):** Host-Routing scharf. Ab hier springt Login auf app.*.
+
+Rollback: Deploy 2 zurücknehmen. Weil das Cookie auf `.qrmaster.net` gilt, bleiben Sessions
+auch nach dem Rollback auf www gültig — niemand wird ausgeloggt. DNS/Caddy können stehen bleiben.
+
+## Testcheckliste (nach Deploy 2)
+
+Jeweils über beide Hosts:
+
+- [ ] `www.qrmaster.net/dashboard` → 301 auf `app.qrmaster.net/dashboard`, eingeloggt
+- [ ] `app.qrmaster.net/pricing` → 301 auf www
+- [ ] Signup auf www → Verify-Mail → Link führt eingeloggt auf app.*
+- [ ] Google-Login von www aus → landet eingeloggt auf app.*/dashboard bzw. /onboarding
+- [ ] Logout auf app.* → auf www **auch** ausgeloggt (prüft B1, häufigster Fehler)
+- [ ] Checkout: Upgrade auf app.* → Stripe → `success_url` app.*/dashboard, Abbruch → www/pricing
+- [ ] Stripe-Portal → zurück auf app.*/settings
+- [ ] Stripe-Webhook feuert weiter (Dashboard → Events, keine 4xx)
+- [ ] **QR-Code neu anlegen + herunterladen → kodierte URL ist `www.qrmaster.net/r/<slug>`**,
+      nicht app.* (prüft B2, das teuerste Fehlerbild)
+- [ ] Bestehender `/r/<slug>` redirected + trackt weiter, vcard/coupon/feedback-Landings laden
+- [ ] Mutation auf app.* (QR umbenennen) → CSRF greift, kein 403
+- [ ] `curl -sI https://app.qrmaster.net/dashboard | grep -i x-robots-tag` → noindex
+- [ ] `https://app.qrmaster.net/robots.txt` → `Disallow: /`
+- [ ] Search Console: `app.qrmaster.net` **nicht** als Property anlegen, keine Sitemap einreichen
+
+## Risiken
+
+| Risiko | Wo | Absicherung |
+|---|---|---|
+| Gedruckte QR-Codes zeigen auf app.* | `QRCodeCard.tsx:82` | B2, explizit im Test |
+| Logout wirkt nicht (Zombie-Cookie) | `logout/route.ts` | B1 löscht beide Varianten |
+| Client/Server-Env divergieren | `Dockerfile` vs. `docker-compose.yml` | B7, beide Stellen setzen |
+| Google-OAuth bricht | Cloud Console | A4, alte URI stehen lassen |
+| Duplicate Content auf app.* | — | B6 vor Deploy 2 |
+
+## Aufwand
+
+- Deine Seite: ~45 min (DNS, Caddy, .env, Google Console, Deploy)
+- Meine Seite: ~4–6 h Code über zwei Deploys
+- Keine DB-Änderung, kein Forced-Logout, kein SEO-Verlust
--- a/PLAN_CRO_UND_RETENTION_2026-07-27.md
+++ b/PLAN_CRO_UND_RETENTION_2026-07-27.md
@@ -0,0 +1,421 @@
+# Umsetzungsplan - CRO-Momente, Upgrade-Wege und Retention-Mails
+
+Stand 27. Juli 2026. Alle Datei- und Zeilenangaben gegen den aktuellen Stand verifiziert.
+
+**Getroffene Entscheidungen:**
+- Das Dynamic-Limit zählt künftig nur noch Codes mit `status = ACTIVE`. Pausieren gibt einen Slot frei.
+- Der Upgrade-Weg im Limit-Moment läuft per Direkt-Checkout aus dem Modal. Kein Redirect auf `/pricing`.
+
+---
+
+## Phase 1 - Der Limit-Moment in `/create`
+
+### 1.1 Limit-Query auf ACTIVE umstellen
+
+**Datei:** `src/app/(main)/api/qrs/route.ts`, Zeile 117-121
+
+```ts
+const dynamicQRCount = await db.qRCode.count({
+  where: { userId, type: 'DYNAMIC', status: 'ACTIVE' },
+});
+```
+
+Dieselbe Änderung in `src/app/(main)/api/user/stats/route.ts`, sonst zeigt das Dashboard eine andere Zahl als die API durchlässt.
+
+**Nebenwirkung, die vorher klar sein muss:** Free-Nutzer, die heute pausierte Codes haben, bekommen dadurch rückwirkend Slots frei. Das ist eine Lockerung, keine Verschärfung - es nimmt niemandem etwas weg. Vor dem Deploy einmal zählen, wie viele Nutzer betroffen sind (SQL unten in Abschnitt „Prüf-Queries").
+
+### 1.2 Das Limit-Modal
+
+**Neue Datei:** `src/components/app/DynamicLimitModal.tsx`
+
+Der 403 aus `/api/qrs` liefert bereits `currentCount`, `limit` und `plan` mit. Es braucht keinen zusätzlichen Request.
+
+**Datei:** `src/app/(main)/(app)/create/page.tsx`, Zeile 456-459 - der Redirect entfällt ersatzlos:
+
+```ts
+if (response.status === 403 && responseData.error === 'Limit reached') {
+  setLimitInfo({ current: responseData.currentCount, limit: responseData.limit, plan: responseData.plan });
+  setLimitModalOpen(true);
+  return;
+}
+```
+
+Der Formular-State bleibt dadurch erhalten. Das ist der eigentliche Fix - alles andere ist Ausgestaltung.
+
+**Copy des Modals:**
+
+> ### Dein vierter Code ist fertig. Er braucht nur noch einen Platz.
+>
+> Du nutzt alle 3 dynamischen Codes deines kostenlosen Plans. Dieser hier ist gebaut und wartet - du kannst ihn behalten oder einen bestehenden freigeben.
+>
+> **[ Diesen Code mit Pro speichern - 9 € / Monat ]**
+> [ Einen bestehenden Code pausieren ]
+> [ Stattdessen als statischen Code herunterladen ]
+>
+> *Deine 3 aktiven Codes laufen weiter, egal wie du dich entscheidest.*
+
+Die Zahlen (`vierter`, `3`) kommen aus `limitInfo`, damit das Modal auch für Pro bei 51 stimmt.
+
+**Warum diese drei Optionen:**
+
+Der Hauptbutton verkauft keinen Plan, sondern rettet einen konkreten Code, den der Nutzer gerade in der Hand hat. Option 2 ist die ehrliche Alternative innerhalb des Free-Plans - sie kostet ein paar Conversions und kauft dafür Belief 5 aus dem Necessary-Beliefs-Doc. Option 3 ist der Ausweg ohne Verlust: ein statischer Code löst das Problem zu einem guten Teil, kostet nichts, und die Zusage „läuft nie ab" ist verifiziert. Der Schlusssatz ist Risk Reversal genau an der Stelle, an der die Kategorie ihren schlechtesten Ruf hat.
+
+### 1.3 Direkt-Checkout aus dem Modal
+
+Der Pro-Button ruft `/api/stripe/checkout` direkt auf, mit `priceId`, `plan: 'PRO'` und `userEmail`.
+
+**Datei:** `src/app/(main)/api/stripe/checkout/route.ts`, Zeile 63. Die `success_url` ist aktuell fest auf `/dashboard?success=true`. Sie muss eine optionale `returnPath` aus dem Request-Body akzeptieren, damit der Nutzer nach dem Kauf dorthin zurückkommt, wo er war.
+
+Vor dem Öffnen von Stripe wird der Formularzustand nach `localStorage` geschrieben (`qrm_pending_qr`, mit Zeitstempel). Beim Zurückkommen auf `/create?restored=1` liest die Seite ihn aus, füllt das Formular und zeigt: *„Willkommen zurück. Dein Code steht noch genau so da - jetzt mit Platz."* Danach den Key löschen. Einträge älter als 24 Stunden werden verworfen.
+
+Kein Draft in der Datenbank. Der Zustand ist ohnehin nur im Browser relevant, und eine Draft-Tabelle wäre Infrastruktur für ein Problem, das `localStorage` löst.
+
+### 1.4 Option „Code pausieren" im Modal
+
+Zeigt die aktiven dynamischen Codes des Nutzers mit Titel und Scan-Zahl der letzten 30 Tage. Ein Klick setzt `status = PAUSED` über das bestehende `PATCH /api/qrs/[id]`, danach wird der ursprüngliche POST automatisch wiederholt.
+
+Die Scan-Zahl daneben ist wichtig: sie macht die Entscheidung informiert statt willkürlich. Wer sieht, dass ein Code seit vier Wochen null Scans hat, pausiert ihn ohne schlechtes Gefühl - und wer sieht, dass alle drei laufen, versteht ohne Verkaufstext, warum Pro sinnvoll ist. Das ist Pointing statt Talking.
+
+---
+
+## Phase 2 - `/bulk-creation`
+
+**Datei:** `src/app/(main)/(app)/bulk-creation/page.tsx`, Zeile 232-247
+
+Die Schleife hat kein `else` zu `if (res.ok)`. Fehlgeschlagene Zeilen verschwinden still, und danach meldet ein grüner Toast `${results.length} dynamische QR-Codes erstellt!` - eine Zahl, die kleiner sein kann als das Hochgeladene, ohne jeden Hinweis.
+
+**Fix:**
+
+```ts
+const failed: { row: number; title: string; reason: string }[] = [];
+// im else-Zweig: failed.push({ row: i + 1, title, reason: (await res.json()).error })
+```
+
+Danach, wenn `failed.length > 0`, statt des Erfolgs-Toasts ein Ergebnis-Panel:
+
+> **180 von 200 Codes erstellt.**
+> 20 Zeilen konnten nicht angelegt werden, weil dein Kontingent an dynamischen Codes erschöpft ist. Hier sind sie - du kannst sie als statische Codes erzeugen oder dein Kontingent erhöhen.
+>
+> [ Fehlende Zeilen als CSV ] [ Kontingent erhöhen ]
+
+Zusätzlich in derselben Datei:
+
+- `remainingDynamic` nach dem Lauf vom Server neu laden statt nur lokal herunterzuzählen (Zeile 251). Das ist die Ursache der Race Condition.
+- Die Toasts sind auf Deutsch (`'Du hast keine dynamischen QR-Codes mehr übrig...'`, Zeile 215 und 221), während die restliche App-Oberfläche Englisch ist. Auf Englisch umstellen.
+
+---
+
+## Phase 3 - Upgrade-Wege aus der App
+
+`/pricing` liegt in der `(marketing)`-Route-Group. Wer im Dashboard auf Upgrade klickt, verliert die Sidebar und landet in der Marketing-Site. Zusätzlich liest `PricingClient.tsx` `searchParams` überhaupt nicht - das `?reason=limit_reached`, das `/create` heute anhängt, wird vollständig ignoriert.
+
+Nach der getroffenen Entscheidung läuft der Limit-Fall künftig über das Modal, damit ist der wichtigste Fall gelöst. Es bleiben drei In-App-Links auf `/pricing`:
+
+| Datei | Zeile | Kontext |
+|---|---|---|
+| `dashboard/page.tsx` | 340 | Upgrade-Badge im Header |
+| `create/page.tsx` | 977 | Hinweis „Upgrade to PRO to customize colors" |
+| `create/page.tsx` | 1106 | Hinweis „Upgrade to PRO to add logos" |
+
+Die beiden Hinweise in `/create` sollten dasselbe Modal öffnen wie der Limit-Fall, nur mit anderem Aufhänger („Dein Logo gehört in diesen Code"). Der Nutzer ist mitten im Gestalten - ihn dafür aus der Seite zu werfen ist derselbe Fehler wie beim Limit, nur weniger sichtbar.
+
+Der Dashboard-Badge kann auf `/pricing` zeigen bleiben. Dort ist der Nutzer nicht mitten in einer Aufgabe, es gibt nichts zu verlieren. Nur ein `?from=dashboard` anhängen und in `PricingClient` einen Zurück-Link rendern, damit der Weg zurück nicht über den Browser-Button läuft.
+
+---
+
+## Phase 4 - Post-Download-Popup auf den Tool-Seiten
+
+**Datei:** `src/components/marketing/PostDownloadPopup.tsx`
+
+Timing und die Ablehn-Option `No thanks, keep it static` bleiben unverändert - beides ist richtig gebaut.
+
+Ersetzt werden Headline und Bullet-Liste:
+
+> ### Dieser Code zeigt jetzt für immer auf diese URL.
+>
+> Bei einem dauerhaften Link ist das genau richtig. Falls sich das Ziel je ändert, brauchst du einen neuen Code und neues Druckmaterial.
+>
+> Ein kostenloses Konto gibt dir 3 dynamische Codes: gleiches Bild, Ziel jederzeit änderbar, jeder Scan gezählt.
+>
+> **[ Kostenloses Konto anlegen - keine Karte ]**
+> *Nein danke, statisch reicht*
+
+Die vier Bullets entfallen. Drei gleichrangige Vorteile sind schwächer als ein Satz, der den einen benennt - in einer Liste aus vier gleich formatierten Punkten ist keiner davon wichtig.
+
+Neues Prop `variant`, das nur die erste Zeile austauscht:
+
+| Tool | Erste Zeile |
+|---|---|
+| Google Review | Dieser Code zeigt jetzt für immer auf dieses Google-Profil. |
+| WiFi | Dieser Code enthält jetzt dauerhaft dieses WLAN-Passwort. |
+| vCard | Dieser Code enthält jetzt dauerhaft diese Kontaktdaten. |
+| Crypto | Dieser Code enthält jetzt dauerhaft diese Wallet-Adresse. |
+| Standard | Dieser Code zeigt jetzt für immer auf diese URL. |
+
+Die WiFi-Variante ist die stärkste, weil sie einen Umstand benennt, den fast niemand vorher bedenkt: Wer das Passwort ändert, hat wertloses Druckmaterial.
+
+Betroffen sind die 10+ Generator-Komponenten, die `PostDownloadPopup` einbinden - dort jeweils nur das `variant`-Prop ergänzen.
+
+**Zusätzlich:** `shouldShowDownloadPopup()` prüft einen einzigen `localStorage`-Key. Wer das Popup einmal gesehen hat, sieht es auf keiner anderen Tool-Seite je wieder - auch nicht Monate später in einem anderen Kontext. Vorschlag: Key mit Zeitstempel, Wiedervorlage nach 30 Tagen.
+
+---
+
+## Phase 5 - Retention-Mails
+
+**Datei:** `src/lib/email.ts` und `src/app/(main)/api/cron/retention-emails/route.ts`
+
+### 5.1 Tag-7-Mail: Trigger vom Kalender aufs Verhalten
+
+Aktuell feuert sie bei `createdAt < 7 Tage` und `qrCount > 0`. Ein Nutzer mit einem einzigen Code bekommt „You're 2 away from the free limit" - eine Verkaufsmail über ein Limit, das ihn nicht drückt, abgeschickt unter deinem Namen.
+
+Neue Logik:
+
+| Zustand | Auslöser | Mail |
+|---|---|---|
+| aktive dynamische Codes = Limit | sobald erreicht | Limit-Mail, Marker `limitReachedNudgeSentAt` |
+| 1-2 von 3 belegt, Tag 7 | Tag 7 | keine Upgrade-Mail |
+| erster Scan liegt vor | 1 Tag danach | Erster-Scan-Mail, Marker `firstScanNudgeSentAt` |
+
+In der Vergleichstabelle der Limit-Mail entfällt die Zeile `CSV export: Free ✓ / Pro ✓`. Eine Zeile, in der beide Spalten identisch sind, gehört nicht in eine Upgrade-Tabelle - sie verwässert die drei, die einen Unterschied zeigen.
+
+### 5.2 Neue Mail: erster Scan
+
+`User.firstScanAt` existiert bereits und wird in `src/app/(main)/r/[slug]/route.ts` (Zeile 150-153 und 263-266) gesetzt. Es fehlt nur ein Versand-Marker.
+
+Betreff: **Dein Code wurde gerade zum ersten Mal gescannt**
+
+> Um {Uhrzeit}, auf einem {Gerät}, aus {Land}. Dein Code „{Titel}" ist im Einsatz.
+>
+> Ab jetzt zählt jeder weitere Scan mit. In ein paar Tagen siehst du, wann die meisten kommen - und ob sich der Ort lohnt, an dem du den Code platziert hast.
+>
+> [ Scans ansehen ]
+
+Kein Verkaufsargument. Diese Mail hat einen Anlass, der nicht konstruiert ist, und ist der Moment, in dem die Positionierung zum ersten Mal einlöst. Sie ist die einzige in der Sequenz, deren Anlass nicht vom Kalender kommt.
+
+### 5.3 Tag-30-Mail auf Scan-Daten umbauen
+
+Zwei Probleme mit der jetzigen Fassung:
+
+Der Satz *„The one thing I hear most from Pro users who switched after a few weeks: they wish they'd added their brand sooner"* behauptet ein Muster aus Kundengesprächen. Wenn es die gab: echtes Zitat rein. Wenn nicht: **streichen** - das ist ein erfundenes Testimonial in indirekter Rede und verstößt gegen die Beweisregel im Product Context. Bei einer Zielgruppe, die Bewertungsportale liest, ist das die teuerste Art von Satz.
+
+Und Branding ist der schwächere von zwei verfügbaren Aufhängern. Nach 30 Tagen hat der Nutzer Scan-Daten. Neuer Aufbau:
+
+> Deine Codes wurden diesen Monat {n}-mal gescannt, {Vorname}.
+>
+> Die meisten davon {Wochentag}s. Was du noch nicht sehen kannst: von welchen Geräten sie kamen und aus welchen Orten - und damit, welche deiner Platzierungen die Scans wirklich gebracht hat.
+>
+> [ Vollständige Auswertung freischalten ]
+
+Damit ist der Kaufgrund aus dem hergeleitet, was der Nutzer selbst erlebt hat. Deckt sich mit Offer Brief §10, Option 1 - auf Analytics-Tiefe metern statt auf Code-Anzahl -, und ist die erste Stelle, an der man das testen kann, ohne das Pricing anzufassen.
+
+### 5.4 Tag-3-Mail: kleine Korrektur
+
+Betreff `You haven't made one yet` kann als Vorwurf gelesen werden - im Body löst die Headline es auf, im Posteingang steht der Betreff allein. Alternative gleicher Länge: **`Your 3 free codes are still sitting there`**.
+
+---
+
+## Phase 6 - QR-Design nach Plan gestaffelt
+
+Neue Staffelung: Farben ab Free, Formen ab Pro, alles ab Business.
+
+### 6.0 Der technische Blocker, der vorher geklärt sein muss
+
+`/create` rendert über `QRCodeSVG` aus `qrcode.react` (Zeile 6 und 1233). **Diese Bibliothek kann ausschließlich quadratische Module.** Es gibt heute überhaupt keine Formauswahl im Produkt - nicht weil sie gesperrt wäre, sondern weil der Renderer sie nicht kann.
+
+Für Formen muss der Renderer also getauscht werden. Es gibt zwei Kandidaten, und sie decken unterschiedlich viel ab:
+
+| Renderer | Kann | Kann nicht |
+|---|---|---|
+| `qr-code-styling` (liegt bereits als Dependency in `package.json`, Zeile 64, ungenutzt) | square, dots, rounded, extra-rounded, classy, classy-rounded, Eye-Styles getrennt, Verläufe, Logo | star, plus, hexagon, diamond, mosaic, liquid |
+| Canvas-Renderer aus `qr-design-showcase.html` | alle 11 Formen inklusive star, plus, hexagon, diamond, mosaic, liquid, Rahmen mit Label, Logo-Formen | ist eigener Code, muss portiert und gepflegt werden |
+
+Das trifft sich gut mit der gewünschten Staffelung: **Pro läuft komplett über `qr-code-styling`** - vier Formen, geringer Aufwand, Bibliothek ist schon da. **Business braucht den portierten Showcase-Renderer** für die exotischen Formen. Damit ist der Mehraufwand genau dort, wo auch der höhere Preis ist.
+
+### 6.1 Free - Farben
+
+**Datei:** `src/app/(main)/(app)/create/page.tsx`, Zeile 167
+
+```ts
+const canCustomizeColors = true;              // war: PRO || BUSINESS
+const canUseShapes       = userPlan === 'PRO' || userPlan === 'BUSINESS';
+const canUseFullDesign   = userPlan === 'BUSINESS';
+const canUseLogo         = userPlan === 'PRO' || userPlan === 'BUSINESS';
+```
+
+Damit fallen die beiden Zwangsüberschreibungen in Zeile 408-409 weg, die heute für Free-Nutzer stumpf `#000000` und `#FFFFFF` einsetzen. Der Upgrade-Hinweis-Block ab Zeile 972 („Upgrade to PRO to customize colors, add logos, and brand your QR codes") entfällt komplett - er stimmt danach nicht mehr.
+
+Der Logo-Block ab Zeile 1104 bleibt, wird aber auf `canUseLogo` umgestellt statt auf `canCustomizeColors`, und öffnet künftig das Modal aus Phase 3 statt auf `/pricing` zu verlinken.
+
+**Der Kontrast-Check bleibt aktiv.** `calculateContrast` gibt es bereits (Zeile 221). Sobald Farben für alle offen sind, wird er wichtiger, nicht unwichtiger - Free-Nutzer sind die Gruppe mit der geringsten Erfahrung darin, was noch scannbar ist. Bei zu geringem Kontrast eine Warnung, kein Verbot: *„Dieser Kontrast ist grenzwertig. Auf gedrucktem Material scannen helle Codes auf hellem Grund oft nicht."*
+
+### 6.2 Pro - vier Modulformen
+
+Umsetzung über `qr-code-styling`. Bewusst nur vier, nicht sechs:
+
+| Auswahl | `dotsOptions.type` | Wofür |
+|---|---|---|
+| Eckig (klassisch) | `square` | Standard, höchste Scan-Sicherheit |
+| Abgerundet | `rounded` | weicher, ohne Lesbarkeit zu kosten |
+| Punkte | `dots` | modern, deutlich sichtbarer Unterschied |
+| Fließend | `classy-rounded` | markantester der vier |
+
+Dazu die Eye-Styles (`cornersSquareOptions`, `cornersDotOptions`) - eckig, abgerundet, Kreis. Die Augen machen optisch mehr aus als die Module selbst und kosten nichts extra, weil dieselbe Bibliothek sie mitbringt.
+
+Vier Optionen statt aller sechs, weil die Auswahl selbst ein Verkaufsargument ist: Pro fühlt sich vollständig an, Business hat sichtbar mehr. Sechs fast identische Varianten wirken dagegen wie eine lange Liste ohne Unterschied.
+
+### 6.3 Business - vollständiger Designer
+
+Portierung des Renderers aus `qr-design-showcase.html` in eine Komponente `src/components/generator/AdvancedQRRenderer.tsx`. Was damit dazukommt:
+
+- **Modulformen:** diamond, star, hexagon, plus, mosaic, liquid zusätzlich zu den vier aus Pro
+- **Eye-Frames getrennt:** eckig, abgerundet, Kreis, Blatt, Flower/Squircle, Hexagon
+- **Eye-Balls getrennt:** eckig, abgerundet, Kreis, Diamant, Stern, Hexagon
+- **Farbverläufe:** linear und radial statt einfarbig
+- **Rahmen mit Label:** weiße Karte mit Schatten, Label oben oder unten (z. B. „Speisekarte", „Jetzt bewerten")
+- **Logo-Formen:** Punkt, Quadrat, Herz, Blitz, WLAN-Symbol
+- **Fehlerkorrektur-Stufe** frei wählbar (L/M/Q/H)
+
+**Erweiterungsvorschläge über die Showcase hinaus**, weil beim Business-Kunden die Wiederholbarkeit zählt und nicht die einzelne Spielerei:
+
+1. **Design-Vorlagen speichern.** Ein einmal gebautes Design als benanntes Preset sichern und auf neue Codes anwenden. Das ist für eine Agentur mit mehreren Kunden der eigentliche Wert - nicht die Sternform, sondern dass Kunde A immer gleich aussieht.
+2. **Preset auf den Bulk-Flow anwenden.** Ein Preset auswählen und alle 500 Codes eines Uploads tragen es. Das verbindet Phase 2 mit diesem Feature und ist das erste Argument für Business, das nicht nur eine Zahl ist.
+3. **Print-Vorschau in Originalgröße.** Der Code in 2×2 cm, 4×4 cm und 10×10 cm dargestellt, mit Hinweis ab wann es kritisch wird. Passt zu den Druckangaben, die im Offer Brief bereits als verifizierter Fakt geführt werden.
+
+### 6.4 Scanbarkeit - der Teil, der nicht optional ist
+
+Exotische Formen füllen weniger Fläche pro Modul. Star, plus und mosaic reduzieren die Kontrastfläche spürbar, und in Kombination mit einem Logo in der Mitte und einer kleinen Druckgröße kippt die Lesbarkeit. Die Showcase weist bei „H (30%)" schon auf „empfohlen bei Logo" hin - das gehört ins Produkt übernommen, und zwar strenger:
+
+- Bei star, plus, mosaic oder liquid automatisch auf Fehlerkorrektur **H** hochsetzen und das sichtbar begründen
+- Bei Logo plus exotischer Form eine Warnung mit Mindestdruckgröße
+- Ein **Test-Scan-Hinweis** vor dem Download: *„Scanne den Code einmal mit deinem eigenen Handy, bevor du ihn in Druck gibst."*
+
+Das ist kein Beiwerk, sondern der Proof-Layer aus der Positionierung an einer Stelle, an der es konkret wird. Ein Anbieter, der vor seinem eigenen Feature warnt, wenn es kritisch wird, belegt Belief 5 besser als jede Aussage über Transparenz.
+
+### 6.5 Was die Umstellung beim Pricing kostet
+
+Ehrlich gesagt: Farben waren laut Offer Brief §10 einer von genau **drei** Gründen, heute auf Pro zu wechseln (die anderen zwei: mehr als 3 aktive Codes, Device- und Location-Breakdown). Diesen Grund gibt man mit dieser Änderung auf.
+
+Das ist meiner Einschätzung nach trotzdem richtig, aber aus einem anderen Grund als „großzügiger sein":
+
+Farben sind kein guter Upgrade-Anlass, weil man sie schon im kostenlosen Zustand *sehen* will, um zu verstehen, ob das Produkt etwas taugt. Ein Free-Nutzer, der nur schwarze Codes bauen kann, hält das Produkt für ein Basiswerkzeug - und bewertet es entsprechend, auch in Vergleichen. Formen sind der bessere Verkäufer, weil der Unterschied größer aussieht und man ihn in der Vorschau zeigen kann, bevor man ihn freischaltet: der Nutzer wählt „Punkte", sieht das Ergebnis live, und erst der Download fragt nach Pro.
+
+**Folgeänderungen an der Preis-Copy** in `src/i18n/en.json` und `src/app/(main)/(marketing)/pricing/PricingClient.tsx`:
+
+| Plan | vorher | nachher |
+|---|---|---|
+| Free | „Standard QR design templates" | „Deine Farben - Vorder- und Hintergrund frei wählbar" |
+| Pro | „Custom branding (colors & logos)" | „4 Modulformen, eigene Eye-Styles und dein Logo im Code" |
+| Business | (kein Design-Punkt) | „Voller Designer: 10 Formen, Verläufe, Rahmen mit Label, speicherbare Design-Vorlagen" |
+
+Dieselbe Anpassung auf `/custom-qr-code-generator`, dessen Meta-Description aktuell „Put your logo and brand colors into the code itself" sagt - das bleibt korrekt, weil Logo weiterhin Pro ist, aber die Seite sollte künftig zeigen, was auf welcher Stufe geht.
+
+### 6.6 Keine Datenbankänderung nötig
+
+`QRCode.style` ist bereits `Json` (siehe `prisma/schema.prisma`). Alle neuen Felder - `dotType`, `eyeFrameType`, `eyeBallType`, `gradient`, `frameLabel`, `logoShape`, `ecLevel` - passen ohne Schemaänderung hinein. Bestehende Codes haben die Felder schlicht nicht und fallen auf die Defaults zurück.
+
+**Ausnahme:** Wenn die speicherbaren Design-Vorlagen aus 6.3 kommen sollen, braucht es eine eigene Tabelle. SQL dafür steht unten, ist aber optional und kann später nachgezogen werden.
+
+---
+
+## SQL - alle nötigen Datenbankänderungen
+
+Nach der Policy in `CLAUDE.md`: keine Prisma-Migrationen, nur direkte Statements.
+
+```sql
+-- Marker für die neuen verhaltensbasierten Retention-Mails
+ALTER TABLE "User" ADD COLUMN IF NOT EXISTS "limitReachedNudgeSentAt" TIMESTAMP(3);
+ALTER TABLE "User" ADD COLUMN IF NOT EXISTS "firstScanNudgeSentAt"    TIMESTAMP(3);
+
+-- Index für den Cron: sucht Nutzer mit erstem Scan, die die Mail noch nicht haben
+CREATE INDEX IF NOT EXISTS "User_firstScanAt_firstScanNudgeSentAt_idx"
+  ON "User" ("firstScanAt", "firstScanNudgeSentAt");
+
+-- Index für die neue Limit-Query (zählt nur noch ACTIVE)
+CREATE INDEX IF NOT EXISTS "QRCode_userId_type_status_idx"
+  ON "QRCode" ("userId", "type", "status");
+```
+
+Für Phase 6 ist **nichts** davon nötig - `QRCode.style` ist bereits `Json`. Optional, nur falls die speicherbaren Design-Vorlagen aus 6.3 gebaut werden:
+
+```sql
+CREATE TABLE IF NOT EXISTS "QRDesignPreset" (
+  "id"        TEXT PRIMARY KEY,
+  "userId"    TEXT NOT NULL REFERENCES "User"("id") ON DELETE CASCADE,
+  "name"      TEXT NOT NULL,
+  "style"     JSONB NOT NULL,
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT now(),
+  "updatedAt" TIMESTAMP(3) NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS "QRDesignPreset_userId_idx" ON "QRDesignPreset" ("userId");
+CREATE UNIQUE INDEX IF NOT EXISTS "QRDesignPreset_userId_name_key" ON "QRDesignPreset" ("userId", "name");
+```
+
+Ausführen über `npm run docker:db` oder:
+
+```bash
+docker-compose exec db psql -U postgres -d qrmaster -c 'ALTER TABLE "User" ADD COLUMN IF NOT EXISTS "limitReachedNudgeSentAt" TIMESTAMP(3);'
+```
+
+Danach `prisma/schema.prisma` im Block `// Retention email tracking` ergänzen:
+
+```prisma
+  limitReachedNudgeSentAt DateTime?
+  firstScanNudgeSentAt    DateTime?
+```
+
+und beim Model `QRCode` den Index:
+
+```prisma
+  @@index([userId, type, status])
+```
+
+Abschließend `npx prisma generate` - kein `migrate`.
+
+### Prüf-Queries vor dem Deploy
+
+```sql
+-- Wie viele Free-Nutzer bekommen durch die ACTIVE-Umstellung Slots frei?
+SELECT COUNT(DISTINCT u.id)
+FROM "User" u
+JOIN "QRCode" q ON q."userId" = u.id
+WHERE u.plan = 'FREE' AND q.type = 'DYNAMIC' AND q.status = 'PAUSED';
+
+-- Wie viele Nutzer bekämen die Erster-Scan-Mail beim ersten Cron-Lauf?
+SELECT COUNT(*) FROM "User"
+WHERE "firstScanAt" IS NOT NULL AND "firstScanNudgeSentAt" IS NULL;
+```
+
+Die zweite Zahl ist wichtig: Beim ersten Lauf würde die neue Mail an **alle** Bestandsnutzer mit Scan-Historie gehen - auch an solche, deren erster Scan Monate zurückliegt. Das wäre kein Anlass mehr, sondern Spam. Der Cron braucht deshalb ein Zeitfenster, etwa `firstScanAt > now() - interval '7 days'`, oder man setzt die Spalte bei Bestandsnutzern einmalig vor:
+
+```sql
+UPDATE "User" SET "firstScanNudgeSentAt" = now()
+WHERE "firstScanAt" IS NOT NULL AND "firstScanAt" < now() - interval '7 days';
+```
+
+---
+
+## Reihenfolge
+
+| # | Was | Aufwand | DB |
+|---|---|---|---|
+| 1 | Limit-Query auf ACTIVE, beide Endpoints | klein | Index |
+| 2 | Limit-Modal ohne Redirect | mittel | nein |
+| 3 | Direkt-Checkout plus `returnPath` und localStorage-Wiederherstellung | mittel | nein |
+| 4 | `bulk-creation`: Fehlerbehandlung und Ergebnis-Panel | klein | nein |
+| 5 | Popup-Copy plus `variant` pro Tool-Seite | klein | nein |
+| 6 | Retention: Trigger umstellen, Tabellen-Zeile raus, Betreff Tag 3 | klein | 1 Spalte |
+| 7 | Erster-Scan-Mail | mittel | 1 Spalte |
+| 8 | Tag-30 auf Scan-Daten, unbelegten Satz klären | klein | nein |
+| 9 | Farben ab Free freischalten, Pricing-Copy nachziehen | klein | nein |
+| 10 | Pro-Formen über `qr-code-styling`, Renderer-Tausch in `/create` | mittel | nein |
+| 11 | Business-Designer, Showcase-Renderer portieren | groß | nein |
+| 12 | Design-Vorlagen speichern und auf Bulk anwenden | mittel | Tabelle |
+
+1 bis 3 gehören zusammen und sollten gemeinsam live gehen. 4 und 5 sind unabhängig und können jederzeit dazwischen. 6 bis 8 brauchen die SQL-Statements und den einmaligen `UPDATE` für Bestandsnutzer.
+
+**9 ist der schnellste Gewinn im ganzen Dokument** - eine Zeile (`canCustomizeColors = true`) plus Copy-Anpassung, und das Produkt wirkt für jeden neuen Nutzer sofort weniger nach Basiswerkzeug. Sie sollte nicht auf 10 warten.
+
+10 ist der Renderer-Tausch und damit der Punkt, an dem `/create` einmal gründlich getestet werden muss - Vorschau, Download PNG, Download SVG, Logo-Overlay und die Frame-Optionen hängen alle daran.
+
+11 und 12 sind der eigentliche Business-Ausbau. 12 ist dabei wertvoller als 11: eine Agentur kauft nicht die Sternform, sondern dass Kunde A auf 500 Codes gleich aussieht.
--- a/PLAN_TESTUMGEBUNG_2026-08-12.md
+++ b/PLAN_TESTUMGEBUNG_2026-08-12.md
@@ -0,0 +1,299 @@
+# Plan: Testumgebung auf testmodul.qrmaster.net
+
+Stand: 2026-08-12 · Ziel: eine vollständige zweite Instanz auf `testmodul.qrmaster.net`, die
+einen anderen Branch (`test`) fährt, damit riskante Features - z.B. ein Bot, der bei
+Kundenerfolgen automatisch tweetet - vor dem Merge nach `master` real getestet werden können.
+
+**Status: nur Planung. Es wurde noch kein Code geändert.**
+
+## Architektur
+
+Zweiter, vollständig eigenständiger Compose-Stack aus demselben Repo, anderer Branch,
+eigene Datenbank, eigenes Redis. Caddy routet `testmodul.qrmaster.net` auf den Test-Container.
+
+```
+www.qrmaster.net   ─┐
+app.qrmaster.net   ─┴─> qrmaster-web       (Branch master, Prod-DB)
+testmodul.qrmaster.net ─> qrmaster-test-web (Branch test, eigene DB)
+```
+
+Prod und Test teilen sich **nichts** außer dem Docker-Netzwerk `qrmaster-network` (das ist
+`external: true`, darüber erreicht Caddy beide Container per Namen).
+
+## Ausgangslage im Repo
+
+Im Working Tree liegen uncommittete Änderungen, die nicht aus der Subdomain-Arbeit stammen:
+
+- `src/lib/cookieConfig.ts` - `getAuthCookieName()` ist angelegt (liest `AUTH_COOKIE_NAME`,
+  Default `userId`)
+- `src/lib/session.ts` - importiert `getAuthCookieName`, **benutzt es aber nicht**; Zeile 14
+  hat weiterhin `export const AUTH_COOKIE_NAME = 'userId'`
+
+Damit ist die Funktion aktuell wirkungslos. Die Verkabelung fehlt an 6 Stellen (siehe unten).
+Vor dem Weiterbauen klären, ob diese Änderungen bewusst so stehen oder committed werden sollen.
+
+Ein Branch `test` existiert noch nicht. Vorhanden: `analytics`, `dynamisch`,
+`feature/mockup-landing-page`, `icons`, `master`.
+
+## Falle 1 - Cookie-Kollision (blockierend)
+
+Produktion setzt das Session-Cookie `userId` auf `.qrmaster.net`. Der Browser schickt es damit
+**auch an `testmodul.qrmaster.net`**. Setzt Test sein eigenes `userId` als Host-Cookie, liegen
+zwei gleichnamige Cookies vor, und `req.cookies.get('userId')` in
+[middleware.ts:250](src/middleware.ts:250) liefert undefiniert welches davon. Folge: Login auf
+Test verhält sich sporadisch wie ausgeloggt - ein Fehlerbild, das schwer zu greifen ist, weil es
+vom Cookie-Zustand des jeweiligen Browsers abhängt.
+
+**Lösung:** Cookie-Name pro Umgebung konfigurierbar. `getAuthCookieName()` fertig verkabeln,
+Test setzt `AUTH_COOKIE_NAME=userId_test`.
+
+Zu ändernde Stellen:
+
+| Datei | Was |
+|---|---|
+| `src/lib/session.ts:14` | `AUTH_COOKIE_NAME`-Konstante durch `getAuthCookieName()` ersetzen (Zeilen 71, 78 ziehen nach) |
+| `src/middleware.ts:250` | `req.cookies.get('userId')` → `getAuthCookieName()` |
+| `src/app/(main)/api/auth/google/route.ts:227` | `cookies.set('userId', …)` |
+| `src/app/(main)/api/auth/verify-email/route.ts:40` | `cookies.set('userId', …)` |
+| `src/app/(main)/api/auth/logout/route.ts:12` | Eintrag in `appendExpiredCookies` |
+| `src/app/(main)/api/user/delete/route.ts:77` | `cookies().delete('userId')` |
+
+Wie `COOKIE_DOMAIN` muss `AUTH_COOKIE_NAME` **auch zur Build-Zeit** gesetzt sein - `process.env`
+wird ins Edge-Middleware-Bundle inlined. Also `ARG` + `ENV` im Dockerfile und als Build-Arg im
+Compose-Override, analog zu `COOKIE_DOMAIN`.
+
+Achtung beim Umstellen der Produktion: ändert sich dort der Cookie-Name, werden **alle
+bestehenden Sessions ungültig** (alle Nutzer ausgeloggt). Deshalb Prod beim Default `userId`
+lassen und nur Test abweichen - dann passiert genau nichts.
+
+## Falle 2 - Host-Routing würde nach Prod umleiten
+
+Die Middleware kennt nur zwei Hosts. Auf `testmodul.qrmaster.net` greift der Zweig
+`else if (isAppPath(path))` und schickt `/dashboard` per 301 auf **app.qrmaster.net**, also in
+die Produktion.
+
+**Lösung ohne Codeänderung:** Test zeigt beide Origins auf sich selbst. Dann ist
+`isHostSplitEnabled()` false, `getAppHostname()` liefert null, und das komplette Host-Routing
+schaltet sich ab. Test läuft als Ein-Host-Umgebung mit Marketing *und* App unter einer Domain -
+genau wie die lokale Entwicklung.
+
+Das ist der Grund, warum beide Variablen in `.env.test` identisch sein müssen. Wer dort später
+aus Versehen `NEXT_PUBLIC_APP_URL=https://app.qrmaster.net` einträgt, schickt seine Testklicks
+in die Produktion.
+
+## Falle 3 - ausgehende Nebenwirkungen
+
+Das ist beim Twitter-Bot der eigentliche Punkt. Eine Testumgebung, die auf echte Dienste zeigt,
+ist keine Testumgebung.
+
+| Dienst | Auf Test |
+|---|---|
+| Twitter/X | eigener App-Key auf einen Test-Account, **oder** ein `DRY_RUN`-Flag, das den Tweet nur loggt |
+| Stripe | Test-Keys (`sk_test_…`), eigener Webhook-Endpoint auf testmodul |
+| Resend / SMTP | Test-Key oder komplett deaktivieren - sonst mailt Test an echte Kunden |
+| Meta Conversions / PostHog / Umami | leer lassen, sonst verschmutzt Test die Prod-Analytics |
+| Cron (Retention-Mails) | auf Test abschalten |
+
+Empfehlung für den Bot: das `DRY_RUN`-Flag von Anfang an einbauen, nicht erst wenn es einmal
+schiefging. Ein Bot, der Kundenerfolge tweetet, ist genau die Sorte Feature, die man nicht
+"kurz mal live" testen will.
+
+## .env.test
+
+```dotenv
+NODE_ENV=production
+
+# Ein-Host-Betrieb: schaltet das Host-Routing ab
+NEXT_PUBLIC_WWW_URL=https://testmodul.qrmaster.net
+NEXT_PUBLIC_APP_URL=https://testmodul.qrmaster.net
+NEXTAUTH_URL=https://testmodul.qrmaster.net
+
+# Host-Cookie, nicht .qrmaster.net - sonst leckt die Test-Session nach Prod
+COOKIE_DOMAIN=
+AUTH_COOKIE_NAME=userId_test
+
+# Anderes Secret: ein Leak auf Test kann dann keine Prod-Session fälschen
+NEXTAUTH_SECRET=<eigenes Secret>
+IP_SALT=<eigenes Salt>
+
+# Nicht indexieren
+NEXT_PUBLIC_INDEXABLE=false
+
+# Eigene DB im Test-Stack
+POSTGRES_USER=postgres
+POSTGRES_PASSWORD=<eigenes, hex - ein "/" aus base64 zerlegt die DATABASE_URL>
+POSTGRES_DB=qrmaster_test
+# DATABASE_URL nicht setzen - Compose baut sie aus den drei Werten oben
+
+# Test-Keys / leer, siehe Falle 3
+STRIPE_SECRET_KEY=sk_test_…
+RESEND_API_KEY=
+```
+
+`NEXTAUTH_URL` darf hier auf testmodul zeigen - der einzige echte Leser ist die
+Social-Assets-Route, und die soll auf Test ohnehin nicht gegen die verifizierte TikTok-Domain
+laufen.
+
+## Infra
+
+**`docker-compose.test.yml`** als Override, das nur die Abweichungen setzt:
+
+- `container_name`: `qrmaster-test-db`, `qrmaster-test-redis`, `qrmaster-test-web` - die Namen
+  sind im Basis-File fest vergeben und würden sonst kollidieren
+- Host-Ports entfernen - `5435` (db) und `8080` (adminer) sind schon von Prod belegt
+- `entrypoint: ["node", "server.js"]` für `web`, siehe Migrationen oben
+- Build-Args für `COOKIE_DOMAIN`, `AUTH_COOKIE_NAME`, `NEXT_PUBLIC_*`
+
+### Netzwerk-Isolation (kritisch)
+
+`db` und `redis` hängen im Basis-File am Netzwerk `qrmaster-network`
+([docker-compose.yml:22](docker-compose.yml:22)), und das ist `external: true`, also für beide
+Stacks dasselbe. Compose vergibt jedem Service automatisch einen Netzwerk-Alias mit seinem
+Servicenamen - zwei Stacks mit einem Service `db` am selben Netzwerk heißt: **`db` löst auf
+zwei Container auf und Dockers DNS wählt zufällig.** Der Test-Container könnte damit auf der
+Produktionsdatenbank landen, nicht deterministisch, sondern mal so und mal so.
+
+Deshalb bekommt der Test-Stack ein eigenes internes Netzwerk. Nur `web` hängt zusätzlich am
+geteilten Netz, damit Caddy es erreicht:
+
+```yaml
+services:
+  db:
+    container_name: qrmaster-test-db
+    ports: !reset []
+    networks: [test-internal]
+  redis:
+    container_name: qrmaster-test-redis
+    networks: [test-internal]
+  web:
+    container_name: qrmaster-test-web
+    entrypoint: ["node", "server.js"]
+    networks: [test-internal, qrmaster-network]
+
+networks:
+  test-internal:
+    driver: bridge
+```
+
+`POSTGRES_DB` heißt auf Test `qrmaster_test`. Die Trennung kommt zwar schon vom eigenen
+Container und Volume, aber der abweichende Name macht bei einer von Hand getippten
+`psql`-Sitzung sofort sichtbar, auf welcher Instanz man ist - die billigste Versicherung
+gegen ein `DELETE` in der falschen Datenbank.
+
+Dafür muss der Healthcheck mitgezogen werden: das Basis-File hat `pg_isready -d qrmaster`
+hartkodiert ([Zeile 19](docker-compose.yml:19)). Ohne Override prüft er eine Datenbank, die
+es nicht gibt, der Container bleibt `unhealthy`, und `web` startet wegen
+`depends_on: condition: service_healthy` nie.
+
+Start:
+
+```bash
+docker compose -p qrmaster-test --env-file .env.test \
+  -f docker-compose.yml -f docker-compose.test.yml up -d --build
+```
+
+Der Projektname `-p qrmaster-test` gibt automatisch eigene Volumes - die Test-DB kann die
+Prod-DB also nicht anfassen.
+
+**Caddy:**
+
+```caddyfile
+testmodul.qrmaster.net {
+    reverse_proxy qrmaster-test-web:3000
+}
+```
+
+**`robots.ts`** an `NEXT_PUBLIC_INDEXABLE` koppeln. Aktuell liefert es hart `Allow` plus
+www-Sitemap; auf Test soll `Disallow: /` stehen. `NEXT_PUBLIC_INDEXABLE=false` setzt heute nur
+das Meta-Tag in den beiden Layouts, nicht die robots.txt.
+
+## Branch-Workflow
+
+```bash
+git checkout -b test master
+git push -u origin test
+```
+
+Deploy auf Test: auf dem Server `git checkout test && git pull`, dann der Compose-Befehl oben.
+Rebuild ist immer nötig, weil `NEXT_PUBLIC_*` und `AUTH_COOKIE_NAME` zur Build-Zeit inlined
+werden.
+
+Ablauf für ein Feature: Branch von `test` abzweigen → auf Test deployen und prüfen → nach
+`master` mergen → Prod-Deploy. `test` bleibt dauerhaft bestehen und wird regelmäßig von
+`master` nachgezogen, damit er nicht wegdriftet.
+
+## Datenbank - entschieden: leeres Schema
+
+Eigene PostgreSQL-Instanz im Test-Stack, befüllt mit **Struktur ohne Zeilen**. Keine
+Kundendaten verlassen die Produktion.
+
+```bash
+# Struktur aus Prod ziehen (keine Zeilen)
+docker exec qrmaster-db pg_dump -U postgres --schema-only qrmaster > schema.sql
+
+# in die Test-DB einspielen
+docker exec -i qrmaster-test-db psql -U postgres -d qrmaster_test < schema.sql
+```
+
+Danach einen Testaccount anlegen - entweder über das Signup-Formular auf testmodul oder per
+`INSERT`.
+
+**Warum der Dump aus Prod und nicht aus Prisma:** `prisma/migrations` steht auf April 2026.
+Alles seitdem (Pulse-Spalten, `BARCODE`-Enum-Wert, ...) kam per Hand-SQL. Die Produktions-DB
+ist damit die einzige Stelle, die die aktuelle Struktur kennt.
+
+**Warum leer statt Kopie:** beim Tweet-Bot willst du wissen, welcher Testfall den Tweet
+ausgelöst hat. Mit Prod-Daten könnte es auch irgendein echter Kunde von vor Monaten gewesen sein.
+
+### Keine Migrationen - der Entrypoint muss überschrieben werden
+
+[docker/entrypoint.sh:5](docker/entrypoint.sh:5) führt bei **jedem** Container-Start
+`npx prisma migrate deploy` aus. Das widerspricht der Policy aus CLAUDE.md (Schema-Änderungen
+nur per Hand-SQL) und würde auf einer frischen Test-DB die 6 veralteten Migrationen anwenden -
+also ein Schema vom Stand April 2026 bauen, dem alle späteren SQL-Änderungen fehlen. Die App
+liefe dann in "column does not exist".
+
+Im Test-Override deshalb:
+
+```yaml
+web:
+  entrypoint: ["node", "server.js"]
+```
+
+Prod bleibt unverändert. Der Schema-Dump bringt die Tabelle `_prisma_migrations` ohnehin mit,
+inklusive der 6 als angewandt markierten Einträge - der Zustand ist also identisch zu Prod.
+
+**Separat zu klären (nicht Teil dieses Plans):** ob `prisma migrate deploy` langfristig auch
+aus dem Prod-Entrypoint verschwinden soll. Heute ist es dort ein No-Op, aber es ist eine
+scharfe Waffe, die bei einem versehentlich hinzugefügten Migrationsfile auf die Produktion
+losgeht.
+
+### Spätere Schema-Änderungen
+
+Ein SQL-Statement, das auf Test getestet wurde, wird auf Prod **erneut von Hand** ausgeführt -
+es gibt keinen automatischen Weg von Test nach Prod. Die Dateien in `sql/` sind der Ort dafür.
+
+## Aufwand
+
+| | |
+|---|---|
+| Cookie-Name verkabeln (6 Stellen) + Dockerfile/Compose | ~1 h |
+| `docker-compose.test.yml` + `robots.ts` an INDEXABLE koppeln | ~1 h |
+| `.env.test`, Secrets, Test-Keys besorgen | Timo |
+| Caddy-Block + erster Deploy | ~30 min |
+| DB-Variante B zusätzlich | +2-3 h für das Anonymisierungs-Skript |
+
+Der Twitter-Bot selbst ist davon unabhängig und noch nicht geschätzt.
+
+## Testcheckliste nach dem ersten Test-Deploy
+
+- [ ] `testmodul.qrmaster.net` lädt, gültiges Zertifikat
+- [ ] `testmodul.qrmaster.net/dashboard` bleibt **auf testmodul** und springt nicht nach app.qrmaster.net
+- [ ] Login auf Test funktioniert, während man in Prod eingeloggt ist - beide Sessions unabhängig
+- [ ] Logout auf Test loggt **nicht** aus Prod aus (und umgekehrt)
+- [ ] Im Browser liegen zwei Cookies: `userId` (Domain `.qrmaster.net`) und `userId_test` (Host `testmodul.qrmaster.net`)
+- [ ] `curl -sI https://testmodul.qrmaster.net` → kein `X-Robots-Tag` nötig, aber `/robots.txt` liefert `Disallow: /`
+- [ ] Test-DB enthält **keine** echten Kunden: `SELECT count(*) FROM "User";` muss die Zahl der selbst angelegten Testaccounts sein
+- [ ] `docker compose -p qrmaster-test exec web env | grep DATABASE_URL` zeigt auf den Test-Container, und `SELECT count(*)` dort weicht von Prod ab - beweist, dass der `db`-Alias nicht auf Prod zeigt
+- [ ] Container-Logs beim Start enthalten **kein** "Applying Prisma migrations"
+- [ ] Ein Testlauf des Bots postet nichts auf dem echten Account
--- a/PLAN_bulk_dynamic_and_barcode_.md
+++ b/PLAN_bulk_dynamic_and_barcode_.md
@@ -0,0 +1,179 @@
+# Feature Plan: Bulk Dynamic QR + Dynamic Barcode Generator
+
+## Feature 1: Bulk Generator → Dynamic QR freischalten
+
+### Ziel
+Nutzer können beim Bulk-Import wählen ob sie statische oder dynamische QR-Codes erstellen. Dynamisch = DB-Einträge mit Slugs + Tracking. Nur für PRO/BUSINESS.
+
+### Aktueller Stand (Ist)
+- `bulk-creation/page.tsx` generiert QR-Codes rein client-seitig (kein DB-Eintrag)
+- `generateStaticQRCodes()` rendert SVGs lokal via `qrcode`-Library
+- `saveQRCodesToDatabase()` sendet an `POST /api/qrs` mit `isStatic: true` — also immer statisch
+- Kein Toggle Static/Dynamic vorhanden
+- Kein Plan-Check für Dynamic im Bulk-Flow
+
+### Änderungen
+
+#### A) Frontend: `bulk-creation/page.tsx`
+
+1. **Toggle "Static / Dynamic" hinzufügen** (nach Plan-Check)
+   - Nur sichtbar/aktivierbar wenn `userPlan === 'PRO' || 'BUSINESS'`
+   - FREE-Nutzer sehen den Toggle gesperrt mit Upgrade-Hinweis
+   - State: `const [isDynamic, setIsDynamic] = useState(false)`
+
+2. **Interface erweitern**
+   ```ts
+   interface GeneratedQR {
+     title: string;
+     content: string;
+     svg: string;
+     slug?: string;       // nur bei dynamic, nach API-Antwort gesetzt
+     redirectUrl?: string; // z.B. https://qrmaster.net/r/abc123
+   }
+   ```
+
+3. **Generierungslogik aufteilen**
+   - Static (wie bisher): client-seitig SVG generieren, kein DB-Eintrag nötig
+   - Dynamic: direkt `POST /api/qrs` pro Eintrag mit `isDynamic: true` → API gibt Slug zurück → QR encodiert `/r/[slug]` statt Original-URL
+
+4. **Preview-Spalte erweitern**
+   - Bei dynamic: Slug-Link anzeigen + "Ziel änderbar" Badge
+   - Download-ZIP enthält QR-SVGs die `/r/[slug]` encodieren
+
+5. **Limit-Anzeige**
+   - PRO: max 50 dynamic / Bulk-Run (entspricht QR-Limit)
+   - BUSINESS: max 500
+
+#### B) Backend: `POST /api/qrs`
+
+Keine strukturelle Änderung nötig — der bestehende Endpunkt unterstützt bereits `isDynamic: false/true` und gibt `slug` zurück. Nur sicherstellen:
+
+- Plan-Limit-Check zählt korrekt bei Bulk-Erstellung (momentan prüft `POST /api/qrs` nur ob Gesamtanzahl < Limit — das bleibt so, aber Bulk erstellt X Requests nacheinander → ggf. Rate-Limit beachten)
+- Evtl. neuen Endpunkt `POST /api/qrs/bulk` der ein Array entgegennimmt und in einer DB-Transaktion schreibt (besser als 500 Einzelrequests)
+
+#### C) Optionaler neuer Endpunkt: `POST /api/qrs/bulk` (empfohlen)
+
+```ts
+// Body: { qrCodes: Array<{ title, content, contentType, isDynamic }>, plan }
+// Response: { created: Array<{ id, slug, redirectUrl }>, failed: number }
+// Vorteile: eine DB-Transaktion, ein CSRF-Check, schneller
+```
+
+Plan-Check: `if (isDynamic && plan === 'FREE') return 403`
+
+---
+
+### Reihenfolge der Umsetzung
+
+1. Toggle + Plan-Check im Frontend
+2. Dynamic-Generierungslogik (nutzt bestehenden `POST /api/qrs`)
+3. (Optional) `POST /api/qrs/bulk` für Performance
+4. ZIP-Download mit Redirect-URLs als Metadaten-CSV
+
+---
+
+## Feature 2: Dynamischer Barcode Generator
+
+### Aufteilung: Landingpage (Marketing) + Dashboard (Funktion)
+
+**Wichtig:** "Dynamic" existiert nur im Dashboard `/create`. Die Landingpage erklärt das Konzept und treibt Nutzer zum Signup/Login — sie hat keinen eigenen Dynamic-Modus.
+
+---
+
+### 2a) Landingpage: `/tools/dynamic-barcode-generator`
+
+**Ziel:** SEO-Traffic auf Keyword "barcode generator" (100k–1M, 0% Competition) konvertieren zu Signups.
+
+**Was die Landingpage NICHT hat:**
+- Keinen Dynamic-Toggle
+- Keine echte Dynamic-Funktionalität
+
+**Was die Landingpage HAT:**
+- Bestehenden `BarcodeGeneratorClient` eingebettet (statischer Generator, unverändert)
+- Erklärung was ein dynamischer Barcode ist + Vorteile
+- Klarer CTA: "Create Dynamic Barcode → Sign up / Dashboard"
+
+**Aufbau** (`src/app/(main)/(marketing)/tools/dynamic-barcode-generator/page.tsx`):
+
+```
+Hero-Section
+  H1: "Dynamic Barcode Generator — Update Any Barcode Without Reprinting"
+  Subtext: Erklärt Tracking + Redirect-Konzept
+  CTA-Button: "Create Dynamic Barcode" → /login oder /signup
+
+Tool-Section
+  BarcodeGeneratorClient (statisch, wie bisher, keine Änderungen)
+  Banner darunter: "Want dynamic barcodes? Sign up free →"
+
+How It Works (3 Schritte)
+  1. Sign up & create barcode in dashboard
+  2. Print it once
+  3. Update the destination anytime — no reprint needed
+
+Use Cases
+  Retail-Verpackungen, Logistik-Labels, Produktkataloge, Event-Badges
+
+FAQ-Section (schema.org FAQ markup)
+  - "Was ist ein dynamischer Barcode?"
+  - "Wie unterscheidet sich dynamisch von statisch?"
+  - "Welche Formate werden unterstützt?"
+
+RelatedTools-Komponente (bereits vorhanden)
+```
+
+**Metadata:**
+```ts
+title: 'Dynamic Barcode Generator — Trackable & Editable Barcodes'
+description: 'Create dynamic barcodes that you can update without reprinting. Track scans, change destinations, and manage all barcodes from one dashboard.'
+canonical: 'https://www.qrmaster.net/tools/dynamic-barcode-generator'
+keywords: ['dynamic barcode generator', 'barcode generator', 'trackable barcode', 'editable barcode']
+```
+
+**Sitemap:** `/tools/dynamic-barcode-generator` hinzufügen.
+
+---
+
+### 2b) Dashboard `/create` — BARCODE als ContentType
+
+**Ziel:** Eingeloggte Nutzer können Barcodes (statisch oder dynamisch) im Dashboard erstellen, speichern und tracken.
+
+**DB-Änderung (kein migrate!):**
+```sql
+-- Direkt gegen PostgreSQL ausführen (npm run docker:db)
+ALTER TYPE "ContentType" ADD VALUE 'BARCODE';
+```
+Danach: `npx prisma generate`
+
+**Änderungen `create/page.tsx`:**
+- BARCODE zu `contentTypes` Array hinzufügen
+- `renderContentFields()` Case: Barcode-Wert + Format-Picker (CODE128, EAN13, UPC, etc.)
+- Preview: `react-barcode` statt `QRCodeSVG` wenn ContentType === BARCODE
+- QR-spezifische Optionen ausblenden bei BARCODE (Frames, Logo, Corner Style)
+- Dynamic Barcode = encodiert `/r/[slug]` → nutzt bestehendes Redirect- + Tracking-System
+- Static Barcode = encodiert Rohwert direkt
+
+**Kein neues Backend nötig** — `POST /api/qrs` + `/r/[slug]`-Redirect funktionieren bereits.
+
+---
+
+### Reihenfolge der Umsetzung
+
+**Phase 1 — Landingpage (kein DB-Change):**
+1. `page.tsx` unter `/tools/dynamic-barcode-generator` erstellen
+2. Sitemap-Eintrag
+
+**Phase 2 — Dashboard BARCODE:**
+1. SQL ausführen: `ALTER TYPE "ContentType" ADD VALUE 'BARCODE'`
+2. `npx prisma generate`
+3. `create/page.tsx` erweitern
+
+---
+
+## Abhängigkeiten zwischen den Features
+
+| Feature | Hängt ab von |
+|---------|-------------|
+| Bulk Dynamic | Bestehendem `POST /api/qrs` (bereits fertig) |
+| Bulk Dynamic (optional) | Neuem `POST /api/qrs/bulk` Endpunkt |
+| Landingpage Dynamic Barcode | Bestehendem BarcodeGeneratorClient (keine Änderungen) |
+| Dashboard BARCODE | SQL-Enum-Erweiterung + `prisma generate` |
--- a/PRODUCT.md
+++ b/PRODUCT.md
@@ -0,0 +1,51 @@
+# Product
+
+## Register
+
+brand
+
+## Users
+
+Two primary personas, both aesthetically-driven professionals who have outgrown generic tools:
+
+**Marketing / Agency Lead** — manages multiple client campaigns simultaneously. Needs organized folders, detailed analytics, and design output that doesn't betray itself as "internet freeware." They evaluate tools by how their outputs look to clients, not just how the tool works internally.
+
+**Modern Restaurateur** — owner of a boutique restaurant, cafe, or hotel. Their physical space is carefully designed; their digital touchpoints must match. They rely on Dynamic QR codes to swap menu PDFs and URLs seasonally without reprinting expensive acrylic table stands. Brand consistency between print and digital is non-negotiable for them.
+
+**Arrival context:** Both land on QR Master after being burned by "free" tools that expired, injected third-party ads, or looked visually cheap. They are actively comparing options and arrive skeptical. They're not discovering QR tools for the first time — they're looking for a permanent, professional home.
+
+## Product Purpose
+
+QR Master is a precision QR code platform — creation, dynamic editing, and analytics — for professionals who refuse to compromise on aesthetics. Success means users choose QR Master not because they have to, but because they want to: the tool itself feels like an extension of their creative workflow, not a clunky utility they tolerate.
+
+## Brand Personality
+
+**Confident, Minimal, Crafted.**
+
+"The Leica of QR Generators." A precision instrument that earns trust through intentionality, not decoration. Every pixel deliberate. Think Linear's pro-tool clarity, Raycast's utilitarian beauty, Framer's implied creative freedom — combined into something that feels high-performance without performing.
+
+Tone of voice: direct and assured. No hedging, no exclamation points for emphasis, no "Amazing!" copy. Let the product speak. Copy is short, specific, and treats the user as a professional.
+
+## Anti-references
+
+- **SEO ad farms** (QR-Code-Generator.com style): cluttered sidebars, aggressive upsell banners, walls of keyword-stuffed text. The opposite of QR Master.
+- **Bubbly link-in-bio tools**: neon gradients, Gen-Z playfulness, the Linktree aesthetic. QR Master is for businesses, not social profiles.
+- **Legacy enterprise software**: cold gray, mechanical, joyless. High-end is not the same as corporate. QR Master should feel premium, not bureaucratic.
+
+## Design Principles
+
+1. **Precision over decoration.** Every element earns its place. No UX furniture — no gratuitous dividers, decorative gradients, or filler icons. If removing it doesn't hurt, remove it.
+
+2. **Show, don't explain.** The product's quality is demonstrated by how the interface looks and behaves, not described in marketing copy. A beautifully rendered QR preview communicates more than three bullet points about "custom branding."
+
+3. **Premium through restraint.** Sophistication comes from what's removed. More whitespace, fewer words, tighter hierarchy. The instinct to add is the enemy of craft.
+
+4. **Trustworthy at a glance.** Clarity and professionalism must be instantaneous — users arriving skeptical decide in 5 seconds. No clever puzzles, no mystery-meat navigation. Confidence is expressed through legibility.
+
+5. **Tool-like beauty.** Functional elegance, like a well-made physical instrument. Interactions should feel responsive and precise. Animations are subtle cues, not performances. The UI should feel fast even when it isn't.
+
+## Accessibility & Inclusion
+
+- **Standard**: WCAG 2.1 AA
+- **Reduced motion**: Full `prefers-reduced-motion` support. Animations (where used) default to subtle fades or scale shifts; no motion for motion's sake.
+- **Color contrast**: Critical for a QR creation tool. The dashboard must warn users when foreground/background color combinations produce insufficient contrast — both for readability and QR scannability. This is a functional requirement, not a nice-to-have.
--- a/QR-Master-Analysis-April-2026.md
+++ b/QR-Master-Analysis-April-2026.md
@@ -0,0 +1,249 @@
+# QR Master — Deep Analysis & Growth Potential
+**Date:** April 1, 2026 | **Project Age:** 3 months (launched Jan 1, 2026)
+
+---
+
+## Executive Summary
+
+QR Master is a young but well-built QR code SaaS entering a **$1–7B market growing at 16%+ CAGR**. After just 3 months, the numbers tell an interesting story: explosive impression growth in Google Search (0 → 4,100/month), strong AI citation momentum (1,849 citations across 11 pages), and 169 unique visitors in the last 90 days with promising engagement metrics (8m 36s avg session, 16% bounce rate). However, organic search clicks remain very low, and there are zero paying customers visible yet. The opportunity is real, but execution over the next 6 months will determine everything.
+
+---
+
+## 1. Your Numbers — What They Tell Me
+
+### Google Search Console (Jan–Mar 2026)
+
+| Metric | January | February | March | Growth |
+|--------|---------|----------|-------|--------|
+| Impressions | 158 | 44 | 4,115 | **+2,504%** |
+| Clicks | 0 | 0 | 23 | From zero |
+| Avg Position | ~1.3 | ~3.3 | ~68.4 | Widened (more keywords) |
+
+**What this means:** Google discovered your site in late January, but the real indexing explosion happened in March. The jump from 44 impressions in February to 4,115 in March is dramatic — this is the "Google sandbox" lifting. The average position being ~68 means most of your keywords are on pages 6–7 of Google. That's normal for a 3-month-old domain, but it also means you're not getting meaningful organic traffic yet from competitive terms.
+
+**Top performing pages by impressions:**
+
+| Page | Impressions | Clicks | Avg Position |
+|------|-------------|--------|-------------|
+| Homepage | 356 | 15 | 4.0 |
+| Barcode Generator | 1,160 | 4 | 71.4 |
+| Dynamic QR Code Generator | 536 | 0 | 81.1 |
+| Restaurant Menu QR Blog | 425 | 0 | 80.9 |
+| Geolocation QR Code | 281 | 0 | 73.2 |
+| URL QR Code | 205 | 0 | 83.6 |
+| Twitter QR Code | 169 | 0 | 71.3 |
+
+**Key insight:** Your barcode generator page has 1,160 impressions but only 4 clicks because it's ranking at position 71. If you can move that to page 1, even position 8–10, you'd capture 20–50 clicks/day from that keyword cluster alone. Same story for "dynamic QR code generator" (536 impressions, position 81).
+
+### AI Citations (Google AI Overviews)
+
+| Week | Citations | Avg/Day | Trend |
+|------|-----------|---------|-------|
+| Week 9 (late Feb) | 123 | 30.8 | Baseline |
+| Week 10 | 328 | 46.9 | +167% |
+| Week 11 | 343 | 49.0 | +5% |
+| Week 12 | 514 | 73.4 | +50% |
+| Week 13 | 541 | 77.3 | +5% |
+
+**Total: 1,849 citations across up to 11 unique pages.**
+
+This is genuinely impressive for a 3-month-old site. AI citations at 77/day means Google's AI is actively referencing your content when answering QR-related queries. This is a leading indicator — AI citations often precede organic ranking improvements. You're building topical authority faster than traditional SEO alone would deliver.
+
+### PostHog Analytics (Last 90 Days)
+
+| Metric | Value | Assessment |
+|--------|-------|-----------|
+| Unique Visitors | 169 | Low, but expected for 3 months |
+| Page Views | 2,120 | ~12.5 pages/visitor — very high engagement |
+| Sessions | 417 | 2.5 sessions/visitor average |
+| Session Duration | 8m 36s | Excellent — users are exploring deeply |
+| Bounce Rate | 16% | Outstanding (industry avg is 40-60%) |
+
+**Traffic sources:**
+
+| Channel | Visitors | Views |
+|---------|----------|-------|
+| Referral | 100 | 803 |
+| Organic Social | 64 | 89 |
+| Direct | 17 | 1,123 |
+| Organic Search | 6 | 70 |
+
+**Critical insight:** Your 16% bounce rate and 8.5-minute session duration are exceptional. People who find your site actually use it. The problem isn't product quality — it's distribution. Only 6 visitors from organic search in 90 days confirms you're still in the early SEO growth phase.
+
+**Retention concern:** The cohort data shows near-zero retention after week 1 for most cohorts. This is the biggest red flag — users come, try the tool, but don't come back. This is typical for free QR generator users, but it means conversion to paid will depend heavily on capturing value during that first session.
+
+---
+
+## 2. Competitive Landscape
+
+### The Market You're Entering
+
+The QR code generator market is valued at **$1.1–6.8B in 2025** (estimates vary by definition) and growing at **16–17% CAGR**. Dynamic QR codes specifically are the revenue driver, accounting for 55-64% of market value.
+
+### Key Competitors
+
+| Company | Est. Revenue (2025) | Pricing | Key Strength |
+|---------|-------------------|---------|-------------|
+| **Flowcode** | $15.7M | Free / $5-25/mo | VC-backed, design-focused, landing pages |
+| **Bitly** | $200M+ (link shortening + QR) | $8–199/mo | Brand recognition, link ecosystem |
+| **Uniqode** (fka Beaconstac) | ~$10M est. | $5–99/mo | Enterprise (SOC2, HIPAA, ISO) |
+| **QR Tiger** | ~$5M est. | $7–37/mo | SEO-aggressive, content marketing |
+| **Trycon/Scanova** | $7.2M | $5–49/mo | 2,000+ businesses, enterprise |
+| **Mobilo** | $5.4M | $4.99–14.99/mo | Digital business cards focus |
+| **Unitag** | $2.3M | Free / $9.90+/mo | European market, design tools |
+| **QR Code Creator** | $1.5M | $4.99–14.99/mo | Long-established (since 2009) |
+| **QRCode Monkey** | Unknown | Free (ad-supported) | SEO dominant, free tools |
+
+### What This Means for QR Master
+
+The market has room. Even QR Code Creator, which has been around since 2009, only does $1.5M. The winner-take-all dynamics of pure SaaS don't apply as strongly here because QR codes are a utility — businesses often try 2-3 tools before settling. Key entry angles that still work: niche verticals (restaurants, real estate), better free tier to build SEO traffic, and superior analytics.
+
+---
+
+## 3. SEO Assessment
+
+### Current State: Early but Promising
+
+Your site is showing 700+ unique keywords with impressions — that's a lot of keyword surface area for a 3-month-old site. But almost all rankings are on pages 5-10 of Google (positions 50-100).
+
+### Biggest Keyword Opportunities (High Impression, Improvable Position)
+
+| Keyword | Monthly Impressions | Current Position | Difficulty |
+|---------|-------------------|-----------------|-----------|
+| barcode generator | 148+ | 74.8 | Very High |
+| dynamic qr code | 115+ | 80.3 | High |
+| dynamic qr code generator | 81+ | 85.8 | High |
+| restaurant qr code | 51+ | 75.0 | Medium |
+| qr code restaurant menu | 48+ | 82.8 | Medium |
+| twitter qr code | 46+ | 76.7 | Low-Medium |
+| instagram qr code generator | 35+ | 54.9 | Medium |
+| bulk qr code generator | 28+ | 94.4 | Medium |
+| vcard qr code generator | 9+ | 74.9 | Low-Medium |
+| teams qr code | 3+ | 34.7 | Low |
+
+### Quick Wins (Already Close to Page 1)
+
+- **"teams qr code"** — Position 34.7 with dedicated tool page already built. You already have traffic to this page (20 visitors in PostHog). Push this to page 1.
+- **"zoom qr code"** — Position 40.3. Similar opportunity.
+- **"qrmaster"** branded terms — Position 4.3 (already strong, but should be #1)
+- **"qr master"** — Position 8.1. Should be #1 for your own brand.
+
+### What's Holding You Back
+
+1. **Domain age (3 months):** Google inherently trusts older domains more. This improves automatically with time.
+2. **Backlink profile:** Likely thin. Your referral traffic (100 visitors) suggests some links, but you need more authoritative ones.
+3. **Competition on head terms:** "QR code generator" is dominated by Bitly, QRCode Monkey, QR Tiger with DA 50+ domains. You won't rank for this soon.
+4. **Content depth vs. competitors:** QR Tiger and Uniqode have 100+ blog posts each. You're early in content production.
+
+---
+
+## 4. Revenue Potential — Realistic Projections
+
+### Assumptions
+
+Based on your current pricing model (FREE / PRO / BUSINESS tiers) and market benchmarks:
+
+- **Free-to-paid conversion rate for QR tools:** 2-4% (industry benchmark)
+- **Average revenue per user (ARPU):** $10-20/month for SMB QR tools
+- **Churn rate:** 5-8% monthly for SMB SaaS
+
+### Scenario Modeling
+
+#### Conservative (SEO-only growth, no paid acquisition)
+
+| Month | Monthly Visitors | Signups (15% CVR) | Paying Users (cum.) | MRR |
+|-------|-----------------|-------------------|--------------------|----|
+| Month 3 (now) | 170 | 39 | 0 | $0 |
+| Month 6 | 1,000 | 150 | 8 | $120 |
+| Month 12 | 5,000 | 750 | 60 | $900 |
+| Month 18 | 15,000 | 2,250 | 200 | $3,000 |
+| Month 24 | 40,000 | 6,000 | 500 | $7,500 |
+
+**Year 1 ARR: ~$10,800 | Year 2 ARR: ~$90,000**
+
+#### Moderate (SEO + content marketing + some link building)
+
+| Month | Monthly Visitors | Signups | Paying Users (cum.) | MRR |
+|-------|-----------------|---------|--------------------|----|
+| Month 6 | 3,000 | 450 | 25 | $375 |
+| Month 12 | 15,000 | 2,250 | 180 | $2,700 |
+| Month 18 | 40,000 | 6,000 | 500 | $7,500 |
+| Month 24 | 80,000 | 12,000 | 1,200 | $18,000 |
+
+**Year 1 ARR: ~$32,400 | Year 2 ARR: ~$216,000**
+
+#### Aggressive (SEO + paid + partnerships + viral loops)
+
+| Month | Monthly Visitors | Signups | Paying Users (cum.) | MRR |
+|-------|-----------------|---------|--------------------|----|
+| Month 12 | 50,000 | 7,500 | 600 | $9,000 |
+| Month 24 | 200,000 | 30,000 | 3,000 | $45,000 |
+
+**Year 2 ARR: ~$540,000**
+
+### Revenue Benchmarks from Comparable Companies
+
+- QR Code Creator (17 years old): **$1.5M/year**
+- Unitag (10+ years old): **$2.3M/year**
+- Flowcode (7 years, VC-backed): **$15.7M/year**
+- Indie SaaS benchmarks: $5K–25K MRR is very achievable within 18-24 months with focused execution
+
+---
+
+## 5. Strengths & Risks
+
+### What's Working
+
+1. **Product quality is high.** 8.5-minute sessions, 16% bounce rate, 12.5 pages/visitor — these are remarkable engagement metrics. The product holds attention.
+2. **AI citations growing fast.** 77 citations/day after 3 months is a strong signal Google's AI trusts your content.
+3. **Broad keyword footprint.** 700+ keywords showing impressions means Google is indexing and considering your pages for a wide range of queries.
+4. **Niche tool pages (Teams, Zoom, WiFi, Instagram).** These long-tail pages are your fastest path to page 1 rankings.
+5. **Technical foundation is solid.** Next.js 14, Stripe, analytics, dynamic QR codes — the infrastructure is already at a paid-product level.
+
+### Risks & Concerns
+
+1. **Near-zero retention.** Cohort data shows almost no users returning after week 1. Without solving retention, paid conversion will be extremely difficult.
+2. **No revenue yet.** 3 months with 0 MRR is normal, but the clock is ticking. Need to see first paying user by month 4-5.
+3. **Competitive head terms are years away.** You won't rank for "QR code generator" anytime soon. The long-tail strategy is correct but requires patience.
+4. **Single-channel dependency.** Currently SEO-reliant. If Google changes its algorithm or sandbox behavior, growth stalls.
+5. **service_account.json in root.** If this is a live credential, it's a security risk. Remove from version control immediately.
+
+---
+
+## 6. Recommendations — Next 90 Days
+
+### Immediate (This Month)
+
+1. **Fix retention first.** Add email capture on first QR creation, build a "My QR Codes" dashboard value prop, and implement a follow-up email sequence showing scan analytics. Users need a reason to come back.
+2. **Push "quick win" keywords to page 1.** Teams QR code (pos 34), Zoom QR code (pos 40), and your branded terms. These need targeted backlinks and content optimization.
+3. **Add pricing friction at the right moment.** If you're not gating anything, users have no reason to pay. Consider limiting dynamic QR codes to 1-3 on free tier, then upsell.
+
+### Short-term (Months 4-6)
+
+4. **Build 10-15 high-quality backlinks.** Guest posts on marketing blogs, HARO/Connectively responses, tool directories. Domain authority is your bottleneck.
+5. **Double down on restaurant/menu niche.** You have 425 impressions on the restaurant menu QR blog. This is a vertical where local businesses actually pay for QR tools. Build a dedicated landing page.
+6. **Launch on Product Hunt, Indie Hackers, and relevant subreddits.** Free exposure that also builds backlinks.
+
+### Medium-term (Months 6-12)
+
+7. **Expand content to 50+ blog posts.** Target every long-tail QR keyword cluster. QR Tiger's content machine is the model to emulate.
+8. **Add a freemium viral loop.** "Powered by QR Master" branding on free QR codes (with option to remove on paid plan).
+9. **Consider German market positioning.** Your GSC data shows German-language queries (dynamische QR codes, etc.) and you appear to be German-speaking. The German QR code market is underserved compared to English.
+
+---
+
+## 7. Bottom Line
+
+**Is there real potential here?** Yes, absolutely. The QR code market is large, growing, and the barrier to entry is manageable with good technical execution — which you clearly have. Companies doing $1.5M–$15M in this space prove the model works.
+
+**How much can you realistically make?** With sustained effort, **$3K–$10K MRR by month 18** is realistic under a moderate growth scenario. That's $36K–$120K ARR — meaningful side-project revenue. The top end of $200K+ ARR is achievable within 24 months if you invest in content, backlinks, and conversion optimization.
+
+**What's the biggest risk?** Not retention, not competition — it's giving up too early. SEO-driven SaaS is a compounding game. Months 1-6 feel slow because organic traffic takes time to build. The hockey stick starts around months 9-12 when domain authority compounds with content volume. QR Code Creator took 17 years to hit $1.5M, but the market was 10x smaller then.
+
+**Your 3-month scorecard: B+.** Excellent product, strong engagement, growing search visibility. The missing pieces are retention mechanics, first revenue, and backlink authority. All fixable.
+
+---
+
+*Analysis based on Google Search Console data (Jan–Mar 2026), PostHog analytics (90 days), Google AI Performance data, and market research as of April 2026.*
+
+*Sources: [Mordor Intelligence QR Market Report](https://www.mordorintelligence.com/industry-reports/qr-codes-market), [GetLatka QR SaaS Companies](https://getlatka.com/companies/industries/i-qr-code-generator-software), [Bitly QR Code Statistics](https://bitly.com/blog/qr-code-statistics/), [360iResearch QR Market](https://www.360iresearch.com/library/intelligence/qr-code-generator), [QR Code Chimp Statistics](https://www.qrcodechimp.com/qr-code-statistics/)*
--- a/README.md
+++ b/README.md
@@ -1,475 +1,482 @@
-# QR Master - Create Custom QR Codes in Seconds
-
-A production-ready SaaS application for creating and managing QR codes with advanced tracking, analytics, and Stripe payment integration.
-
-## Features
-
- 🎨 **Custom QR Codes** - Create static and dynamic QR codes with full customization
- 📊 **Advanced Analytics** - Track scans, locations, devices, and user behavior
- 🔄 **Dynamic Content** - Edit QR code destinations anytime without reprinting
- 📦 **Bulk Operations** - Import CSV/Excel files to create up to 1,000 QR codes at once
- 💳 **Stripe Integration** - FREE, PRO, and BUSINESS subscription plans with secure billing
- 🎨 **Custom Branding** - Logo upload, custom colors (PRO+ plans)
- 🌍 **SEO Optimized** - Schema.org structured data, meta tags, breadcrumbs
- 🔒 **Privacy-First** - GDPR-compliant, hashed IPs, DNT headers respected
- 📱 **Responsive Design** - Works perfectly on all devices
-
-## Tech Stack
-
- **Frontend**: Next.js 14 (App Router), TypeScript, Tailwind CSS
- **Backend**: Next.js API Routes, Prisma ORM
- **Database**: PostgreSQL (with Prisma migrations)
- **Cache**: Redis (optional)
- **Auth**: NextAuth.js (Credentials + Google OAuth)
- **Payments**: Stripe (Subscriptions & Webhooks)
- **QR Generation**: qrcode library
- **Bulk Processing**: Papa Parse (CSV), XLSX, JSZip
- **Analytics**: PostHog (optional)
- **SEO**: next-sitemap, Schema.org structured data
-
-## Quick Start
-
-### Prerequisites
-
- Node.js 18+
- Docker and Docker Compose V2
- Git
-
-### Installation
-
-#### Option 1: Development Mode (Recommended)
-
-Run database in Docker, app on host machine:
-
-1. Clone the repository:
-
-```bash
-git clone https://github.com/yourusername/qr-master.git
-cd qr-master
-```
-
-2. Install dependencies:
-
-```bash
-npm install
-```
-
-3. Copy and configure environment:
-
-```bash
-cp env.example .env
-```
-
-Edit `.env` and set:
-
- `NEXTAUTH_SECRET` (generate: `openssl rand -base64 32`)
- `IP_SALT` (generate: `openssl rand -base64 32`)
- (Optional) Google OAuth credentials
-
-4. Start database services:
-
-```bash
-npm run docker:dev
-```
-
-5. Run database migrations and seed:
-
-```bash
-npx prisma migrate dev
-npm run db:seed
-```
-
-> **Note**: If you get migration errors, you can reset the database:
->
-> ```bash
-> npx prisma migrate reset
-> ```
->
-> This will drop the database, recreate it, run all migrations, and seed data.
-
-6. Start development server:
-
-```bash
-npm run dev
-```
-
-7. Access the application:
-   - **App**: http://localhost:3050
-   - **Database UI**: http://localhost:8080 (Adminer - username: `root`, password: `root`)
-   - **Database**: localhost:5435 (username: `postgres`, password: `postgres`)
-   - **Redis**: localhost:6379
-
-#### Option 2: Full Docker (Production)
-
-Run everything in Docker:
-
-1. Clone and setup:
-
-```bash
-git clone https://github.com/yourusername/qr-master.git
-cd qr-master
-cp env.example .env
-# Edit .env with your configuration
-```
-
-2. Build and start:
-
-```bash
-npm run docker:prod
-```
-
-3. Run migrations:
-
-```bash
-docker-compose exec web npx prisma migrate deploy
-```
-
-4. Access at http://localhost:3050
-
-📚 **For detailed Docker setup, see [DOCKER_SETUP.md](DOCKER_SETUP.md)**
-
-## Demo Account
-
-After running `npm run db:seed`, use these credentials to test the application:
-
- **Email**: demo@qrmaster.com
- **Password**: demo123
- **Plan**: FREE (3 QR codes limit)
-
-The seed script also creates sample QR codes for testing.
-
-## Development
-
-### Available Scripts
-
-```bash
-# Development
-npm run dev                    # Start Next.js dev server (port 3050)
-npm run build                  # Build for production
-npm run start                  # Start production server
-
-# Database
-npm run db:generate            # Generate Prisma Client
-npm run db:migrate             # Run migrations (dev mode)
-npm run db:deploy              # Deploy migrations (production)
-npm run db:seed                # Seed database with demo data
-npm run db:studio              # Open Prisma Studio UI
-npx prisma migrate reset       # Reset database (drop, recreate, migrate, seed)
-
-# Docker
-npm run docker:dev             # Start DB & Redis only
-npm run docker:dev:stop        # Stop dev services
-npm run docker:dev:clean       # Stop and clean containers
-npm run docker:prod            # Start full stack (production)
-npm run docker:stop            # Stop all services
-npm run docker:logs            # View container logs
-npm run docker:db              # PostgreSQL CLI
-npm run docker:redis           # Redis CLI
-npm run docker:backup          # Backup database to SQL file
-```
-
-### Local Development (without Docker)
-
-1. Install dependencies:
-
-```bash
-npm install
-```
-
-2. Set up PostgreSQL and Redis locally
-
-3. Configure `.env` with local database URL:
-
-```env
-DATABASE_URL=postgresql://postgres:postgres@localhost:5435/qrmaster?schema=public
-```
-
-4. Run migrations and seed:
-
-```bash
-npx prisma migrate dev
-npm run db:seed
-```
-
-5. Start dev server:
-
-```bash
-npm run dev
-```
-
-### Resetting the Database
-
-If you need to reset your database (drop all tables, recreate, and reseed):
-
-```bash
-# Full reset (drops database, reruns migrations, seeds data)
-npx prisma migrate reset
-
-# Or manually:
-npx prisma migrate reset --skip-seed  # Reset without seeding
-npm run db:seed                        # Then seed manually
-```
-
-This is useful when:
-
- Schema has changed significantly
- You have migration conflicts
- You want to start fresh with clean data
-
-### Project Structure
-
-```
-qr-master/
-├── src/
-│   ├── app/                    # Next.js app router pages
-│   ├── components/             # React components
-│   ├── lib/                   # Utility functions and configurations
-│   ├── hooks/                 # Custom React hooks
-│   ├── styles/                # Global styles
-│   └── i18n/                  # Translation files
-├── prisma/                    # Database schema and migrations
-├── docker/                    # Docker initialization scripts
-│   ├── init-db.sh            # PostgreSQL initialization
-│   └── README.md             # Docker documentation
-├── public/                    # Static assets
-├── docker-compose.yml         # Production Docker setup
-├── docker-compose.dev.yml     # Development Docker setup
-├── Dockerfile                # Container definition
-├── DOCKER_SETUP.md           # Complete Docker guide
-└── env.example               # Environment template
-```
-
-## API Endpoints
-
-### Authentication
-
- `POST /api/auth/signin` - Sign in with credentials
- `POST /api/auth/signout` - Sign out
- `GET /api/auth/session` - Get current session
-
-### QR Codes
-
- `GET /api/qrs` - List all QR codes
- `POST /api/qrs` - Create a new QR code (dynamic or static)
- `POST /api/qrs/static` - Create a static QR code
- `GET /api/qrs/[id]` - Get QR code details
- `PATCH /api/qrs/[id]` - Update QR code
- `DELETE /api/qrs/[id]` - Delete QR code
- `DELETE /api/qrs/delete-all` - Delete all user's QR codes
-
-### Analytics
-
- `GET /api/analytics/summary` - Get analytics summary for a QR code
-
-### User & Settings
-
- `GET /api/user/plan` - Get current user plan
- `GET /api/user/stats` - Get user statistics
- `POST /api/user/password` - Update password
- `POST /api/user/profile` - Update profile
- `DELETE /api/user/delete` - Delete account
-
-### Stripe Payments
-
- `POST /api/stripe/checkout` - Create checkout session
- `POST /api/stripe/portal` - Create customer portal session
- `POST /api/stripe/webhook` - Handle Stripe webhooks
- `POST /api/stripe/cancel-subscription` - Cancel subscription
-
-### Public Redirect
-
- `GET /r/[slug]` - Redirect and track QR code scan
-
-## Environment Variables
-
-| Variable                             | Description                   | Required | Default                                                                |
-| ------------------------------------ | ----------------------------- | -------- | ---------------------------------------------------------------------- |
-| `DATABASE_URL`                       | PostgreSQL connection string  | Yes      | `postgresql://postgres:postgres@localhost:5435/qrmaster?schema=public` |
-| `NEXTAUTH_URL`                       | Application URL               | Yes      | `http://localhost:3050`                                                |
-| `NEXTAUTH_SECRET`                    | Secret for JWT encryption     | Yes      | Generate with `openssl rand -base64 32`                                |
-| `IP_SALT`                            | Salt for IP hashing (privacy) | Yes      | Generate with `openssl rand -base64 32`                                |
-| `GOOGLE_CLIENT_ID`                   | Google OAuth client ID        | No       | -                                                                      |
-| `GOOGLE_CLIENT_SECRET`               | Google OAuth client secret    | No       | -                                                                      |
-| `STRIPE_SECRET_KEY`                  | Stripe secret key             | No       | -                                                                      |
-| `STRIPE_WEBHOOK_SECRET`              | Stripe webhook signing secret | No       | -                                                                      |
-| `NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY` | Stripe public key             | No       | -                                                                      |
-| `NEXT_PUBLIC_INDEXABLE`              | Allow search engine indexing  | No       | `false` (set to `true` in production)                                  |
-| `REDIS_URL`                          | Redis connection string       | No       | `redis://redis:6379`                                                   |
-| `NEXT_PUBLIC_POSTHOG_KEY`            | PostHog analytics key         | No       | -                                                                      |
-| `NEXT_PUBLIC_POSTHOG_HOST`           | PostHog host URL              | No       | -                                                                      |
-
-**Note**: Copy `env.example` to `.env` and update the values before starting.
-
-### Generating Secrets
-
-```bash
-# Generate NEXTAUTH_SECRET
-openssl rand -base64 32
-
-# Generate IP_SALT
-openssl rand -base64 32
-```
-
-## Security & Privacy
-
- **IP Hashing**: IP addresses are hashed with salt before storage (GDPR-compliant)
- **DNT Respect**: Honors Do Not Track browser headers
- **Rate Limiting**: API endpoints protected against abuse
- **CSRF Protection**: Token-based CSRF validation on mutations
- **Secure Sessions**: NextAuth.js with encrypted JWT tokens
- **Stripe Security**: PCI-compliant payment processing
- **SQL Injection Prevention**: Prisma ORM parameterized queries
-
-## Database Schema
-
-The application uses PostgreSQL with Prisma ORM. Key models:
-
- **User**: User accounts with Stripe subscription data
- **QRCode**: QR code records (static/dynamic, multiple content types)
- **QRScan**: Scan analytics data (hashed IP, device, location, UTM params)
- **Integration**: Third-party integrations (Zapier, etc.)
- **Account/Session**: NextAuth authentication data
-
-### Supported QR Code Types
-
- **URL**: Website links
- **VCARD**: Contact cards (name, email, phone, company)
- **GEO**: GPS locations
- **PHONE**: Phone numbers (tel: links)
- **TEXT**: Plain text
- **SMS**: SMS messages
- **WHATSAPP**: WhatsApp messages
-
-### Plans
-
- **FREE**: 3 dynamic QR codes, unlimited static
- **PRO**: 50 codes, custom branding, advanced analytics
- **BUSINESS**: 500 codes, bulk upload, API access, priority support
-
-## Deployment
-
-### Docker (Recommended for Self-Hosting)
-
-The application includes production-ready Docker configuration with PostgreSQL and Redis:
-
-```bash
-# Build and start all services
-docker-compose up -d --build
-
-# Run migrations
-docker-compose exec web npx prisma migrate deploy
-
-# View logs
-docker-compose logs -f
-```
-
-For detailed deployment instructions, see [DOCKER_SETUP.md](DOCKER_SETUP.md).
-
-### Vercel
-
-1. Push your code to GitHub
-2. Import the project in Vercel
-3. Add a PostgreSQL database (Vercel Postgres, Supabase, or other)
-4. Add environment variables in Vercel dashboard
-5. Deploy
-
-**Note**: For Vercel deployment, you'll need to set up a PostgreSQL database separately.
-
-## Troubleshooting
-
-### Database Issues
-
-**Problem**: Migration errors or schema conflicts
-
-```bash
-# Solution: Reset the database
-npx prisma migrate reset
-```
-
-**Problem**: "Error: P1001: Can't reach database server"
-
-```bash
-# Check if Docker containers are running
-docker ps
-
-# Restart database
-npm run docker:dev:stop
-npm run docker:dev
-```
-
-**Problem**: Prisma Client out of sync
-
-```bash
-# Regenerate Prisma Client
-npx prisma generate
-```
-
-**Problem**: Need to start completely fresh
-
-```bash
-# Stop all Docker containers
-npm run docker:dev:stop
-
-# Remove volumes (⚠️ deletes all data)
-docker volume prune
-
-# Restart everything
-npm run docker:dev
-npx prisma migrate dev
-npm run db:seed
-```
-
-### Port Already in Use
-
-If port 3050 is already in use:
-
-```bash
-# Find and kill the process (Windows)
-netstat -ano | findstr :3050
-taskkill /PID <PID> /F
-
-# Or change the port in package.json
-"dev": "next dev -p 3051"
-```
-
-### Docker Issues
-
-**Problem**: Permission denied errors
-
-```bash
-# Windows: Run PowerShell as Administrator
-# Linux/Mac: Use sudo for docker commands
-```
-
-**Problem**: Out of disk space
-
-```bash
-# Clean up Docker
-docker system prune -a
-```
-
-## Contributing
-
-1. Fork the repository
-2. Create your feature branch (`git checkout -b feature/amazing-feature`)
-3. Commit your changes (`git commit -m 'Add some amazing feature'`)
-4. Push to the branch (`git push origin feature/amazing-feature`)
-5. Open a Pull Request
-
-## License
-
-This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
-
-## Support
-
-For support, email support@qrmaster.net or open an issue on GitHub.
-
-## Acknowledgments
-
- Next.js team for the amazing framework
- Vercel for hosting and deployment
- All open-source contributors
-
---
-
-Built with ❤️ by QR Master Team
+# QR Master - Create Custom QR Codes in Seconds
+
+A production-ready SaaS application for creating and managing QR codes with advanced tracking, analytics, and Stripe payment integration.
+
+## Features
+
+- 🎨 **Custom QR Codes** - Create static and dynamic QR codes with full customization
+- 📊 **Advanced Analytics** - Track scans, locations, devices, and user behavior
+- 🔄 **Dynamic Content** - Edit QR code destinations anytime without reprinting
+- 📦 **Bulk Operations** - Import CSV/Excel files to create up to 1,000 QR codes at once
+- 💳 **Stripe Integration** - FREE, PRO, and BUSINESS subscription plans with secure billing
+- 🎨 **Custom Branding** - Logo upload, custom colors (PRO+ plans)
+- 🌍 **SEO Optimized** - Schema.org structured data, meta tags, breadcrumbs
+- 🔒 **Privacy-First** - GDPR-compliant, hashed IPs, DNT headers respected
+- 📱 **Responsive Design** - Works perfectly on all devices
+
+## Tech Stack
+
+- **Frontend**: Next.js 14 (App Router), TypeScript, Tailwind CSS
+- **Backend**: Next.js API Routes, Prisma ORM
+- **Database**: PostgreSQL (with Prisma migrations)
+- **Cache**: Redis (optional)
+- **Auth**: NextAuth.js (Credentials + Google OAuth)
+- **Payments**: Stripe (Subscriptions & Webhooks)
+- **QR Generation**: qrcode library
+- **Bulk Processing**: Papa Parse (CSV), XLSX, JSZip
+- **Analytics**: PostHog (optional)
+- **SEO**: next-sitemap, Schema.org structured data
+
+## Quick Start
+
+### Prerequisites
+
+- Node.js 18+
+- Docker and Docker Compose V2
+- Git
+
+### Installation
+
+#### Option 1: Development Mode (Recommended)
+
+Run database in Docker, app on host machine:
+
+1. Clone the repository:
+
+```bash
+git clone https://github.com/yourusername/qr-master.git
+cd qr-master
+```
+
+2. Install dependencies:
+
+```bash
+npm install
+```
+
+3. Copy and configure environment:
+
+```bash
+cp env.example .env
+```
+
+Edit `.env` and set:
+
+- `NEXTAUTH_SECRET` (generate: `openssl rand -base64 32`)
+- `IP_SALT` (generate: `openssl rand -base64 32`)
+- (Optional) Google OAuth credentials
+
+4. Start database services:
+
+```bash
+npm run docker:dev
+```
+
+5. Run database migrations and seed:
+
+```bash
+npx prisma migrate dev
+npm run db:seed
+```
+
+> **Note**: If you get migration errors, you can reset the database:
+>
+> ```bash
+> npx prisma migrate reset
+> ```
+>
+> This will drop the database, recreate it, run all migrations, and seed data.
+
+6. Start development server:
+
+```bash
+npm run dev
+```
+
+7. Access the application:
+   - **App**: http://localhost:3050
+   - **Database UI**: http://localhost:8080 (Adminer - username: `root`, password: `root`)
+   - **Database**: localhost:5435 (username: `postgres`, password: `postgres`)
+   - **Redis**: localhost:6379
+
+#### Option 2: Full Docker (Production)
+
+Run everything in Docker:
+
+1. Clone and setup:
+
+```bash
+git clone https://github.com/yourusername/qr-master.git
+cd qr-master
+cp env.example .env
+# Edit .env with your configuration
+```
+
+2. Build and start:
+
+```bash
+npm run docker:prod
+```
+
+3. Run migrations:
+
+```bash
+docker-compose exec web npx prisma migrate deploy
+```
+
+4. Access at http://localhost:3050
+
+📚 **For detailed Docker setup, see [DOCKER_SETUP.md](DOCKER_SETUP.md)**
+
+## Demo Account
+
+After running `npm run db:seed`, use these credentials to test the application:
+
+- **Email**: demo@qrmaster.com
+- **Password**: demo123
+- **Plan**: FREE (3 QR codes limit)
+
+The seed script also creates sample QR codes for testing.
+
+## Development
+
+### Available Scripts
+
+```bash
+# Development
+npm run dev                    # Start Next.js dev server (port 3050)
+npm run build                  # Build for production
+npm run start                  # Start production server
+
+# Database
+npm run db:generate            # Generate Prisma Client
+npm run db:migrate             # Run migrations (dev mode)
+npm run db:deploy              # Deploy migrations (production)
+npm run db:seed                # Seed database with demo data
+npm run db:studio              # Open Prisma Studio UI
+npx prisma migrate reset       # Reset database (drop, recreate, migrate, seed)
+
+# Docker
+npm run docker:dev             # Start DB & Redis only
+npm run docker:dev:stop        # Stop dev services
+npm run docker:dev:clean       # Stop and clean containers
+npm run docker:prod            # Start full stack (production)
+npm run docker:stop            # Stop all services
+npm run docker:logs            # View container logs
+npm run docker:db              # PostgreSQL CLI
+npm run docker:redis           # Redis CLI
+npm run docker:backup          # Backup database to SQL file
+```
+
+### Local Development (without Docker)
+
+1. Install dependencies:
+
+```bash
+npm install
+```
+
+2. Set up PostgreSQL and Redis locally
+
+3. Configure `.env` with local database URL:
+
+```env
+DATABASE_URL=postgresql://postgres:postgres@localhost:5435/qrmaster?schema=public
+```
+
+4. Run migrations and seed:
+
+```bash
+npx prisma migrate dev
+npm run db:seed
+```
+
+5. Start dev server:
+
+```bash
+npm run dev
+```
+
+### Resetting the Database
+
+If you need to reset your database (drop all tables, recreate, and reseed):
+
+```bash
+# Full reset (drops database, reruns migrations, seeds data)
+npx prisma migrate reset
+
+# Or manually:
+npx prisma migrate reset --skip-seed  # Reset without seeding
+npm run db:seed                        # Then seed manually
+```
+
+This is useful when:
+
+- Schema has changed significantly
+- You have migration conflicts
+- You want to start fresh with clean data
+
+### Project Structure
+
+```
+qr-master/
+├── src/
+│   ├── app/                    # Next.js app router pages
+│   ├── components/             # React components
+│   ├── lib/                   # Utility functions and configurations
+│   ├── hooks/                 # Custom React hooks
+│   ├── styles/                # Global styles
+│   └── i18n/                  # Translation files
+├── prisma/                    # Database schema and migrations
+├── docker/                    # Docker initialization scripts
+│   ├── init-db.sh            # PostgreSQL initialization
+│   └── README.md             # Docker documentation
+├── public/                    # Static assets
+├── docker-compose.yml         # Production Docker setup
+├── docker-compose.dev.yml     # Development Docker setup
+├── Dockerfile                # Container definition
+├── DOCKER_SETUP.md           # Complete Docker guide
+└── env.example               # Environment template
+```
+
+## API Endpoints
+
+### Authentication
+
+- `POST /api/auth/signin` - Sign in with credentials
+- `POST /api/auth/signout` - Sign out
+- `GET /api/auth/session` - Get current session
+
+### QR Codes
+
+- `GET /api/qrs` - List all QR codes
+- `POST /api/qrs` - Create a new QR code (dynamic or static)
+- `POST /api/qrs/static` - Create a static QR code
+- `GET /api/qrs/[id]` - Get QR code details
+- `PATCH /api/qrs/[id]` - Update QR code
+- `DELETE /api/qrs/[id]` - Delete QR code
+- `DELETE /api/qrs/delete-all` - Delete all user's QR codes
+
+### Analytics
+
+- `GET /api/analytics/summary` - Get analytics summary for a QR code
+
+### User & Settings
+
+- `GET /api/user/plan` - Get current user plan
+- `GET /api/user/stats` - Get user statistics
+- `POST /api/user/password` - Update password
+- `POST /api/user/profile` - Update profile
+- `DELETE /api/user/delete` - Delete account
+
+### Stripe Payments
+
+- `POST /api/stripe/checkout` - Create checkout session
+- `POST /api/stripe/portal` - Create customer portal session
+- `POST /api/stripe/webhook` - Handle Stripe webhooks
+- `POST /api/stripe/cancel-subscription` - Cancel subscription
+
+### Public Redirect
+
+- `GET /r/[slug]` - Redirect and track QR code scan
+
+## Environment Variables
+
+| Variable                             | Description                   | Required | Default                                                                |
+| ------------------------------------ | ----------------------------- | -------- | ---------------------------------------------------------------------- |
+| `DATABASE_URL`                       | PostgreSQL connection string  | Yes      | -                                                                      |
+| `NEXTAUTH_URL`                       | Application URL               | Yes      | `http://localhost:3050`                                                |
+| `NEXTAUTH_SECRET`                    | Secret for JWT encryption     | Yes      | - (Generate with `openssl rand -base64 32`)                            |
+| `IP_SALT`                            | Salt for IP hashing (privacy) | Yes      | Generate with `openssl rand -base64 32`                                |
+| `GOOGLE_CLIENT_ID`                   | Google OAuth client ID        | No       | -                                                                      |
+| `GOOGLE_CLIENT_SECRET`               | Google OAuth client secret    | No       | -                                                                      |
+| `STRIPE_SECRET_KEY`                  | Stripe secret key             | No       | -                                                                      |
+| `STRIPE_WEBHOOK_SECRET`              | Stripe webhook signing secret | No       | -                                                                      |
+| `NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY` | Stripe public key             | No       | -                                                                      |
+| `NEXT_PUBLIC_INDEXABLE`              | Allow search engine indexing  | No       | `false` (set to `true` in production)                                  |
+| `REDIS_URL`                          | Redis connection string       | No       | `redis://redis:6379`                                                   |
+| `NEXT_PUBLIC_POSTHOG_KEY`            | PostHog analytics key         | No       | -                                                                      |
+| `NEXT_PUBLIC_POSTHOG_HOST`           | PostHog host URL              | No       | -                                                                      |
+
+**Note**: Copy `env.example` to `.env` and update the values before starting.
+
+### Generating Secrets
+
+```bash
+# Generate NEXTAUTH_SECRET
+openssl rand -base64 32
+
+# Generate IP_SALT
+openssl rand -base64 32
+```
+
+## Security & Privacy
+
+- **IP Hashing**: IP addresses are hashed with salt before storage (GDPR-compliant)
+- **DNT Respect**: Honors Do Not Track browser headers
+- **Rate Limiting**: API endpoints protected against abuse
+- **CSRF Protection**: Token-based CSRF validation on mutations
+- **Secure Sessions**: NextAuth.js with encrypted JWT tokens
+- **Stripe Security**: PCI-compliant payment processing
+- **SQL Injection Prevention**: Prisma ORM parameterized queries
+
+## Database Schema
+
+The application uses PostgreSQL with Prisma ORM. Key models:
+
+- **User**: User accounts with Stripe subscription data
+- **QRCode**: QR code records (static/dynamic, multiple content types)
+- **QRScan**: Scan analytics data (hashed IP, device, location, UTM params)
+- **Integration**: Third-party integrations (Zapier, etc.)
+- **Account/Session**: NextAuth authentication data
+
+### Supported QR Code Types
+
+- **URL**: Website links
+- **VCARD**: Contact cards (name, email, phone, company)
+- **GEO**: GPS locations
+- **PHONE**: Phone numbers (tel: links)
+- **TEXT**: Plain text
+- **SMS**: SMS messages
+- **WHATSAPP**: WhatsApp messages
+
+### Plans
+
+- **FREE**: 3 dynamic QR codes, unlimited static
+- **PRO**: 50 codes, custom branding, advanced analytics
+- **BUSINESS**: 500 codes, bulk upload, API access, priority support
+
+## Deployment
+
+### Docker (Recommended for Self-Hosting)
+
+The application includes production-ready Docker configuration with PostgreSQL and Redis:
+
+```bash
+# Build and start all services
+docker-compose up -d --build
+
+# Run migrations
+docker-compose exec web npx prisma migrate deploy
+
+# View logs
+docker-compose logs -f
+```
+
+For detailed deployment instructions, see [DOCKER_SETUP.md](DOCKER_SETUP.md).
+
+### Vercel
+
+1. Push your code to GitHub
+2. Import the project in Vercel
+3. Add a PostgreSQL database (Vercel Postgres, Supabase, or other)
+4. Add environment variables in Vercel dashboard
+5. Deploy
+
+**Note**: For Vercel deployment, you'll need to set up a PostgreSQL database separately.
+
+## Troubleshooting
+
+### Database Issues
+
+**Problem**: Migration errors or schema conflicts
+
+```bash
+# Solution: Reset the database
+npx prisma migrate reset
+```
+
+**Problem**: "Error: P1001: Can't reach database server"
+
+```bash
+# Check if Docker containers are running
+docker ps
+
+# Restart database
+npm run docker:dev:stop
+npm run docker:dev
+```
+
+**Problem**: Prisma Client out of sync
+
+```bash
+# Regenerate Prisma Client
+npx prisma generate
+```
+
+**Problem**: Need to start completely fresh
+
+```bash
+# Stop all Docker containers
+npm run docker:dev:stop
+
+# Remove volumes (⚠️ deletes all data)
+docker volume prune
+
+# Restart everything
+npm run docker:dev
+npx prisma migrate dev
+npm run db:seed
+```
+
+### Port Already in Use
+
+If port 3050 is already in use:
+
+```bash
+# Find and kill the process (Windows)
+netstat -ano | findstr :3050
+taskkill /PID <PID> /F
+
+# Or change the port in package.json
+"dev": "next dev -p 3051"
+```
+
+### Docker Issues
+
+**Problem**: Permission denied errors
+
+```bash
+# Windows: Run PowerShell as Administrator
+# Linux/Mac: Use sudo for docker commands
+```
+
+**Problem**: Out of disk space
+
+```bash
+# Clean up Docker
+docker system prune -a
+```
+
+## Contributing
+
+1. Fork the repository
+2. Create your feature branch (`git checkout -b feature/amazing-feature`)
+3. Commit your changes (`git commit -m 'Add some amazing feature'`)
+4. Push to the branch (`git push origin feature/amazing-feature`)
+5. Open a Pull Request
+
+## License
+
+This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
+
+## Support
+
+For support, email support@qrmaster.net or open an issue on GitHub.
+
+## Acknowledgments
+
+- Next.js team for the amazing framework
+- Vercel for hosting and deployment
+- All open-source contributors
+
+---
+
+Built with ❤️ by QR Master Team
+
+
+
+Führe diese im Terminal aus:
+
+IndexNow (Bing/Yandex + Partner): npm run submit:indexnow
+Google Indexing API: npm run trigger:indexing
--- a/RETENTION_UND_CRO_ANALYSE_2026-07-27.md
+++ b/RETENTION_UND_CRO_ANALYSE_2026-07-27.md
@@ -0,0 +1,169 @@
+# Retention-Mails & CRO-Momente - Analyse
+
+Stand 27. Juli 2026. Grundlage: `src/lib/email.ts`, `src/app/(main)/api/cron/retention-emails/route.ts`, `src/components/marketing/PostDownloadPopup.tsx`, `src/app/(main)/(app)/create/page.tsx` sowie Offer Brief §10 und der Necessary-Beliefs-Doc.
+
+---
+
+## Teil 1 - Der 3/3-Moment: es gibt kein Popup
+
+Das Wichtigste zuerst, weil es kein Copy-Problem ist.
+
+Wenn ein Free-Nutzer den vierten dynamischen Code anlegen will, passiert laut `create/page.tsx` Zeile 456-458 Folgendes:
+
+```
+if (response.status === 403 && responseData.error === 'Limit reached') {
+  showToast(responseData.message || 'You have reached your plan limit.', 'error');
+  router.push('/pricing?reason=limit_reached');
+}
+```
+
+Drei Dinge gehen hier schief, in aufsteigender Schwere:
+
+**1. Roter Fehler-Toast.** Der Nutzer hat nichts falsch gemacht. Er hat das Produkt so benutzt, wie es gedacht ist, und bekommt dafür eine Fehlermeldung im gleichen Stil wie eine kaputte URL. Das ist keine Upgrade-Aufforderung, das ist eine Zurechtweisung.
+
+**2. Die Arbeit ist weg.** Der Nutzer hat Ziel-URL, Typ, Farben, vielleicht ein Logo eingegeben. Beim Redirect auf `/pricing` ist all das verloren. Wer danach upgradet, muss von vorne anfangen. Das ist der teuerste denkbare Zeitpunkt für Datenverlust: exakt in dem Moment, in dem die Kaufabsicht am höchsten ist.
+
+**3. Der Redirect ist ein Rauswurf.** Der Nutzer wollte einen QR-Code bauen und landet auf einer Preistabelle ohne Bezug zu dem, was er gerade tat. Kein Weg zurück, kein „so sieht dein Code aus, er ist nur noch nicht gespeichert".
+
+Aus dem Offer Brief §7: der Engpass ist **Perceived Likelihood**, nicht Preis und nicht Effort. Dieser Ablauf senkt genau die - er zeigt, dass das Produkt in einem kritischen Moment die eigene Arbeit wegwirft.
+
+### Was stattdessen hin muss
+
+Ein Modal, das **über** dem fertigen Code aufgeht, nicht statt ihm. Der Code bleibt im Hintergrund sichtbar. Vorschlag:
+
+> **Dein vierter Code ist fertig. Er braucht nur noch einen Platz.**
+>
+> Du nutzt alle 3 dynamischen Codes des Free-Plans. Dieser hier ist gebaut und wartet - du kannst ihn behalten oder einen bestehenden freigeben.
+>
+> [ Diesen Code mit Pro speichern - 9 € / Monat ]
+> [ Einen bestehenden Code ersetzen ]
+> [ Stattdessen als statischen Code herunterladen - kostenlos, läuft nie ab ]
+>
+> Deine 3 aktiven Codes laufen weiter, egal wie du dich entscheidest.
+
+Warum diese drei Optionen:
+
+- **Option 1** ist der Kauf, aber formuliert als „diesen konkreten Code retten", nicht als „Plan kaufen". Der Nutzer kauft eine Sache, die er gerade in der Hand hat.
+- **Option 2** ist die ehrliche Alternative innerhalb des Free-Plans. Sie kostet ein paar Conversions und kauft dafür Glaubwürdigkeit - Belief 5 aus dem Necessary-Beliefs-Doc: der sicherste Anbieter ist der, der offenlegt, was er kann und was nicht.
+- **Option 3** ist der Ausweg ohne Verlust. Ein statischer Code löst das Problem des Nutzers zu 60 % und kostet nichts, und die Zusage „läuft nie ab" ist verifiziert. Wer sie nimmt, ist nicht verloren - er hat gerade erlebt, dass das Produkt ihm nichts wegnimmt.
+
+Der letzte Satz ist Risk Reversal an genau der Stelle, wo die Kategorie ihren schlechtesten Ruf hat: das Abschalten bereits gedruckter Codes.
+
+---
+
+## Teil 2 - Die Retention-Mails
+
+Die Copy ist besser als der Durchschnitt. Absenderpersona ist da (Timo, Founder, Reply geht an einen Menschen), keine Ausrufezeichen-Orgie, konkrete Zahlen. Was fehlt, liegt eine Ebene tiefer.
+
+### Mail 1 - Tag 3, Aktivierung
+
+Betreff: `You haven't made one yet`
+Headline: `You haven't made one yet, {Name}. 3 days since signup · 0 QR codes created`
+
+Das ist die stärkste der drei. Der Betreff ist ein Pattern Interrupt in einem Posteingang voller „Tips & Tricks", und die Zeile `Your 3 free dynamic QR codes are still there. Unused.` ist Pointing statt Talking.
+
+Zwei Schwächen:
+
+**Der Betreff kann als Vorwurf gelesen werden.** „You haven't made one yet" mit Doppeldeutigkeit - ist das eine Beobachtung oder eine Rüge? Die Headline im Body löst es auf, der Betreff allein nicht. Alternative, gleiche Länge, ohne Vorwurfsrisiko: `Your 3 free codes are still sitting there`.
+
+**Es fehlt der Anlass.** Die Mail erklärt, *wie* man einen Code macht (drei Schritte), aber nicht, *wofür der Empfänger sich damals angemeldet hat*. Wenn beim Signup die Quelle bekannt ist - kam er über `/tools/google-review-qr-code`, über die Restaurant-Seite, über Bulk? -, dann gehört Schritt 01 personalisiert. „Paste your URL" ist die generischste denkbare Aufforderung an jemanden, der wegen Google-Reviews kam.
+
+### Mail 2 - Tag 7, Upgrade
+
+Betreff: `You're at the free limit` bzw. `You're 2 away from the free limit`
+Headline: `{n} of 3 free codes used, {Name}.`
+
+Hier ist der Trigger das Problem, nicht die Worte.
+
+**Die Mail feuert am Tag 7, unabhängig vom Verhalten.** Die Bedingung im Cron ist `createdAt < 7 Tage` und `qrCount > 0` und `plan = FREE`. Ein Nutzer mit **einem** Code bekommt eine Mail mit dem Betreff „You're 2 away from the free limit" - über ein Limit, das ihn nicht drückt und vielleicht nie drücken wird. Das ist eine Upgrade-Aufforderung an jemanden ohne Schmerz. Solche Mails trainieren Empfänger darauf, den Absender zu ignorieren, und der Absender ist hier der Gründer persönlich - das ist teurer Kredit, den man nicht für eine Fehlzündung ausgeben sollte.
+
+**Empfehlung: den Trigger vom Kalender aufs Verhalten umstellen.**
+
+| Zustand | Auslöser | Inhalt |
+|---|---|---|
+| 3 von 3 belegt | sobald erreicht, nicht Tag 7 | Limit-Mail wie jetzt, aber sofort im Moment der Relevanz |
+| 1-2 von 3 belegt | Tag 7 | keine Upgrade-Mail. Stattdessen: was die Scan-Daten des ersten Codes zeigen |
+| 3 von 3 und erster Code hat Scans | 3 Tage nach Limit | Upgrade mit den eigenen Zahlen des Nutzers als Beweis |
+
+Das dritte Szenario ist die eigentlich fehlende Mail. Nichts überzeugt einen Marketing-Manager so wie sein eigener erster Datenpunkt: „Dein Code auf dem Flyer hatte 47 Scans, die meisten dienstags zwischen 11 und 14 Uhr." Das ist Pointing in Reinform, und es kostet nichts außer der Query.
+
+**Und ein inhaltlicher Fehler.** Die Vergleichstabelle listet `CSV export: Free ✓ / Pro ✓`. Eine Zeile, in der beide Spalten identisch sind, ist in einer Upgrade-Tabelle wertlos - sie füllt Platz und verwässert die drei Zeilen, die tatsächlich einen Unterschied zeigen. Streichen.
+
+### Mail 3 - Tag 30
+
+Betreff: `{Name}, a month of QR codes - one upgrade worth making`
+Argument: Pro-Nutzer bereuen, das Branding nicht früher hinzugefügt zu haben.
+
+**Das Argument ist gut gebaut und nicht belegt.** Der Satz `The one thing I hear most from Pro users who switched after a few weeks: they wish they'd added their brand sooner` behauptet ein Muster aus Kundengesprächen. Wenn diese Gespräche stattgefunden haben: rein damit, am besten mit einem echten Zitat. Wenn nicht, ist das ein erfundenes Testimonial in indirekter Rede und verstößt gegen die Beweisregel aus dem Product Context („keine erfundenen Testimonials"). Bei einer Zielgruppe, die Bewertungsportale liest, ist das die teuerste Art von Satz.
+
+**Der Aufhänger ist außerdem der schwächere von zwei verfügbaren.** Branding ist ein Ästhetik-Argument. Nach 30 Tagen mit mehreren Codes hat der Nutzer etwas viel Stärkeres in der Hand: Scan-Daten. Der Tag-30-Anlass sollte der erste echte Report sein, nicht ein Logo-Feature. „Deine Codes wurden diesen Monat X-mal gescannt. Hier ist, was du noch nicht sehen kannst" - und dann Device- und Location-Breakdown als das, was Pro freischaltet. Das ist derselbe Kaufgrund, aber hergeleitet aus dem, was der Nutzer selbst erlebt hat.
+
+Das deckt sich mit Offer Brief §10, Option 1: auf Analytics-Tiefe metern statt auf Code-Anzahl. Diese Mail wäre die erste Stelle, an der man das testen kann, ohne das Pricing anzufassen.
+
+### Übergreifend: es fehlt die Mail nach dem ersten Scan
+
+Die Sequenz ist Tag 3, Tag 7, Tag 30 - drei Kalendertermine. Der wichtigste Moment im Lebenszyklus dieses Produkts kommt in keinem davon vor: **der erste Scan eines Codes.** Das ist der Augenblick, in dem aus einem Tool eine Messung wird und in dem das Versprechen der Positionierung zum ersten Mal einlöst. Eine Mail „Dein Code wurde gerade zum ersten Mal gescannt" hat einen Anlass, der nicht konstruiert ist, und braucht überhaupt kein Verkaufsargument.
+
+---
+
+## Teil 3 - Das Post-Download-Popup auf den Tool-Seiten
+
+Aktuell:
+
+> **Your QR code is downloading!**
+> Want to make it smarter - for free?
+>
+> - Edit the link anytime - QR stays the same
+> - See who scans, when & where
+> - Custom colors, logo & frames
+> - Free plan included - upgrade anytime for more
+>
+> [ Create Free Account ] / *No thanks, keep it static*
+
+### Was funktioniert
+
+Das Timing ist richtig: nach dem Download, nicht davor. Der Nutzer hat bekommen, wofür er kam - das Popup nimmt ihm nichts weg. Und `No thanks, keep it static` ist eine ehrliche Ablehn-Option ohne Beschämung, was in dieser Kategorie selten ist. Nicht anfassen.
+
+### Was nicht funktioniert
+
+**Die Headline sagt nichts.** `Your QR code is downloading!` ist eine Statusmeldung. Der Nutzer sieht den Download in seinem Browser, er braucht keine Bestätigung. Diese Zeile ist die prominenteste Fläche des Popups und verbraucht sie für eine Information, die der Nutzer schon hat.
+
+**Der Kernnutzen ist die dritte Zeile in einer Bullet-Liste.** `Edit the link anytime - QR stays the same` ist das gesamte Argument des Produkts, versteckt zwischen einem Icon und drei gleichgewichtigen Geschwistern. In einer Liste von vier gleich formatierten Punkten ist keiner davon wichtig.
+
+**Es fehlt der Anlass in diesem Moment.** Der Nutzer hat gerade einen **statischen** Code heruntergeladen. Der interessante Satz ist nicht „mach ihn schlauer", sondern die Konsequenz dessen, was er gerade getan hat: dieser Code ist ab jetzt festgelegt. Das ist kein Vorwurf und keine Drohung, das ist eine Tatsache über die Datei in seinem Download-Ordner - und exakt Belief 1 aus dem Necessary-Beliefs-Doc.
+
+**Es ist auf allen Tool-Seiten identisch.** Wer auf `/tools/google-review-qr-code` war, will Bewertungen. Wer auf `/tools/wifi-qr-code` war, will Gäste ins WLAN. Ein Popup, das beiden dasselbe sagt, spricht keinem von beiden.
+
+### Vorschlag
+
+> **Dieser Code zeigt jetzt für immer auf diese URL.**
+>
+> Das ist bei einem dauerhaften Link genau richtig. Falls sich das Ziel je ändert, brauchst du einen neuen Code und neues Druckmaterial.
+>
+> Ein kostenloses Konto gibt dir 3 dynamische Codes: gleiches Bild, Ziel jederzeit änderbar, jeder Scan gezählt.
+>
+> [ Kostenloses Konto anlegen - keine Karte ]
+> *Nein danke, statisch reicht*
+
+Struktur dahinter: P.I.G.-Opening auf eine Tatsache statt auf ein Feature, dann die Zugeständnis-Zeile („bei einem dauerhaften Link genau richtig") - das ist Offer Brief §9, die Konzession als Glaubwürdigkeits-Move -, dann erst der Mechanismus. Die Bullet-Liste entfällt komplett; drei gleichrangige Vorteile sind schwächer als ein Satz, der den einen benennt.
+
+Pro Tool-Seite variiert nur die erste Zeile:
+
+| Tool | Erste Zeile |
+|---|---|
+| Google Review | Dieser Code zeigt jetzt für immer auf dieses Google-Profil. |
+| WiFi | Dieser Code enthält jetzt dauerhaft dieses WLAN-Passwort. |
+| vCard | Dieser Code enthält jetzt dauerhaft diese Kontaktdaten. |
+| URL / Standard | Dieser Code zeigt jetzt für immer auf diese URL. |
+
+Die WiFi-Variante ist die stärkste der vier, weil sie einen Umstand benennt, den fast niemand vorher bedenkt: das Passwort steht in der gedruckten Datei. Wer es ändert, hat wertloses Material.
+
+---
+
+## Reihenfolge nach Wirkung pro Aufwand
+
+1. **Das 3/3-Modal bauen.** Momentan verliert das Produkt an der Stelle mit der höchsten Kaufabsicht die Arbeit des Nutzers. Das ist der einzige Punkt hier, der auch Entwicklungsarbeit ist und nicht nur Text.
+2. **Trigger der Tag-7-Mail auf Verhalten umstellen.** Query-Änderung im Cron, keine neue Infrastruktur.
+3. **Popup-Copy und Headline umstellen**, mit Variante pro Tool-Seite.
+4. **Die „erster Scan"-Mail** ergänzen - der einzige Anlass in der ganzen Sequenz, der nicht vom Kalender kommt.
+5. **Tag 30 auf Scan-Daten umbauen** statt Branding, und den unbelegten Pro-Nutzer-Satz entweder belegen oder streichen.
--- a/SEO-BLOG-PLAN-2026-08.md
+++ b/SEO-BLOG-PLAN-2026-08.md
@@ -0,0 +1,139 @@
+# Blog-Keyword-Plan aus GSC (letzte 3 Monate, Stand 2026-08-03)
+
+Datenbasis: 1.001 Suchanfragen, 163 Seiten. Gesamt ~34k Impressionen, ~150 Klicks außerhalb der Homepage.
+
+## Kernbefund
+
+Das Problem ist **nicht fehlender Content, sondern Positionen 40–70**. Fast alle großen Cluster haben 0 Klicks bei hunderten Impressionen, weil sie auf Seite 4–7 stehen. Dazu kommt **Kannibalisierung**: mehrere Blogposts konkurrieren mit der Money-Page um dasselbe Keyword — und alle verlieren.
+
+Beispiel Tracking:
+
+| URL | Impr. | Position |
+|---|---|---|
+| /qr-code-tracking | 2.148 | 48,4 |
+| /blog/qr-code-tracking-guide-2025 | 67 | 79,4 |
+| /blog/trackable-qr-codes | 204 | 81,5 |
+| /blog/qr-code-analytics | 93 | 85,1 |
+| /guide/tracking-analytics | 1 | 91,0 |
+
+Fünf Seiten für ein Thema → keine rankt. Gleiches Muster bei Dynamic QR und Instagram.
+
+---
+
+## A) Zuerst verbessern (bestehende Posts, Position 20–45 = erreichbar)
+
+Diese sind am nächsten an Seite 1. Höchster ROI.
+
+**1. `/blog/free-vs-paid-qr-generator` — Position 31, 446 Impr., 1 Klick**
+Beste Blog-Position der Site. Keywords, die schon auf ~26 stehen:
+- `free vs paid qr code generator` (97 Impr., Pos. 26,7)
+- `free vs paid qr code generators` (78, Pos. 26,6)
+- `do you have to pay for qr codes` (42, Pos. 49) + 4 Varianten
+- `do qr codes cost money` (20)
+
+→ Ergänzen: FAQ-Block mit exakt diesen Frageformulierungen ("Do you have to pay for QR codes?", "Do QR codes cost money?"), Preisvergleichstabelle mit echten Zahlen der Wettbewerber, Update-Datum 2026.
+
+**2. `/blog/microsoft-teams-qr-code` — Position 14,4, 287 Impr., 0 Klicks**
+Position 14 mit 0 % CTR = Title/Meta-Problem, kein Ranking-Problem.
+- `microsoft teams qr code generator` (18 Impr., Pos. 9,6 — bereits Seite 1!)
+- `teams qr code generator` (12, Pos. 6,6), `teams qr code` (17, Pos. 27), `qr code for teams meeting` (6, Pos. 11)
+
+→ Title-Tag und Meta-Description neu schreiben (Jahreszahl, Nutzenversprechen), interne Verlinkung von /tools/teams-qr-code. Kein neuer Content nötig.
+
+**3. `/blog/best-qr-code-generator-2026` — Position 41, 55 Impr.**
+Wettbewerber-Cluster hat 1.173 Impr. gesamt, alles bei 0 Klicks:
+- `beaconstac` (96), `beaconstac qr code generator` (75), `beaconstac vs popl` (67), `beaconstac vs mobilo` (57), `popl vs beaconstac` (56), `blinq vs beaconstac` (42), `beaconstac alternative` (34)
+- `flowcode alternative` (51, Pos. 18,3 — nah dran), `flowcode competitors` (38, Pos. 29), `flowcode pricing` (21), `uniqode alternative` (24, Pos. 26)
+
+→ Vergleichstabelle mit Preisen pro Anbieter einbauen. Zusätzlich: die `X vs Y`-Queries (Beaconstac vs Popl/Mobilo/Blinq) sind reine Vergleichsintention ohne passende Seite — dafür Punkt B4.
+
+**4. `/blog/whatsapp-qr-code-generator` — Position 10,2, nur 33 Impr.**
+Steht auf Seite 1, bekommt aber kaum Impressionen — während `/tools/whatsapp-qr-code` bei 441 Impr. auf Position 55 hängt.
+- `whatsapp qr code generator` (211 Impr., Pos. 59,5), `whatsapp qr generator` (107, Pos. 66,5)
+
+→ Klassische Kannibalisierung. Blogpost auf Tool-Seite verlinken (Canonical prüfen), Blogpost als Ratgeber positionieren statt als Generator.
+
+---
+
+## B) Neue Blogposts (echte Nachfrage, keine passende Seite)
+
+**B1. Google Reviews — 1.331 Impr., 0 Klicks, kein einziger Blogpost**
+Größte inhaltliche Lücke. `/tools/google-review-qr-code` hat 1.752 Impr. bei Pos. 37,8 und 0,11 % CTR — komplett ohne Content-Support.
+- `google review qr code generator` (222), `free qr code for google review` (121), `qr code generator for google reviews` (93), `free google review qr code` (89), `review qr code` (83, Pos. 35), `qr code for feedback` (93)
+- Long-Tail: `how to generate google review qr code` (40), `ask for a review by qr code` (6, Pos. 19), `review us on google qr code` (14, Pos. 29)
+
+→ **Post: "How to Create a Google Review QR Code (Free, 2026)"** — Schritt-für-Schritt inkl. Place-ID finden, Aufsteller-Templates, rechtliche Hinweise zum Review-Gating. Verlinkt hart auf das Tool.
+
+**B2. Location / Geo QR — 923 Impr., 0 Klicks, kein Blogpost**
+`/tools/geolocation-qr-code`: 1.087 Impr. bei Position 62,8.
+- `location qr code generator` (129), `qr code for location` (69), `qr code generator location` (53), `location qr code` (41), `qr code generator for map location` (19), `gps qr code generator` (21), `qr code generator gps coordinates` (10)
+
+→ **Post: "Location QR Codes: Google Maps, GPS-Koordinaten & Apple Maps richtig verlinken"** — geo:-URI vs. Maps-Link, welches Format auf iOS/Android funktioniert. Dieses technische Detail sucht sonst niemand ordentlich.
+
+**B3. Coupon / Promo QR — 495 Impr., 0 Klicks**
+`/use-cases/coupon-qr-codes` steht auf Pos. 47,3 (545 Impr.).
+- `qr code coupon` (66), `qr code coupons` (56), `qr coupon` (50), `coupon qr code` (49), `qr coupons` (36), `qr code coupon redemption` (35), `qr code discount coupon` (22), `qr code coupon system` (5)
+
+→ **Post: "QR Code Coupons: Einlösung tracken & Missbrauch verhindern"** — Einmal-Codes, Redemption-Tracking, Ablaufdaten. `qr code coupon redemption` und `qr code coupon system` zeigen Intention über "erstellen" hinaus.
+
+**B4. Wettbewerbsvergleiche `X vs Y` — ~350 Impr., 0 Klicks**
+- `beaconstac vs popl` (67), `beaconstac vs mobilo` (57), `popl vs beaconstac` (56), `blinq vs beaconstac` (42), `bitly vs beaconstac qr codes` (18, Pos. 14,9!), `uniqode vs flowcode` (4), `flowcode vs qr code` (15)
+
+→ Deckt sich mit dem CLAUDE.md-Backlog (`/vs/`-Seiten). Ein Blogpost **"Beaconstac vs Popl vs Blinq vs QR Master: Digital Business Card & QR Vergleich 2026"** fängt mehrere dieser Queries gleichzeitig ab.
+
+**B5. Custom Design / Logo — 465 Impr., 0 Klicks**
+`/custom-qr-code-generator`: 634 Impr., Pos. 42,8.
+- `custom color qr code` (49), `custom design qr code` (44), `custom qr codes with logo` (42), `custom qr code designs` (33), `custom qr code with logo` (31), `how to make custom qr codes` (23), `how to make a custom qr code with logo` (13)
+
+→ **Post: "Custom QR Codes mit Logo: Design-Regeln, die die Scanbarkeit nicht kaputt machen"** — Fehlerkorrektur-Level, Kontrastminimum, Logo-Größe max. 30 %, Farbkombis die scheitern. Klarer How-to-Intent, den die Tool-Seite nicht bedient.
+
+**B6. Bulk / Batch aus Excel & CSV — 402 Impr., aber bereits 2 Klicks + gute Positionen**
+- `bulk qr code generator in google sheets` (23, Pos. 38, **1 Klick**), `batch qr code generator from excel` (32, Pos. 41,8), `bulk qr code generator from excel` (3, Pos. 22, **1 Klick**), `bulk qr code generator excel` (18), `csv qr code generator` (13), `free bulk qr code generator excel` (14)
+
+→ **Post: "QR Codes aus Excel oder Google Sheets erzeugen (Schritt für Schritt)"** — sehr konkreter Workflow-Intent, konvertiert nachweislich schon jetzt.
+
+**B7. Feedback QR — 349 Impr., 0 Klicks**
+`/use-cases/feedback-qr-codes`: 385 Impr., Pos. 60,3.
+- `qr code feedback` (165), `qr code for feedback` (93), `feedback qr code` (62), `qr code for customer feedback` (23), `create qr code for feedback` (21)
+
+→ **Post: "Kundenfeedback per QR Code sammeln: Formulare, Response-Raten, Platzierung"**
+
+---
+
+## C) Konsolidieren statt neu schreiben
+
+**Tracking-Cluster (2.371 Impr., 0 Klicks)** — 5 Seiten kannibalisieren sich (Tabelle oben).
+→ `/blog/trackable-qr-codes`, `/blog/qr-code-analytics`, `/guide/tracking-analytics` per 301 auf `/blog/qr-code-tracking-guide-2025` zusammenlegen. Dieser eine Post wird der Support-Content für `/qr-code-tracking`.
+Zielkeywords: `qr code tracking` (190), `tracking qr code` (158), `qr tracking` (145), `how to track qr code` (118), `track qr code scans` (92), `qr code scan tracking` (88)
+Bereits stark: `how to track qr code scans from a print campaign` (43 Impr., **Pos. 9,9**) — als eigenes H2 ausbauen.
+
+**Dynamic-QR-Cluster (3.598 Impr., 0 Klicks — größtes Volumen der Site)**
+`/dynamic-qr-code-generator` hat 4.147 Impr. bei Pos. 45,5 und **0,02 % CTR**.
+Support-Posts existieren, ranken aber ohne Impressionen (Indexierungsproblem):
+- `/blog/static-vs-dynamic-qr-code` (Pos. 3, aber nur 1 Impr.)
+- `/blog/dynamic-vs-static-qr-codes` (Pos. 5, 1 Impr.) ← Duplikat des vorigen
+- `/blog/convert-static-to-dynamic-qr-code` (Pos. 3,5, 2 Impr.)
+- `/guide/dynamic-qr-code-best-practices` (Pos. 50)
+
+→ Die beiden static-vs-dynamic-Posts sind faktisch dieselbe Seite. Zusammenlegen, dann alle drei prominent von der Money-Page verlinken. Kein neuer Post nötig.
+
+**Instagram** — `/tools/instagram-qr-code` (794 Impr., Pos. 33,7) vs. `/blog/instagram-qr-code-generator` (11 Impr., Pos. 73,4). Blogpost zu How-to umschreiben oder konsolidieren.
+
+---
+
+## Priorisierung
+
+| # | Maßnahme | Aufwand | Potenzial |
+|---|---|---|---|
+| 1 | Tracking-Cluster konsolidieren (C) | mittel | 2.371 Impr. |
+| 2 | Title/Meta Teams-Post fixen (A2) | 15 Min | Pos. 9,6 ohne Klicks |
+| 3 | Google-Review-Post neu (B1) | hoch | 1.331 Impr. |
+| 4 | Free-vs-Paid FAQ ergänzen (A1) | niedrig | Pos. 26 → Seite 1 möglich |
+| 5 | Static-vs-Dynamic-Duplikate mergen (C) | niedrig | entsperrt 3.598 Impr. |
+| 6 | Excel/Sheets-Bulk-Post (B6) | mittel | konvertiert bereits |
+| 7 | Location/Geo-Post (B2) | mittel | 923 Impr. |
+| 8 | Wettbewerbsvergleich vs-Post (B4) | mittel | 350 Impr., hohe Kaufintention |
+
+## Nicht priorisieren
+
+`usdt qr code generator` (85 Impr., Pos. 13, 2 Klicks) und der Crypto-Cluster (765 Impr.) ranken vergleichsweise gut, haben aber schwache Monetarisierung. `system qr dla hoteli` (PL), `qr kütüphane` (TR), `куар мастер` (RU) — internationale Streuung ohne lokalisierte Seiten, aktuell ignorieren.
--- a/SEO-UMSETZUNGSPLAN-2026-08.md
+++ b/SEO-UMSETZUNGSPLAN-2026-08.md
@@ -0,0 +1,226 @@
+# SEO-Umsetzungsplan qrmaster.net
+
+Erstellt: 2026-08-04 · Datenbasis: GSC-Export 2026-08-03 (letzte 3 Monate)
+Zugeschnitten auf **wenige Stunden pro Woche** — jeder Schritt ist einzeln abschließbar.
+
+Ausgangslage: ~34.000 Impressionen, ~150 Klicks außerhalb der Homepage. Kein Sichtbarkeits-, sondern ein Positions- und Konsolidierungsproblem.
+
+---
+
+## REVISION 2026-08-04 — nach Code- und Live-Prüfung
+
+Beim Umsetzen von Phase 1 hat sich die Ausgangslage als anders herausgestellt als aus den reinen GSC-Daten ableitbar. Drei Befunde, die den Plan verändern.
+
+### Befund 1: Kaputter Title (behoben)
+
+`/blog/qr-code-tracking-guide-2025` hatte rohes HTML im `title`-Feld:
+
+```
+title: '<a href="/qr-code-tracking" class="...">QR Code Tracking</a>: Complete Guide 2026'
+```
+
+Live ausgeliefert wurde daraus im `<title>`-Tag, in der H1, in `og:title` und `twitter:title`:
+
+```
+&lt;a href="/qr-code-tracking" class="text-blue-600 underline font-semibold"&gt;QR Code Tracking&lt;/a&gt;: Complete Guide 2026 | QR Master
+```
+
+**Das erklärt Position 79,4 vollständig.** Kein Content-, kein Kannibalisierungsproblem — ein unbrauchbares Snippet. Einzelvorkommen, alle anderen Titles sind sauber. Behoben in `src/lib/blog-data.ts:1160`.
+
+### Befund 2: Konsolidierungsrunde lief bereits (Commit 671c1a1 / 2026-07-10)
+
+Live und funktionierend:
+
+| Quelle | Ziel |
+|---|---|
+| `/blog/qr-code-analytics` | `/qr-code-analytics` |
+| `/blog/qr-code-restaurant-menu` | `/restaurants` |
+| `/guide/tracking-analytics` | `/learn/tracking` |
+| `/guide/qr-code-best-practices` | `/learn/basics` |
+| `/guide/bulk-qr-code-generation` | `/learn/developer` |
+
+Die GSC-Positionen dieser URLs sind damit **historisch** — die Redirects waren nur die letzten ~3,5 Wochen des Auswertungsfensters aktiv. Die Phase-1.1-Tabelle weiter unten ist insoweit überholt.
+
+**Konsequenz:** Nicht `/blog/qr-code-tracking-guide-2025` zum Ziel machen, wie ursprünglich geplant. Die bestehende Architektur ist `/learn/[pillar]` als Hub. Dieser Struktur folgen, keine dritte parallel aufmachen.
+
+### Befund 3: Der Learn-Hub hält die Kannibalisierung am Leben
+
+`/learn/tracking` listet und verlinkt **alle fünf** konkurrierenden Tracking-Artikel gleichzeitig — inklusive `/blog/qr-code-analytics`, das eine 301-Quelle ist. Der Hub ist damit nicht die Lösung, sondern der Motor: Er hält jeden Artikel im Index und intern verlinkt, statt Signale zu bündeln.
+
+Zusätzlich behoben:
+
+- **Footer** verlinkte sitewide auf `/guide/tracking-analytics` und `/guide/qr-code-best-practices` — beides 301-Quellen. Jede Seite der Site leitete Linkkraft durch eine Weiterleitung. → jetzt `/learn/tracking` und `/learn/basics` (`src/components/ui/Footer.tsx:88-89`)
+- **IndexNow** meldete aktiv die drei `/guide/*`-URLs an Suchmaschinen, also Redirect-Quellen. → jetzt die `/learn/*`-Pillars (`src/lib/indexnow.ts:125-130`)
+
+### Offen aus dieser Runde
+
+- [ ] `/learn/tracking` entrümpeln: nur noch auf die eine überlebende Tracking-Seite verlinken, nicht auf alle fünf
+- [ ] `/blog/trackable-qr-codes` (204 Impr., Pos. 81,5) ist **nicht** weitergeleitet und lebt weiter → 301 auf den Guide
+- [ ] `src/app/(main)/guide/*/page.tsx` existieren noch als Komponenten mit Self-Canonical, obwohl der Redirect greift → Dead Code entfernen
+- [ ] Drei FAQ-Antworten in `industry-pages.ts` (Zeilen 102, 375, 735) und `growth-pages.ts:473` verlinken auf `/blog/qr-code-restaurant-menu` → auf `/restaurants` umhängen
+
+**Erst diese Punkte, dann Phase 2.** Die Reihenfolge im Plan bleibt sonst gültig.
+
+---
+
+## Wichtige Korrektur vorab: Intent-Check vor Snippet-Rewrites
+
+Ich hatte empfohlen, die `/qr-code-for/`-Seiten mit Position < 20 und 0 % CTR per Title-Rewrite zu fixen. Beim Prüfen der Seiten stimmt das **nur zum Teil**. Die Meta-Titles sind bereits gut geschrieben:
+
+> `barbershops` → „QR Codes for Barbershops: Bookings & Reviews"
+> `cinemas` → „QR Codes for Cinemas: Tickets & Loyalty"
+
+Das Problem liegt woanders. Beispiel `/qr-code-for/barbershops` (327 Impr., Position 9,8, 4 Klicks) — die tatsächlichen Suchanfragen:
+
+| Query | Impr. | Pos. |
+|---|---|---|
+| short code for barbershops | 16 | 21,8 |
+| qr barber | 13 | 8,9 |
+| short code for barber shops | 6 | 16,3 |
+| barber+scan | 5 | 9,6 |
+| barcode grooming | 4 | 11,0 |
+| short code for barber shop | 4 | 26,0 |
+
+Das Muster `short code for X` zieht sich durch: `short code for barbers`, `for yoga studios`, `for cinemas`, `for bars`, `for nail bars`, `for theaters`, `for barbershop` — zusammen rund 60 Impressionen. Wer „short code for barbershops" sucht, will mit hoher Wahrscheinlichkeit einen **SMS-Short-Code**, keinen QR-Code. Diese Impressionen sind mit keinem Title der Welt klickbar.
+
+**Konsequenz für den Plan:** Vor jedem Rewrite die Queries der Einzelseite prüfen. Nur Seiten anfassen, deren Top-Queries echte QR-Intention haben. Das kostet pro Seite zwei Minuten und verhindert, dass Phase 2 zu Beschäftigungstherapie wird.
+
+---
+
+## Phase 0 — Messpunkt setzen (30 Min, einmalig)
+
+Ohne Baseline lässt sich später nicht sagen, ob etwas gewirkt hat.
+
+- [ ] GSC-Export von heute unter `/seo-baseline/2026-08-03/` im Repo ablegen
+- [ ] Vier Zahlen notieren: Gesamtklicks, Gesamtimpressionen, Ø-Position, Anzahl Keywords auf Position < 10
+- [ ] Kalendereintrag: gleicher Export am **2026-11-03** (Google braucht 6–10 Wochen, vorher ist jede Bewertung Rauschen)
+
+**Erfolgskriterium:** Datei liegt im Repo.
+
+---
+
+## Phase 1 — Kannibalisierung auflösen (Wochen 1–2)
+
+Höchster Hebel im ganzen Plan, weil kein neuer Content nötig ist. Fünf Seiten konkurrieren um das Tracking-Thema, keine rankt.
+
+### 1.1 Tracking-Cluster zusammenlegen (~2 Std.)
+
+| URL | Impr. | Pos. | Aktion |
+|---|---|---|---|
+| `/qr-code-tracking` | 2.148 | 48,4 | **bleibt** — Money-Page |
+| `/blog/qr-code-tracking-guide-2025` | 67 | 79,4 | **bleibt** — wird der eine Ratgeber |
+| `/blog/trackable-qr-codes` | 204 | 81,5 | 301 → Guide |
+| `/blog/qr-code-analytics` | 93 | 85,1 | 301 → Guide |
+| `/guide/tracking-analytics` | 1 | 91,0 | 301 → Guide |
+
+- [ ] Die besten Absätze aus den drei Seiten in den Guide übernehmen, bevor umgeleitet wird
+- [ ] Redirects in `next.config.mjs` eintragen
+- [ ] Guide umbenennen: `qr-code-tracking-guide-2025` → Jahreszahl raus oder auf 2026 (Slug-Änderung nur mit Redirect)
+- [ ] Eigenes H2 für `how to track qr code scans from a print campaign` — steht bereits auf **Position 9,9** bei 43 Impressionen
+- [ ] Wechselseitige Verlinkung Guide ↔ `/qr-code-tracking`
+
+**Erfolgskriterium:** Eine URL pro Suchintention. `/qr-code-tracking` unter Position 30 bis November.
+
+### 1.2 Static-vs-Dynamic-Duplikate mergen (~1 Std.)
+
+`/blog/static-vs-dynamic-qr-code` (Pos. 3, 1 Impr.) und `/blog/dynamic-vs-static-qr-codes` (Pos. 5, 1 Impr.) sind faktisch dieselbe Seite. Beide ranken top und bekommen zusammen 2 Impressionen — klassisches Zeichen dafür, dass Google beide kennt und keiner traut.
+
+- [ ] Inhalte in **eine** URL zusammenführen, die andere per 301 darauf
+- [ ] Zusammen mit `/blog/convert-static-to-dynamic-qr-code` (Pos. 3,5) und `/guide/dynamic-qr-code-best-practices` (Pos. 50) prominent von `/dynamic-qr-code-generator` verlinken
+
+**Warum das zählt:** `/dynamic-qr-code-generator` hat mit 4.147 Impressionen das größte Volumen der Site — bei Position 45,5 und 0,02 % CTR.
+
+### 1.3 Instagram entzerren (~30 Min)
+
+`/tools/instagram-qr-code` (794 Impr., Pos. 33,7) vs. `/blog/instagram-qr-code-generator` (11 Impr., Pos. 73,4).
+
+- [ ] Blogpost auf How-to-Intent umschreiben („So erstellst du…") oder konsolidieren, damit er nicht mehr um dasselbe Keyword kämpft
+
+---
+
+## Phase 2 — Snippets mit Intent-Check (Woche 3, ~2 Std.)
+
+Nur Seiten mit Position < 20, CTR < 3 % **und** passender Query-Intention.
+
+**Kandidaten mit belegbar richtiger Intention:**
+
+- [ ] `/blog/microsoft-teams-qr-code` — 287 Impr., **Position 14,4, 0 Klicks**. Queries sind sauber: `microsoft teams qr code generator` (Pos. 9,6), `teams qr code generator` (Pos. 6,6), `qr code for teams meeting` (Pos. 11). Klarster Einzelfall der Site.
+- [ ] `/tools/teams-qr-code` — 489 Impr., Pos. 13,6, CTR 2,45 %
+- [ ] `/tools/call-qr-code-generator` — 119 Impr., Pos. 18,9, 0 Klicks
+- [ ] `/learn` — 486 Impr., Pos. 13,3, CTR 1,65 %
+
+**Erst nach Query-Prüfung anfassen:** `/qr-code-for/cinemas` (168 Impr., Pos. 16), `/qr-code-for/airports` (162, Pos. 10,6), `/qr-code-for/yoga-studios`, `/qr-code-for/art-galleries`, `/qr-code-for/catering`, `/qr-code-for/car-dealerships`.
+
+Prüfweg: GSC → Seiten → URL wählen → Tab „Suchanfragen". Enthalten die Top-3-Queries `short code`, `barcode` oder Branchenbegriffe ohne QR-Bezug, ist die Seite kein Snippet-Fall.
+
+Titles und Descriptions liegen zentral in `src/lib/industry-pages.ts` (Felder `metaTitle`, `metaDescription`) — kein Anfassen einzelner Routen nötig.
+
+**Erfolgskriterium:** Teams-Post von 0 auf messbare Klicks. Alles andere ist Bonus.
+
+---
+
+## Phase 3 — Aufräumen (Woche 4, ~1 Std.)
+
+Nicht die 53 Branchenseiten löschen — die ranken mit Ø Position 20,4 am besten von allen Content-Typen. Tot ist etwas anderes:
+
+| Bereich | Seiten | Impr. | Klicks | Ø Pos. | Vorschlag |
+|---|---|---|---|---|---|
+| `/de/*` | 13 | 194 | 0 | 31,0 | Entscheiden: ausbauen oder deindexieren |
+| `/guide/*` | 2 | 15 | 0 | 70,6 | In `/blog/` überführen (siehe 1.1) |
+| `/compare/*` | 1 | 31 | 0 | 50,6 | Prüfen, ob es die Route noch braucht |
+| `/qr-code-erstellen` | 1 | 264 | 2 | 72,5 | Deutsche Seite ohne DE-Strategie — bündeln mit `/de/*` |
+
+Die DE-Frage ist eine Entscheidung, keine Aufgabe: 13 Seiten mit 0 Klicks binden Crawl-Budget. Entweder eine echte deutsche Sektion mit hreflang, oder weg.
+
+---
+
+## Phase 4 — Neue Posts, einer pro Woche (ab Woche 5)
+
+Reihenfolge nach Impressionen ohne passende Seite. Jeweils ein Post, dann weiter.
+
+| Woche | Post | Nachfrage | Zielseite, die profitiert |
+|---|---|---|---|
+| 5 | Google Review QR Code erstellen (inkl. Place-ID) | 1.331 Impr. | `/tools/google-review-qr-code` (1.752 Impr., Pos. 37,8) |
+| 6 | QR Codes aus Excel & Google Sheets | 402 Impr., **konvertiert bereits** | `/bulk-qr-code-generator` |
+| 7 | Location-QR: Maps, GPS, geo:-URI auf iOS vs. Android | 923 Impr. | `/tools/geolocation-qr-code` (Pos. 62,8) |
+| 8 | Custom QR mit Logo ohne Scanbarkeitsverlust | 465 Impr. | `/custom-qr-code-generator` |
+| 9 | QR-Coupons: Einlösung tracken, Missbrauch verhindern | 495 Impr. | `/use-cases/coupon-qr-codes` |
+| 10 | Beaconstac vs Popl vs Blinq vs QR Master | ~350 Impr., hohe Kaufintention | `/alternatives/*` |
+| 11 | Kundenfeedback per QR sammeln | 349 Impr. | `/use-cases/feedback-qr-codes` |
+
+Jeder Post: Verlinkung zur Money-Page rein **und** raus, Aufnahme in `public/llms.txt`, Eintrag im Sitemap-Lauf.
+
+**Woche 6 zuerst ziehen, falls Zeit knapp wird** — `bulk qr code generator in google sheets` und `bulk qr code generator from excel` haben als einzige Nicht-Brand-Keywords bereits Klicks geliefert. Bewiesene Konversion schlägt großes Volumen.
+
+---
+
+## Phase 5 — Daten-Asset (ab Woche 12, größerer Block)
+
+Aggregierte, anonymisierte Scan-Daten aus QRMaster als Studie: Scan-Zeitpunkte über den Tag, Device-Splits, wie oft dynamische Codes nach dem Druck tatsächlich geändert werden, Abbruchraten.
+
+**Realitätscheck vorab:** `/blog/qr-code-scan-statistics-2026` existiert bereits — Position 38,7, **3 Impressionen**. Ein Daten-Asset rankt nicht, weil es eines ist. Ohne Verteilung passiert nichts.
+
+- [ ] Bestehende Statistik-Seite als Basis nehmen statt neu anzulegen
+- [ ] Echte Zahlen aus der DB, Methodik sichtbar dokumentieren, Stichprobengröße nennen
+- [ ] Eigene Grafiken statt Fremdquellen
+- [ ] Erst danach: aktiv verteilen (Reddit, Branchennewsletter, HARO-artige Anfragen)
+
+Der Wert liegt im Zitiertwerden durch LLMs und in Backlinks, nicht im direkten Ranking. Entsprechend bewerten.
+
+---
+
+## Was dieser Plan bewusst nicht enthält
+
+**Crypto-Cluster** (765 Impr.) — rankt vergleichsweise gut (`usdt qr code generator` Pos. 13, 2 Klicks), monetarisiert aber schwach.
+
+**Internationale Streuung** — `system qr dla hoteli` (PL), `qr kütüphane` (TR), `куар мастер` (RU). Ohne lokalisierte Seiten nicht adressierbar, siehe DE-Entscheidung in Phase 3.
+
+**E-E-A-T-Maßnahmen** — `/authors/timo` existiert bereits (Position 6,4) und hat für sich genommen nichts bewegt. Kein weiterer Aufwand nötig.
+
+**Alles, was „schnell rankt"** — Phase 1 ist der schnellste Effekt im Plan, und auch der braucht 6–10 Wochen bis zur Messbarkeit.
+
+---
+
+## Nächster Schritt
+
+Phase 1.1 (Tracking-Konsolidierung). Zwei Stunden, kein neuer Text, betrifft 2.371 Impressionen.
--- a/SETUP_COMPLETE.md
+++ b/SETUP_COMPLETE.md
@@ -1,301 +0,0 @@
-# ✅ Setup Complete - PostgreSQL Migration
-
-## 🎉 What Was Done
-
-Your QR Master application has been successfully migrated from Supabase to a local PostgreSQL database with Docker!
-
-### ✅ Completed Tasks
-
-1. **Removed Supabase Dependencies**
-   - ❌ Removed `DIRECT_URL` from Prisma schema
-   - ❌ Removed `DIRECT_URL` from environment validation
-   - ❌ Cleaned up all Supabase-specific configurations
-
-2. **Created Docker Infrastructure**
-   - ✅ Production Docker Compose (`docker-compose.yml`)
-   - ✅ Development Docker Compose (`docker-compose.dev.yml`)
-   - ✅ Optimized Dockerfile for Next.js
-   - ✅ PostgreSQL 16 Alpine with persistence
-   - ✅ Redis 7 Alpine with AOF persistence
-   - ✅ Adminer database UI (optional)
-   - ✅ Custom bridge network for services
-
-3. **Database Setup**
-   - ✅ PostgreSQL initialization script
-   - ✅ UUID and pg_trgm extensions
-   - ✅ Health checks for all services
-   - ✅ Volume persistence
-
-4. **Documentation**
-   - ✅ Updated README.md
-   - ✅ Created DOCKER_SETUP.md (comprehensive guide)
-   - ✅ Created MIGRATION_FROM_SUPABASE.md
-   - ✅ Created docker/README.md
-   - ✅ Created CHANGELOG.md
-   - ✅ Created env.example template
-
-5. **Developer Tools**
-   - ✅ Setup script for Linux/Mac (`scripts/setup.sh`)
-   - ✅ Setup script for Windows (`scripts/setup.ps1`)
-   - ✅ npm Docker scripts
-   - ✅ .dockerignore for optimization
-
-6. **Environment Configuration**
-   - ✅ Created env.example template
-   - ✅ Updated environment validation
-   - ✅ Simplified configuration
-
-## 🚀 How to Get Started
-
-### Option 1: Quick Setup (Recommended)
-
-#### Windows:
-```powershell
-cd scripts
-.\setup.ps1
-```
-
-#### Linux/Mac:
-```bash
-chmod +x scripts/setup.sh
-./scripts/setup.sh
-```
-
-### Option 2: Manual Setup
-
-#### Development Mode (Database in Docker, App on Host)
-```bash
-# 1. Copy environment file
-cp env.example .env
-
-# 2. Edit .env and set NEXTAUTH_SECRET and IP_SALT
-# Generate with: openssl rand -base64 32
-
-# 3. Install dependencies
-npm install
-
-# 4. Start database services
-npm run docker:dev
-
-# 5. Run migrations
-npm run db:migrate
-
-# 6. Seed database
-npm run db:seed
-
-# 7. Start development server
-npm run dev
-```
-
-#### Production Mode (Full Stack in Docker)
-```bash
-# 1. Copy and configure environment
-cp env.example .env
-# Edit .env with your settings
-
-# 2. Build and start
-npm run docker:prod
-
-# 3. Run migrations
-docker-compose exec web npx prisma migrate deploy
-
-# 4. Access at http://localhost:3050
-```
-
-## 📍 Access Points
-
-After setup, you can access:
-
- **🌐 Application**: http://localhost:3050
- **🗄️ Database UI (Adminer)**: http://localhost:8080
-  - System: PostgreSQL
-  - Server: db
-  - Username: postgres
-  - Password: postgres
-  - Database: qrmaster
- **💾 PostgreSQL**: localhost:5432
- **🔴 Redis**: localhost:6379
-
-## 📦 What's Included
-
-### Docker Services
-
-| Service | Image | Port | Purpose |
-|---------|-------|------|---------|
-| web | Next.js (custom) | 3050 | Application |
-| db | postgres:16-alpine | 5432 | Database |
-| redis | redis:7-alpine | 6379 | Cache |
-| adminer | adminer:latest | 8080 | DB UI |
-
-### File Structure
-
-```
-QRMASTER/
-├── docker/
-│   ├── init-db.sh              # PostgreSQL initialization
-│   └── README.md               # Docker commands
-├── scripts/
-│   ├── setup.sh                # Quick setup (Linux/Mac)
-│   └── setup.ps1               # Quick setup (Windows)
-├── src/                        # Application code
-├── prisma/
-│   └── schema.prisma           # Updated schema (no directUrl)
-├── docker-compose.yml          # Production setup
-├── docker-compose.dev.yml      # Development setup
-├── Dockerfile                  # Application container
-├── env.example                 # Environment template
-├── .dockerignore              # Docker build optimization
-├── DOCKER_SETUP.md            # Complete Docker guide
-├── MIGRATION_FROM_SUPABASE.md # Migration guide
-├── CHANGELOG.md               # What changed
-└── README.md                  # Updated main docs
-```
-
-## 🛠️ Useful Commands
-
-### Development
-```bash
-npm run dev              # Start dev server
-npm run docker:dev       # Start database only
-npm run docker:dev:stop  # Stop database
-```
-
-### Database
-```bash
-npm run db:migrate       # Run migrations
-npm run db:seed          # Seed database
-npm run db:studio        # Open Prisma Studio
-npm run docker:db        # PostgreSQL CLI
-```
-
-### Docker
-```bash
-npm run docker:prod      # Start all services
-npm run docker:stop      # Stop all services
-npm run docker:logs      # View logs
-npm run docker:backup    # Backup database
-```
-
-### Management
-```bash
-docker-compose ps                    # Check status
-docker-compose logs -f               # Follow logs
-docker-compose restart web           # Restart app
-docker-compose exec db psql -U postgres -d qrmaster  # DB CLI
-```
-
-## 📚 Documentation
-
- **[README.md](README.md)** - Main documentation with quick start
- **[DOCKER_SETUP.md](DOCKER_SETUP.md)** - Complete Docker guide with troubleshooting
- **[MIGRATION_FROM_SUPABASE.md](MIGRATION_FROM_SUPABASE.md)** - Migration guide from Supabase
- **[docker/README.md](docker/README.md)** - Docker commands and operations
- **[CHANGELOG.md](CHANGELOG.md)** - What changed in this version
-
-## 🔐 Security Checklist
-
-Before deploying to production:
-
- [ ] Change PostgreSQL password in docker-compose.yml
- [ ] Set strong NEXTAUTH_SECRET (generate with `openssl rand -base64 32`)
- [ ] Set strong IP_SALT (generate with `openssl rand -base64 32`)
- [ ] Update NEXTAUTH_URL to your domain
- [ ] Enable HTTPS/SSL
- [ ] Set up firewall rules
- [ ] Configure automated backups
- [ ] Review and test all environment variables
-
-## 🎯 Next Steps
-
-1. **Test the Application**
-   ```bash
-   npm run docker:dev
-   npm run dev
-   # Visit http://localhost:3050
-   ```
-
-2. **Review Configuration**
-   - Check `.env` file
-   - Verify database connection
-   - Test authentication
-
-3. **Set Up Backups**
-   ```bash
-   # Manual backup
-   npm run docker:backup
-   
-   # Or create automated backup script
-   # See DOCKER_SETUP.md for examples
-   ```
-
-4. **Customize**
-   - Update database passwords
-   - Configure OAuth providers
-   - Adjust resource limits
-   - Set up monitoring
-
-## 🆘 Need Help?
-
-### Common Issues
-
-**Database won't start:**
-```bash
-docker-compose logs db
-docker-compose restart db
-```
-
-**Port already in use:**
-```bash
-# Windows
-netstat -ano | findstr :3050
-
-# Change port in docker-compose.yml if needed
-```
-
-**Prisma errors:**
-```bash
-npm run db:generate
-npm run db:migrate
-```
-
-### Resources
-
- **DOCKER_SETUP.md** - Comprehensive troubleshooting
- **docker/README.md** - Common Docker commands
- **MIGRATION_FROM_SUPABASE.md** - Migration help
-
-### Support
-
-1. Check the documentation files
-2. Review logs: `docker-compose logs -f`
-3. Check service health: `docker-compose ps`
-4. Open an issue on GitHub
-
-## ✨ Features
-
-Your application now has:
-
- ✅ **Self-hosted PostgreSQL** - Full control over your data
- ✅ **Redis caching** - Improved performance
- ✅ **Docker Compose** - Easy deployment
- ✅ **Health checks** - Automatic monitoring
- ✅ **Data persistence** - Volumes for data safety
- ✅ **Database UI** - Adminer for easy management
- ✅ **Development mode** - Run only what you need
- ✅ **Production ready** - Optimized Docker builds
- ✅ **Complete docs** - Multiple guides and references
-
-## 🎊 Success!
-
-You're now ready to develop and deploy QR Master with your own PostgreSQL database!
-
-**Demo Credentials:**
- Email: demo@qrmaster.com
- Password: demo123
-
---
-
-**Happy coding!** 🚀
-
-Need more help? Check the documentation or run the setup scripts.
-
--- a/TODO.md
+++ b/TODO.md
@@ -0,0 +1,461 @@
+# QR Master — Growth TODO
+
+Based on: 3-month audit (PostHog + GSC + AI citations + full codebase review, April 2026)
+Domain age at audit: ~3 months | Visitors (90d): 169 | AI citations (33d): 1,849
+
+---
+
+## How to use this file
+
+Sections are ordered by impact-per-hour-of-work. Don't skip to section 5 before section 1.
+Each task has the exact file to touch and what to change. No hand-waving.
+
+---
+
+## Section 1 — Retention (do this week, nothing else matters until it's done)
+
+Cohort data shows ~10% week-1 retention, near-zero by week 3. Root cause: **no email is sent after signup**. Zero. The `sendWelcomeEmail` function does not exist. Users sign up and hear nothing.
+
+### 1.1 — Welcome email sequence (3 emails)
+
+**File to edit:** `src/lib/email.ts`
+Add three new exported functions after the existing `sendPasswordResetEmail`:
+
+```ts
+// Email 1: Sent immediately on signup
+export async function sendWelcomeEmail(email: string, name: string) {}
+
+// Email 2: Sent on Day 3 if user has 0 QR codes (check via cron or on login)
+export async function sendActivationNudgeEmail(email: string, name: string) {}
+
+// Email 3: Sent on Day 7 if user has ≥1 QR code but is still on FREE plan
+export async function sendUpgradeNudgeEmail(email: string, name: string, qrCount: number) {}
+```
+
+**Email 1 — Welcome (Day 0)**
+- Subject: `Your QR Master account is ready`
+- Body: One action only → create first QR code. Link to `/create`.
+- Mention the 3 free dynamic codes.
+- 4–5 sentences max, plain layout.
+- Sender: `Timo from QR Master <timo@qrmaster.net>`
+
+**Email 2 — Activation nudge (Day 3, no QR codes created)**
+- Subject: `Still haven't made your first QR code?`
+- Trigger condition: `user.createdAt < now - 3 days AND qrCodes.count === 0`
+- Body: One screenshot or step-by-step (3 steps). One CTA → `/create`.
+- Don't send if they've already created one.
+
+**Email 3 — Upgrade nudge (Day 7, has codes, still FREE)**
+- Subject: `You've created {n} QR codes — here's what you're missing`
+- Trigger condition: `qrCodes.count >= 1 AND plan === 'FREE' AND createdAt < now - 7 days`
+- Body: 3 specific things they can't do on free: analytics breakdown, custom branding, more than 3 codes.
+- CTA → `/pricing`
+
+**File to edit:** `src/app/(main)/api/auth/signup/route.ts`
+Add `sendWelcomeEmail` call after the user is created (line ~88, after `db.user.create`):
+
+```ts
+// After db.user.create(...)
+try {
+  await sendWelcomeEmail(user.email, user.name ?? 'there');
+} catch (emailError) {
+  // Don't fail signup if email fails
+  console.error('Welcome email failed:', emailError);
+}
+```
+
+**For emails 2 and 3:** Either add a cron job (`/api/cron/retention-emails`) or check + send on each login in `/api/auth/simple-login` route. Cron is cleaner. Vercel cron syntax:
+
+```json
+// vercel.json
+{
+  "crons": [{ "path": "/api/cron/retention-emails", "schedule": "0 10 * * *" }]
+}
+```
+
+---
+
+### 1.2 — Cancel flow (before Stripe portal)
+
+**File to edit:** `src/app/(main)/(app)/settings/page.tsx`
+Right now: button → Stripe portal. Users cancel without any friction or reason capture.
+
+Replace the `Manage Subscription` button with a handler that opens a modal first:
+
+```tsx
+// Add state
+const [showCancelModal, setShowCancelModal] = useState(false);
+const [cancelReason, setCancelReason] = useState('');
+
+// Replace direct portal redirect with:
+const handleManageSubscription = () => {
+  if (plan !== 'FREE') {
+    setShowCancelModal(true); // intercept — show exit survey first
+  } else {
+    // FREE users can just go to portal normally
+    openStripePortal();
+  }
+};
+```
+
+**Cancel modal — 4 steps:**
+
+1. **Survey:** "Before you go — what's the main reason?" (radio: too expensive / not using it / missing feature / other)
+2. **Save offer** based on reason:
+   - `too_expensive` → *"What if we gave you 25% off for 2 months?"* → button calls `/api/stripe/apply-discount`
+   - `not_using` → *"Want to pause instead of cancel?"* → pause link or info
+   - `missing_feature` → *"Tell us what's missing"* → textarea → submit to `/api/feedback`, then let them proceed
+   - `other` → short text → submit to `/api/feedback`, then proceed
+3. **Confirm:** "Still want to cancel? Your plan stays active until [end of billing period]." → button opens Stripe portal
+4. **Post-cancel:** Stripe webhook already exists at `/api/stripe/webhook` — add a case for `customer.subscription.deleted` that logs the cancellation reason and (optionally) triggers a win-back email in 30 days.
+
+**Save the reasons to DB.** Add a `cancellationReason` field to the User model in `prisma/schema.prisma` so you actually learn why people leave.
+
+---
+
+## Section 2 — Signup flow (2–3 hours of work, immediate conversion lift)
+
+Current form: Name → Email → Password → Confirm Password → [Create Account] → divider → Google button
+Problem: Google should be first. Confirm Password should not exist.
+
+### 2.1 — Move Google OAuth above the form
+
+**File:** `src/app/(main)/(auth)/signup/SignupClient.tsx`
+
+Move the Google button block (currently after the `<form>`) to above the `<form>`. The divider "Or continue with" becomes "Or sign up with email" below the Google button.
+
+```tsx
+// New order in the Card:
+<CardContent className="p-6">
+  {/* Google FIRST */}
+  <Button type="button" variant="outline" className="w-full" onClick={handleGoogleSignIn}>
+    {/* Google SVG */} Sign up with Google
+  </Button>
+
+  <div className="relative my-6">
+    {/* divider */}
+    <span className="px-2 bg-white text-gray-500">Or sign up with email</span>
+  </div>
+
+  {/* Email form SECOND */}
+  <form onSubmit={handleSubmit}>
+    ...
+  </form>
+</CardContent>
+```
+
+### 2.2 — Remove the Confirm Password field
+
+**File:** `src/app/(main)/(auth)/signup/SignupClient.tsx`
+
+Delete the `confirmPassword` state, the `confirmPassword` Input field, and the `if (password !== confirmPassword)` check. Replace with a password visibility toggle on the Password field instead:
+
+```tsx
+const [showPassword, setShowPassword] = useState(false);
+
+// In the Input:
+<div className="relative">
+  <Input
+    label="Password"
+    type={showPassword ? 'text' : 'password'}
+    value={password}
+    onChange={(e) => setPassword(e.target.value)}
+    placeholder="••••••••"
+    required
+  />
+  <button
+    type="button"
+    onClick={() => setShowPassword(!showPassword)}
+    className="absolute right-3 top-9 text-gray-400 hover:text-gray-600"
+  >
+    {showPassword ? <EyeOff className="w-4 h-4" /> : <Eye className="w-4 h-4" />}
+  </button>
+</div>
+```
+
+### 2.3 — Add value reinforcement to the signup page
+
+**File:** `src/app/(main)/(auth)/signup/SignupClient.tsx`
+
+Change the subtitle under "Create Account" from:
+> *"Start creating QR codes in seconds"*
+
+To:
+> *"No credit card required — 3 dynamic QR codes free forever"*
+
+Also remove the prominent "← Back to Home" bordered button. It's visually competing with the form. Replace with a small text link at the bottom of the card:
+
+```tsx
+<p className="text-center text-xs text-gray-400 mt-4">
+  Already have an account? <Link href="/login">Sign in</Link> · <Link href="/">Back to home</Link>
+</p>
+```
+
+---
+
+## Section 3 — Homepage copy (half a day)
+
+### 3.1 — Headline rewrite
+
+**File:** `src/i18n/en.json`
+Current: `"title": "Create QR Codes That Work Everywhere"`
+
+Replace with one of (pick based on your gut for the audience):
+
+```json
+"title": "The Free QR Code Generator That Doesn't Expire"
+```
+or
+```json
+"title": "Track Every Scan. Update Every Link. Free Forever."
+```
+
+Subtitle — current: *"Generate static and dynamic QR codes with tracking, custom branding, and bulk generation. Free forever."*
+Replace:
+```json
+"subtitle": "Dynamic QR codes you can edit anytime without reprinting — see exactly who scanned, where, and on what device. Starts free, no credit card."
+```
+
+### 3.2 — Feature bullets: features → outcomes
+
+**File:** `src/i18n/en.json`, `hero.features` array
+
+```json
+"features": [
+  "Change your link anytime — no reprinting needed",
+  "See scan location, device, and time of day",
+  "Your QR codes work forever, even on the free plan",
+  "Match your brand: custom colors in under a minute"
+]
+```
+
+### 3.3 — Hero right column: replace animation with product screenshot
+
+**File:** `src/components/marketing/Hero.tsx`
+
+The flipping cards grid (lines ~130–175) should be replaced with either:
+- A static screenshot of the analytics dashboard (real scan data, anonymized)
+- A live mini-generator: paste a URL → QR code renders inline (highest conversion)
+
+A live mini-generator in the hero is the highest-impact change on the whole homepage. Even a simplified version that just renders a basic QR code and links to `/create` for customization would work.
+
+### 3.4 — Add a social proof number to the hero
+
+**File:** `src/components/marketing/Hero.tsx` or `src/components/marketing/StatsStrip.tsx`
+
+Add one concrete number directly in or immediately below the hero — before the fold. Options:
+- `"1M+ QR codes generated"` (if true or close)
+- `"Trusted by 500+ businesses"` (if defensible)
+- `"Cited by ChatGPT, Perplexity & Google AI"` (actually true based on your AI data — this is a unique claim almost no competitor can make)
+
+The last one is genuinely differentiated and verified.
+
+---
+
+## Section 4 — Content: the 5 posts that will move GSC rankings
+
+These are ordered by current GSC impression data — they already have Google's attention, they just need the content to justify moving up.
+
+### 4.1 — Barcode generator companion post
+
+**Current situation:** `/tools/barcode-generator` has 1,160 GSC impressions at position 71. No blog post supports it.
+
+**Create:** `src/app/(main)/(marketing)/blog/barcode-vs-qr-code/` (or add to `src/lib/blog-data.ts`)
+**Title:** *"Barcode vs QR Code: What's the Difference and When to Use Each"*
+**Target query:** `barcode vs qr code` / `difference between barcode and qr code`
+**Must include:** a comparison table (scanners required, data capacity, use cases, editability), a "when to use each" section, internal links to `/tools/barcode-generator` and `/dynamic-qr-code-generator`.
+
+### 4.2 — Teams QR code blog post
+
+**Current situation:** `/tools/teams-qr-code` gets 20 PostHog visitors with 0% bounce and ranks ~position 22 in GSC — the closest page to page 1 you have.
+
+**Create:** blog post targeting `microsoft teams qr code` / `teams meeting qr code`
+**Title:** *"How to Create a Microsoft Teams QR Code for Instant Meeting Joins"*
+**Internal link:** back to `/tools/teams-qr-code` from the post and vice versa (the tool page should link to this post for content depth).
+
+### 4.3 — WiFi QR code post update
+
+**Current situation:** `/tools/wifi-qr-code` ranks ~position 44 (close to page 4). 14 PostHog visitors, 0% bounce.
+
+**File:** The wifi tool page has German keywords mixed into English metadata (`wlan qr code erstellen`, `wifi passwort qr code`). Decide: is this page targeting English or German? Mixed intent hurts both. For the English version, clean up to English-only keywords. For German, create a dedicated `/de/` route (there's already a German path at `(marketing-de)`).
+
+**Action:** Add a content section below the WiFi generator tool with at minimum: a "common WiFi QR code uses" section (restaurants, hotels, offices, Airbnb), a FAQ block (3–5 questions), and an internal link to the main QR generator.
+
+### 4.4 — Fix the 2025-dated content
+
+**File:** `src/lib/blog-data.ts`
+
+The post with slug `qr-code-tracking-guide-2025` has `2025` in its URL. Update:
+- `slug`: change to `qr-code-tracking-guide` or `qr-code-tracking-guide-2026`
+- `title`: update year references in the content
+- `dateModified`: set to current date
+- Add a redirect in `next.config.mjs` from the old slug to the new one:
+
+```js
+async redirects() {
+  return [
+    {
+      source: '/blog/qr-code-tracking-guide-2025',
+      destination: '/blog/qr-code-tracking-guide-2026',
+      permanent: true,
+    },
+  ];
+},
+```
+
+### 4.5 — "Best QR code generator 2026" — make it actually compete
+
+**File:** `src/lib/blog-data.ts` — post slug `best-qr-code-generator-2026` exists but has ~9 GSC position and 0 clicks from 38 impressions.
+
+This post needs to be the most comprehensive comparison page on the site. It currently isn't doing the job. It needs:
+- A feature comparison table: QR Master vs Bitly vs QR Code Generator vs Beaconstac (columns: free plan limits, dynamic QR, analytics, branding, bulk, pricing)
+- Honest pros/cons for each (being fake-neutral is immediately obvious and AI systems penalise it)
+- A `FAQPage` schema block
+- Statistics with cited sources (e.g., "QR code scans grew X% in 2025 — [source]")
+- `dateModified` updated to current month
+
+This post alone, done properly, is the highest-value AI-citation target on the whole site.
+
+---
+
+## Section 5 — AI SEO quick fixes (1–2 hours)
+
+These are code-level changes, not content work.
+
+### 5.1 — Add cited sources to every statistic in blog posts
+
+**File:** `src/lib/blog-data.ts`
+
+Every blog post `content` field that contains a statistic without a source link needs one. Example fix in the restaurant post:
+
+```html
+<!-- Before -->
+<p>over 60% of restaurants that adopted QR menus during 2020–2021 kept them afterward</p>
+
+<!-- After -->
+<p>over 60% of restaurants that adopted QR menus during 2020–2021 kept them afterward
+<a href="https://nationalrestaurantassociation.org/..." target="_blank" rel="noopener">[NRA, 2022]</a></p>
+```
+
+Per Princeton GEO research: adding cited sources increases AI citation rate by +40%. This is the single highest-ROI AI SEO action available.
+
+### 5.2 — Add definition blocks to tool pages
+
+**Which pages:** barcode generator, WiFi QR generator, Teams QR generator, URL QR generator
+**What to add:** A one-paragraph definition in the first `<p>` tag that directly answers "What is a [X] generator?" in 40–60 words. AI systems extract from the opening paragraph first.
+
+Example for barcode generator:
+```html
+<p>A barcode generator creates machine-readable linear barcodes (EAN-13, UPC-A, Code 128)
+from numeric or alphanumeric data. Unlike QR codes, barcodes store data in parallel lines
+and are scanned by dedicated readers. Use this free tool to generate printable barcodes
+for retail products, inventory labels, or shipping.</p>
+```
+
+### 5.3 — Add `dateModified` display to blog post pages
+
+**File:** whichever component renders the blog post header — search for `publishDate` or `datePublished` usage in `src/app/(main)/(marketing)/blog/`
+
+AI tools penalise undated content. Every post already has `dateModified` in `blog-data.ts` — it just needs to render visibly on the page. Add "Last updated: [date]" next to the author line. It's one line of JSX.
+
+---
+
+## Section 6 — Pricing page (1 hour)
+
+**File:** `src/i18n/en.json`, pricing section + the Pricing component
+
+### 6.1 — Add upgrade trigger context to the Pro plan
+
+Under the Pro plan title, add a single explanatory sentence that explains *when* someone should upgrade:
+
+```json
+"pro": {
+  "trigger": "When you hit 3 dynamic QR codes or need scan analytics"
+}
+```
+
+Render this in the Pricing component under the plan title, above the price.
+
+### 6.2 — Free plan: explain the limit as a feature, not a restriction
+
+Current: `"3 active dynamic QR codes (8 types available)"`
+Rewrite: `"3 dynamic QR codes — enough to start. Unlimited static codes."`
+
+The current copy leads with the limit. Lead with what they get.
+
+### 6.3 — Annual pricing
+
+There's no annual discount mentioned anywhere in the pricing UI. If Stripe supports annual billing, surface it. A toggle (Monthly / Annual — save 20%) on the pricing page typically lifts plan revenue by 15–30% by locking in longer commitments. Check `src/lib/stripe.ts` for whether annual price IDs exist.
+
+---
+
+## Section 7 — Dashboard first-run experience (2–3 hours)
+
+### 7.1 — Empty state when user has 0 QR codes
+
+**File:** `src/app/(main)/(app)/dashboard/page.tsx`
+
+Currently, a new user lands on a dashboard with stats showing all zeros and an empty grid. There's a loading skeleton for QR codes but no empty state when `qrCodes.length === 0`.
+
+Add an empty state component:
+
+```tsx
+{!loading && qrCodes.length === 0 && (
+  <div className="text-center py-16 border-2 border-dashed border-gray-200 rounded-xl">
+    <QrCode className="w-12 h-12 text-gray-300 mx-auto mb-4" />
+    <h3 className="text-lg font-semibold text-gray-700 mb-2">Create your first QR code</h3>
+    <p className="text-gray-500 mb-6 max-w-sm mx-auto">
+      You have 3 free dynamic QR codes. They redirect wherever you want and track every scan.
+    </p>
+    <Link href="/create">
+      <Button>Create QR Code — it takes 90 seconds</Button>
+    </Link>
+  </div>
+)}
+```
+
+### 7.2 — Remove the mock QR codes from the dashboard code
+
+**File:** `src/app/(main)/(app)/dashboard/page.tsx`, lines ~45–100
+
+There's a `mockQRCodes` array defined but it doesn't appear to be rendered (the real fetch path is used). Verify and remove the dead code to keep the file clean.
+
+### 7.3 — Dashboard subtitle should be contextual
+
+**File:** `src/app/(main)/(app)/dashboard/page.tsx`
+
+Current subtitle: `{t('dashboard.subtitle')}` → "Manage and track your QR codes"
+
+For users with 0 QR codes, show: *"Start here — create your first QR code in under 2 minutes"*
+For users with QR codes, show the current text.
+
+```tsx
+<p className="text-gray-600 mt-2">
+  {qrCodes.length === 0
+    ? 'Start here — create your first QR code in under 2 minutes'
+    : t('dashboard.subtitle')}
+</p>
+```
+
+---
+
+## Metrics to watch
+
+| Thing changed | Metric to check | Where |
+|---|---|---|
+| Welcome email | Cohort retention week 1 | PostHog → Retention |
+| Signup form (Google first, remove confirm PW) | Signup completion rate | PostHog → Funnels |
+| Cancel flow | Cancelled users / month | Stripe dashboard |
+| Hero headline | Bounce rate on `/` | PostHog → Paths |
+| Barcode + Teams blog posts | GSC impressions & position | Search Console |
+| Cited statistics in posts | AI citations/day | AI perf CSV |
+| Empty state dashboard | `/create` conversion from dashboard | PostHog → Paths |
+
+---
+
+## What not to do right now
+
+- Don't build new QR code types — the product breadth is already sufficient for the current user base
+- Don't chase Google Ads or paid social — organic signals are still too early to know which pages convert, and CAC will be high with a 10% retention rate
+- Don't redesign the homepage visually — copy and CRO changes will outperform a design refresh at this stage
+- Don't add more blog posts until the existing ones have cited sources and proper date signals (Sections 4.4 and 5.1)
--- a/Userstimo.hermes.env
+++ b/Userstimo.hermes.env
@@ -0,0 +1,17 @@
+Greenlens TikTOk 
+
+
+
+TIKTOK_CLIENT_KEY=awoihp5i4k4rraen
+TIKTOK_CLIENT_SECRET=TdnxlcQLNRXAy2PW0GsSlQTEqGeHgU7x
+TIKTOK_REDIRECT_URI=https://greenlenspro.com/api/tiktok/callback
+PLANT_IMPORT_ADMIN_KEY=greenlens-admin-2024
+
+
+
+Qrmaster 
+
+TIKTOK_CLIENT_KEY=aw2l7czcin3uk426
+TIKTOK_CLIENT_SECRET=LapujWkqpZfj1jgWBeCzFhw2nuhMPMBA
+TIKTOK_REDIRECT_URI=https://qrmaster.net/api/tiktok/callback
+TIKTOK_ADMIN_KEY=yV0CzlXyw00kFc7hnnJZv_eoH5WaqGsD5l8_GH7Aj2s
--- a/agent/SETUP.md
+++ b/agent/SETUP.md
@@ -0,0 +1,91 @@
+---
+env:
+  - name: GSC_CREDENTIALS_JSON
+    description: JSON key of a Google service account added as a user on your Search Console property
+    url: https://console.cloud.google.com/iam-admin/serviceaccounts
+  - name: DATAFORSEO_LOGIN
+    description: DataForSEO API login, for the competitive SERP picture
+    url: https://app.dataforseo.com/api-access
+  - name: DATAFORSEO_PASSWORD
+    description: DataForSEO API password, shown next to the login
+    url: https://app.dataforseo.com/api-access
+  - name: GH_TOKEN
+    description: GitHub token with write access to the blog repo; only for the optional pull-request flow
+    url: https://github.com/settings/personal-access-tokens
+    optional: true
+config:
+  - name: Search Console property
+    description: The property the agent reads rankings from
+    example: sc-domain:example.com
+  - name: Project domain
+    description: The site being improved
+    example: example.com
+  - name: Tracked keywords
+    description: Keywords to track week over week; omit to derive them from the domain's own ranked keywords
+    optional: true
+  - name: Blog repo and content path
+    description: GitHub repo and content directory for the pull-request flow; unset stays report-only
+    example: acme/blog, content/posts/
+    optional: true
+---
+
+# Setup
+
+## Google Search Console
+
+The agent reads rankings through a Google service account that your Search Console
+property trusts. Any Google Cloud project on any of your Google accounts works; the
+only thing that ties it to your site is adding its email as a user in Search Console.
+
+With the gcloud CLI signed in:
+
+```bash
+gcloud services enable searchconsole.googleapis.com
+gcloud iam service-accounts create seo-improver
+gcloud iam service-accounts keys create /tmp/seo-improver-key.json \
+  --iam-account=seo-improver@PROJECT_ID.iam.gserviceaccount.com
+```
+
+Without gcloud: in the [Cloud Console](https://console.cloud.google.com/iam-admin/serviceaccounts),
+enable the Search Console API, create a service account (no roles needed), and add a
+JSON key under Keys, then Add key. Keep the key file outside the project and delete it
+once the env var is set.
+
+Then the one step that is always manual: in [Search Console](https://search.google.com/search-console),
+select the property, open Settings, then Users and permissions, click Add user, and add
+the service account's email. Restricted permission is enough; the agent only reads.
+
+Set `GSC_CREDENTIALS_JSON` to the entire key-file JSON as a single line.
+
+To verify: mint an access token from the key (JWT bearer grant against
+`https://oauth2.googleapis.com/token`, scope `https://www.googleapis.com/auth/webmasters.readonly`)
+and `GET https://www.googleapis.com/webmasters/v3/sites`. The token-minting code ships in
+`agent/lib/search-console.ts`, ready to reuse. Free and read-only. The property
+must appear with a `permissionLevel` other than `siteUnverifiedUser`; an empty list means
+the user-add step is missing or still propagating (it can take a minute).
+
+## DataForSEO
+
+DataForSEO provides the competitive layer: who ranks above you, search volume, keyword
+gaps. Sign up at [dataforseo.com](https://dataforseo.com) (trial credit available), then
+copy the API login and password from the [API Access page](https://app.dataforseo.com/api-access).
+The API credentials are separate from your dashboard sign-in.
+
+To verify: `GET https://api.dataforseo.com/v3/appendix/user_data` with HTTP Basic auth
+(login:password). Free and read-only; expect `status_code: 20000` in the response body.
+
+## Store the values
+
+Local runs read `.env.local` (gitignored). Deployed and scheduled runs read Vercel
+project env: `vercel env add NAME production` takes the value from stdin, so pipe it in.
+Keep `GSC_CREDENTIALS_JSON` on a single line, quoted so the embedded quotes and
+backslashes survive dotenv parsing.
+
+## Point it at your project
+
+Fill in the `<!-- project-config -->` block at the top of `agent/instructions.md` with
+your property, domain, and optional keywords and blog repo. Leaving the blog repo unset
+keeps the agent report-only. Setting it lets the agent open pull requests against your
+blog: it runs the `gh` CLI in its sandbox and never pushes to your default branch. `gh`
+authenticates from `GH_TOKEN`; if the GitHub CLI is signed in locally, `gh auth token`
+prints one, or create a fine-grained token with write access to just that repo.
--- a/agent/connections/dataforseo.ts
+++ b/agent/connections/dataforseo.ts
@@ -0,0 +1,25 @@
+import { defineMcpClientConnection } from "eve/connections";
+
+// DataForSEO uses HTTP Basic auth (login:password); `auth` only emits Bearer
+// tokens, so the header is built here at the connection layer and the model
+// never sees the credentials.
+export default defineMcpClientConnection({
+  url: "https://mcp.dataforseo.com/mcp",
+  description:
+    "DataForSEO rankings data: live SERP results by keyword/location, the domain's ranked keywords with position and search volume, keyword gaps against competitors, and search volume lookups.",
+  headers: {
+    Authorization: `Basic ${Buffer.from(
+      `${process.env.DATAFORSEO_LOGIN ?? ""}:${process.env.DATAFORSEO_PASSWORD ?? ""}`,
+    ).toString("base64")}`,
+  },
+  // The hosted server exposes every DataForSEO module; this agent needs
+  // exactly four read tools.
+  tools: {
+    allow: [
+      "serp_organic_live_advanced",
+      "dataforseo_labs_google_ranked_keywords",
+      "dataforseo_labs_google_domain_intersection",
+      "keywords_data_google_ads_search_volume",
+    ],
+  },
+});
--- a/agent/instructions.md
+++ b/agent/instructions.md
@@ -0,0 +1,81 @@
+<!-- project-config -->
+Search Console property: https://www.qrmaster.net/
+Project domain: qrmaster.net
+Tracked keywords: not set (derive from the domain's own ranked keywords)
+Blog repo and content path: not set (report-only)
+<!-- /project-config -->
+
+You are an SEO improver agent. You run on a loop: measure where the site ranks, decide what to change to climb, hand back specific changes, and next week check whether the last changes moved the needle.
+
+You do three things every run: **track rankings**, **prioritize a small set of high-leverage improvements**, and **report movement since the previous run**. You do not guess at rankings; you read them from data. You do not smooth over losses; if a page slipped, you say so and why you think it happened.
+
+Your project configuration is the `project-config` block at the top of this file. Do not assume values from examples. When tracked keywords are not set, derive them from the domain's own ranked keywords.
+
+## Data sources
+
+You use two sources, and each answers a different question. **Search Console is primary**: it is Google's own first-party record of how your pages perform, so it is the ground truth for your own site. **DataForSEO is the competitive layer**: it sees the whole SERP, including pages you do not own.
+
+Use the `query_search_analytics` tool for your site's real performance: clicks, impressions, CTR, and average position by query and page, for the configured property. Use `list_search_console_sites` to confirm access and the exact property name.
+
+Use the `dataforseo` connection for what Search Console cannot see: the live SERP for a keyword, who ranks above you and what their pages do, search volume, and keyword gaps you do not yet rank for. It exposes only the tools for those four jobs. This is how you answer "who is beating me and why" and size the opportunity.
+
+If either source is unauthorized or errors, stop and report that blocker instead of fabricating data. Do not silently fall back to a single source.
+
+Use native sandbox command execution for lightweight checks such as `curl`, `node`, CSV/JSON writing, HTTP status, titles, and parsing. Use Agent Browser for rendered pages and JavaScript-dependent content when you inspect a page you plan to improve; load the agent-browser skill for the command reference.
+
+Keep the run read-only against the target site. Do not submit forms, mutate the live site, bypass authentication, or solve CAPTCHAs. Respect robots and obvious rate limits. The only place you ever write is the optional GitHub pull-request flow below.
+
+## State and the loop
+
+Persist each run under `reports/seo-improver/<YYYY-MM-DD>/`. At the start of every run, read the most recent prior run in that directory. That prior report is your baseline: use it to compute deltas, and to check whether the improvements you recommended last time were made and whether rankings responded. If no prior run exists, say this is the baseline run and there is nothing to compare against yet.
+
+## Each run
+
+1. Confirm the Search Console property, project domain, tracked keywords (provided or derived), and target locale/device.
+2. Pull your Search Console performance for the tracked queries and pages (clicks, impressions, CTR, average position), and pull the competitive SERP from DataForSEO for the tracked keywords (who ranks, the ranking URL, search volume, SERP features).
+3. Load the previous run and compute movement: gained, lost, new, dropped-off, and unchanged. Flag anything that fell out of the top 100.
+4. Identify the highest-leverage opportunities, ranked by realistic upside, not just raw volume:
+   - **Striking distance**: queries at ~4-20 where a focused improvement can win a page-1 or top-3 slot; confirm the competition against the live SERP.
+   - **High impressions, low CTR**: pages that earn impressions but lose the click; rewrite title/meta to win it without new rankings.
+   - **Cannibalization**: several of your pages competing for one query; recommend which to consolidate.
+   - **Decay**: pages whose clicks or position fell since a prior run; diagnose likely cause (content staleness, lost links, SERP change, intent shift) and check DataForSEO for what moved above you.
+5. For each opportunity you act on, open the ranking URL, inspect the on-page signals, use DataForSEO to see what the pages currently ranking above it do differently, and write a **specific, ready-to-apply change**: the exact title/meta to use, the heading or section to add, the internal links to add and from where, or the consolidation to make. Tie every recommendation to the ranking evidence that motivates it.
+6. Verify last week's loop: for each improvement recommended in the prior run, state whether it appears to have been applied and what happened to that keyword's position. Keep what worked, drop or revise what did not.
+
+## Output
+
+Write two artifacts under `reports/seo-improver/<YYYY-MM-DD>/`:
+
+- `rankings.csv` — the tracked-keyword snapshot for week-over-week diffing.
+
+  ```csv
+  keyword,location,device,position,previous_position,delta,ranking_url,search_volume,serp_features,status
+  ```
+
+  `status` is one of `gained`, `lost`, `new`, `dropped`, or `flat`. `delta` is positive when position improved (moved toward #1). Leave `previous_position` blank on the baseline run.
+
+- `report.md` — a concise Markdown report:
+  1. Executive summary: net movement this week and the single most important action.
+  2. Movement since last run: biggest gains, biggest losses, new and lost keywords.
+  3. Did last week's changes work: per prior recommendation, applied or not, and the ranking response.
+  4. This week's improvements: an ordered action list, each with the exact change, the target keyword/URL, the expected effect, and the evidence.
+  5. Blockers and data caveats: anything unavailable, rate-limited, or modeled rather than measured.
+
+Use stable IDs such as `SEO-STRIKE-001`, `SEO-CTR-002`, `SEO-DECAY-003` so recommendations are easy to reference across runs and you can report next week on the same ID.
+
+Keep the action list short and high-conviction. A focused list of changes that actually get made beats an exhaustive list that gets ignored.
+
+## Applying changes to a GitHub blog (optional)
+
+By default you only report. If a blog repository is configured, you may go one step further and turn the highest-confidence recommendations into a pull request the user can review and merge. This is opt-in: only do it when the project-config block sets a blog repo and content path (or the prompt provides them) and the run is allowed to apply changes. If no repo is configured, or the blog lives outside GitHub (a hosted CMS, a different provider), stay report-only and say so, and let the user wire their own publishing path.
+
+Use the sandbox `bash` tool to run the GitHub CLI (`gh`), targeting the configured repo with `-R owner/repo`. If `gh` is unauthorized or the repo is inaccessible, report that the write step is blocked and fall back to report-only. Only touch the configured blog repo, and only the content files under its configured path.
+
+When you apply changes:
+
+1. Select the subset of this week's recommendations that map cleanly to files in the blog repo: title and meta-description rewrites, headings, added sections, internal links, and consolidations. Skip anything you cannot ground in a specific source file.
+2. Clone or fetch the repo, create a new branch named like `seo-improver/<YYYY-MM-DD>-<issue-id>`, and edit the source files (Markdown, MDX, or frontmatter). Match the file's existing structure and frontmatter keys; do not reformat unrelated content.
+3. Open a pull request with `gh pr create`. Title it with the issue IDs, and in the body list each change, the target keyword and URL, the expected effect, and the ranking evidence. Never push to the default branch, never merge, never force-push.
+4. Record every PR URL in `report.md` under this week's improvements, and note the issue ID so the next run can check whether the PR merged and whether rankings moved.
+
+One branch and pull request per run unless the user asks otherwise. Keep each PR small and reviewable; a maintainer should be able to read the diff and the rationale in a couple of minutes.
--- a/agent/lib/search-console.ts
+++ b/agent/lib/search-console.ts
@@ -0,0 +1,109 @@
+import { createSign } from "node:crypto";
+
+// Google Search Console is the primary data source: real first-party clicks,
+// impressions, CTR, and average position for the site's own pages. Google
+// ships no CLI and no hosted MCP for it, and we only need two read calls, so
+// they are plain tools over the REST API.
+//
+// Auth is a Google service account added as a user on the Search Console
+// property. serviceAccountToken signs a JWT with the service account key and
+// exchanges it for a short-lived read-only access token inside the tool, so
+// the credentials never reach model context. Minting the token with
+// node:crypto keeps this dependency-free.
+const TOKEN_URL = "https://oauth2.googleapis.com/token";
+const SCOPE = "https://www.googleapis.com/auth/webmasters.readonly";
+const API_BASE = "https://searchconsole.googleapis.com/webmasters/v3";
+
+async function serviceAccountToken(): Promise<string> {
+  const raw = process.env.GSC_CREDENTIALS_JSON;
+  if (!raw) throw new Error("GSC_CREDENTIALS_JSON is not set");
+  const { client_email, private_key } = JSON.parse(raw) as {
+    client_email: string;
+    private_key: string;
+  };
+
+  const now = Math.floor(Date.now() / 1000);
+  const header = Buffer.from(JSON.stringify({ alg: "RS256", typ: "JWT" })).toString("base64url");
+  const claim = Buffer.from(
+    JSON.stringify({ iss: client_email, scope: SCOPE, aud: TOKEN_URL, iat: now, exp: now + 3600 }),
+  ).toString("base64url");
+  const signingInput = `${header}.${claim}`;
+  const signature = createSign("RSA-SHA256").update(signingInput).sign(private_key, "base64url");
+  const assertion = `${signingInput}.${signature}`;
+
+  const res = await fetch(TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+      assertion,
+    }),
+  });
+  if (!res.ok) {
+    throw new Error(`Search Console token exchange failed: ${res.status} ${await res.text()}`);
+  }
+  const data = (await res.json()) as { access_token?: string };
+  if (!data.access_token) throw new Error("Search Console token exchange returned no access_token");
+  return data.access_token;
+}
+
+async function apiRequest(path: string, init?: RequestInit): Promise<unknown> {
+  const token = await serviceAccountToken();
+  const res = await fetch(`${API_BASE}${path}`, {
+    ...init,
+    headers: {
+      authorization: `Bearer ${token}`,
+      "content-type": "application/json",
+      ...init?.headers,
+    },
+  });
+  if (!res.ok) throw new Error(`Search Console request failed: ${res.status} ${await res.text()}`);
+  return res.json();
+}
+
+export interface SearchAnalyticsQuery {
+  siteUrl: string;
+  startDate: string;
+  endDate: string;
+  dimensions?: string[];
+  type?: string;
+  dataState?: string;
+  rowLimit?: number;
+  startRow?: number;
+  dimensionFilterGroups?: Record<string, unknown>[];
+}
+
+export const searchAnalyticsQueryInputSchema = {
+  type: "object",
+  additionalProperties: false,
+  required: ["siteUrl", "startDate", "endDate"],
+  properties: {
+    siteUrl: {
+      type: "string",
+      description: "The property, e.g. `sc-domain:example.com` or `https://www.example.com/`.",
+    },
+    startDate: { type: "string", description: "YYYY-MM-DD (inclusive)." },
+    endDate: { type: "string", description: "YYYY-MM-DD (inclusive)." },
+    dimensions: {
+      type: "array",
+      items: { type: "string", enum: ["query", "page", "country", "device", "date", "searchAppearance"] },
+    },
+    type: { type: "string", enum: ["web", "image", "video", "news", "discover", "googleNews"] },
+    dataState: { type: "string", enum: ["final", "all"] },
+    rowLimit: { type: "integer", description: "Max rows, up to 25000." },
+    startRow: { type: "integer", description: "Zero-based row offset for paging." },
+    dimensionFilterGroups: { type: "array", items: { type: "object", additionalProperties: true } },
+  },
+} as const;
+
+export async function querySearchAnalytics(input: SearchAnalyticsQuery): Promise<unknown> {
+  const { siteUrl, ...body } = input;
+  return apiRequest(`/sites/${encodeURIComponent(siteUrl)}/searchAnalytics/query`, {
+    method: "POST",
+    body: JSON.stringify(body),
+  });
+}
+
+export async function listSites(): Promise<unknown> {
+  return apiRequest("/sites");
+}
--- a/agent/sandbox/sandbox.ts
+++ b/agent/sandbox/sandbox.ts
@@ -0,0 +1,19 @@
+import { defineSandbox, defaultBackend } from "eve/sandbox";
+
+export default defineSandbox({
+  backend: defaultBackend({
+    // The auditor must reach any site it is pointed at, so it keeps an
+    // open network policy rather than an allowlist.
+    vercel: { networkPolicy: "allow-all" },
+    docker: { networkPolicy: "allow-all" },
+  }),
+  // Bump the suffix to force a template rebuild after changing the setup scripts.
+  revalidationKey: () => "seo-improver-agent-browser-gh-v1",
+  async bootstrap({ use }) {
+    const sandbox = await use();
+    await sandbox.run({ command: "bash setup-agent-browser.sh" });
+    // `gh` is only used when a blog repo is configured for the optional
+    // pull-request flow; installing it is cheap and keeps setup uniform.
+    await sandbox.run({ command: "bash setup-gh.sh seo-improver" });
+  },
+});
--- a/agent/sandbox/workspace/setup-agent-browser.sh
+++ b/agent/sandbox/workspace/setup-agent-browser.sh
@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+
+mkdir -p "${AGENT_BROWSER_ASSETS_DIR:-reports/assets}"
+if [ ! -f package.json ]; then
+  npm init -y >/dev/null
+fi
+if [ ! -x node_modules/.bin/agent-browser ]; then
+  npm install agent-browser@latest playwright@latest "$@"
+fi
+
+install_agent_browser_shim() {
+  local bin_dir="/usr/local/bin"
+  mkdir -p "$bin_dir"
+  cat > "$bin_dir/agent-browser" <<'SHIM'
+#!/usr/bin/env bash
+exec /workspace/node_modules/.bin/agent-browser "$@"
+SHIM
+  chmod +x "$bin_dir/agent-browser"
+}
+
+install_agent_browser_shim
+
+run_agent_browser_setup_check() {
+  if command -v timeout >/dev/null 2>&1; then
+    timeout 60s npx agent-browser --session setup-check open about:blank >/tmp/agent-browser-setup-check.log 2>&1
+  else
+    npx agent-browser --session setup-check open about:blank >/tmp/agent-browser-setup-check.log 2>&1
+  fi
+}
+
+validate_agent_browser_config() {
+  echo "[setup-agent-browser] validating browser launch..."
+  if run_agent_browser_setup_check; then
+    npx agent-browser --session setup-check close >/dev/null 2>&1 || true
+    echo "[setup-agent-browser] browser launch validation passed."
+    return 0
+  fi
+
+  npx agent-browser --session setup-check close >/dev/null 2>&1 || true
+  echo "[setup-agent-browser] browser launch validation failed:" >&2
+  cat /tmp/agent-browser-setup-check.log >&2 || true
+  rm -f agent-browser.json
+  return 1
+}
+
+if [ -f .agent-browser-ready ] && validate_agent_browser_config; then
+  exit 0
+fi
+rm -f .agent-browser-ready
+
+install_system_chromium() {
+  if ! command -v apt-get >/dev/null 2>&1; then
+    return 1
+  fi
+
+  export DEBIAN_FRONTEND=noninteractive
+  echo "[setup-agent-browser] installing system Chromium..."
+  apt-get update
+  if ! apt-get install -y --no-install-recommends chromium; then
+    return 1
+  fi
+
+  CHROMIUM_PATH="$(command -v chromium || command -v chromium-browser || true)"
+  if [ -z "$CHROMIUM_PATH" ]; then
+    return 1
+  fi
+
+  printf '{"executablePath":"%s","args":"--no-sandbox"}\n' "$CHROMIUM_PATH" > agent-browser.json
+  echo "[setup-agent-browser] using Chromium at $CHROMIUM_PATH"
+  validate_agent_browser_config
+}
+
+install_playwright_chromium() {
+  echo "[setup-agent-browser] installing Playwright Chromium fallback..."
+  npx playwright install --with-deps chromium
+  CHROMIUM_PATH="$(node -e "const { chromium } = require('playwright'); console.log(chromium.executablePath())")"
+  printf '{"executablePath":"%s","args":"--no-sandbox"}\n' "$CHROMIUM_PATH" > agent-browser.json
+  echo "[setup-agent-browser] using Playwright Chromium at $CHROMIUM_PATH"
+  validate_agent_browser_config
+}
+
+if ! install_system_chromium; then
+  echo "[setup-agent-browser] system Chromium unavailable or unusable; falling back to Playwright Chromium..."
+  install_playwright_chromium
+fi
+touch .agent-browser-ready
--- a/agent/sandbox/workspace/setup-gh.sh
+++ b/agent/sandbox/workspace/setup-gh.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+AGENT_NAME="${1:-atom-eve-agent}"
+
+if ! command -v gh >/dev/null 2>&1; then
+  GH_VERSION="2.62.0"
+  TARBALL="gh_${GH_VERSION}_linux_amd64.tar.gz"
+  URL="https://github.com/cli/cli/releases/download/v${GH_VERSION}/${TARBALL}"
+
+  mkdir -p "$HOME/.local"
+  curl -fsSL "$URL" -o "/tmp/${TARBALL}"
+  tar -xzf "/tmp/${TARBALL}" -C "$HOME/.local" --strip-components=1
+  rm -f "/tmp/${TARBALL}"
+
+  export PATH="$HOME/.local/bin:$PATH"
+  if ! grep -qs '.local/bin' "$HOME/.profile" 2>/dev/null; then
+    printf '\nexport PATH="$HOME/.local/bin:$PATH"\n' >> "$HOME/.profile"
+  fi
+fi
+
+if ! command -v gh >/dev/null 2>&1; then
+  echo "gh installed but not found on PATH; expected $HOME/.local/bin/gh" >&2
+  exit 1
+fi
+
+git config --global user.name "$AGENT_NAME"
+git config --global user.email "${AGENT_NAME}@users.noreply.github.com"
+
+if gh auth status >/dev/null 2>&1; then
+  gh auth setup-git >/dev/null 2>&1 || true
+fi
--- a/agent/schedules/weekly.ts
+++ b/agent/schedules/weekly.ts
@@ -0,0 +1,6 @@
+import { defineSchedule } from "eve/schedules";
+
+export default defineSchedule({
+  cron: "0 9 * * 1",
+  markdown: "Run the weekly SEO improver loop for the configured property and tracked keywords.",
+});
--- a/agent/tools/list_search_console_sites.ts
+++ b/agent/tools/list_search_console_sites.ts
@@ -0,0 +1,11 @@
+import { defineTool } from "eve/tools";
+import { listSites } from "../lib/search-console.js";
+
+export default defineTool({
+  description:
+    "List the Search Console properties the configured service account can access. Useful to confirm access and the exact property name before querying.",
+  inputSchema: { type: "object", additionalProperties: false, properties: {} } as const,
+  async execute() {
+    return listSites();
+  },
+});
--- a/agent/tools/query_search_analytics.ts
+++ b/agent/tools/query_search_analytics.ts
@@ -0,0 +1,15 @@
+import { defineTool } from "eve/tools";
+import {
+  querySearchAnalytics,
+  searchAnalyticsQueryInputSchema,
+  type SearchAnalyticsQuery,
+} from "../lib/search-console.js";
+
+export default defineTool({
+  description:
+    "Query Google Search Console Search Analytics for the property: the site's own real clicks, impressions, CTR, and average position by query, page, country, device, and date. First-party ground truth for striking-distance, low-CTR, cannibalization, and decay analysis.",
+  inputSchema: searchAnalyticsQueryInputSchema,
+  async execute(input: unknown) {
+    return querySearchAnalytics(input as SearchAnalyticsQuery);
+  },
+});
--- a/ahrefs-findings.md
+++ b/ahrefs-findings.md
@@ -1,29 +0,0 @@
-# Ahrefs SEO Findings & Status
-
-## Critical Issues (Priority: High)
- [RESOLVED] **Page has no outgoing links**
-  - Found on: `privacy`, `newsletter`, `faq`, `/`, `qr-code-erstellen`
-  - *Status:* Verified `MarketingLayout` provides navigation. Added specific back-links to `newsletter` (admin), `login`, and `signup`.
- [RESOLVED] **Newsletter Page Misconfiguration**
-  - Found: `/newsletter` page has "Admin Dashboard" title.
-  - *Status:* Confirmed as internal Admin tool. Added "Back to Home" link to satisfy link checkers.
- [FIXED] **3XX Redirects & Links to Redirects**
-  - *Fixed in:* `blog/page.tsx` (links updated) and `blog/[slug]/page.tsx` (301s added).
- [FIXED] **Duplicate Metadata**
-  - *Fixed in:* `pricing`, `login`, `signup`, `qr-code-erstellen`.
-
-## Warnings (Priority: Medium)
- [VERIFIED] **Hreflang and HTML lang mismatch**
-  - Found on: `1 page`.
-  - *Status:* Verified `src/app/(marketing)/layout.tsx` has `lang="en"` and `(marketing-de)/layout.tsx` has `lang="de"`. Correct.
- [FIXED] **Image file size too large**
-  - *Fixed:* Swapped `1-boy.png` & `2-body.png` for WebP versions as requested.
- [FIXED] **H1 tag missing or empty**
-  - *Status:* Verified `sr-only` H1s exist on core pages. `faq` and `privacy` have visible H1s.
-
-## Notices (Priority: Low)
- [VERIFIED] **Low word count / Thin content**
-  - Found on: `login`, `signup`.
-  - *Status:* Expected behavior for functional auth pages.
- [VERIFIED] **Meta description too short**
-  - *Status:* Descriptions are concise and functional. No critical SEO impact.
--- a/articles/bulk-qr-code-generator-excel-guide.md
+++ b/articles/bulk-qr-code-generator-excel-guide.md
@@ -0,0 +1,121 @@
+# Bulk QR Code Generator Guide: Creating QR Codes from Excel & CSV
+
+If you need to generate hundreds or thousands of QR codes, creating them manually is no longer a realistic option. Whether you are managing product labels for a retail launch, printing badges for a large-scale event, or tracking inventory across multiple warehouses, the manual entry of data into a generator is time-consuming and prone to human error.
+
+The most efficient workflow is to prepare your data in a spreadsheet—Excel or CSV—and use a **Bulk QR Code Generator** to turn each row into a named, export-ready asset. This guide explains how to structure your files, choose the correct output formats, and follow technical best practices to ensure your codes are scanable and secure.
+
+---
+
+## 1. Why Use a Bulk QR Code Generator?
+
+Industrializing your QR code workflow is about more than just speed; it is about data integrity. As the industry moves closer to the **GS1 Digital Link** standards—the global transition from 1D barcodes to 2D symbols—the complexity of the data embedded in QR codes has increased.
+
+A bulk generation workflow allows you to:
+- **Minimize Errors:** Copy-pasting thousands of URLs or IDs into a spreadsheet is safer than manual entry into a web form.
+- **Automate Naming:** You can assign specific filenames to each QR code based on SKU or ID, making it easy for design and print teams to find the right assets.
+- **Maintain Consistency:** Standardize colors, error correction levels, and dimensions across an entire batch of assets.
+
+---
+
+## 2. How to Structure Your Excel or CSV File for Bulk Generation
+
+The success of a bulk project depends entirely on the formatting of your source file. Most professional tools require a simple, tabular structure.
+
+### Column Mapping
+At a minimum, your spreadsheet should include two primary columns:
+1.  **The Payload (Target URL/Data):** This is the information the scanner will read. It could be a website URL, a vCard string, or a product ID.
+2.  **The Filename (Identifier):** This column tells the generator how to name the exported image files. Use unique identifiers like SKUs or internal IDs (e.g., `SKU-9942`).
+
+### Data Formatting Rules
+To prevent generation errors, follow these technical constraints:
+- **Encoding special characters:** If your URLs contain localized characters or symbols, ensure your CSV is saved with **UTF-8 encoding**.
+- **No empty rows:** Ensure there are no gaps in your data, as some automated engines may stop processing at the first empty cell.
+- **Consistent protocol:** Always include the `https://` prefix for URLs to ensure they are recognized as links by mobile OS cameras.
+- **Avoid duplicate identifiers:** If two rows have the same identifier in your "Filename" column, the second file may overwrite the first during the export process.
+
+---
+
+## 3. Step-by-Step: From Spreadsheet to Production-Ready Assets
+
+Generating a batch of codes involves three critical phases: preparation, design application, and extraction.
+
+### Step 1: Data Validation
+Before uploading your file to a tool like **QR Master**, perform a quick audit. Use Excel’s "Remove Duplicates" feature on your identifier column. If you are generating thousands of codes, verify that your browser has enough memory to handle the local processing; professional tools typically process generation in the browser to maintain data privacy.
+
+### Step 2: Choosing Design and Scanability Parameters
+When applying a design in bulk, you are setting a global rule for all images:
+- **Error Correction Level:** For bulk projects, we recommend **Level M (15%)** or **Level H (30%)**. This adds redundancy to the code, allowing it to remain scanable even if it is slightly damaged or partially obscured by a logo.
+- **Color Contrast:** High contrast is the single most important factor for scanability. A dark foreground (usually black) on a white background remains the gold standard for universal compatibility.
+- **Quiet Zones:** Modern scanners require a "quiet zone"—a small margin of empty space around the code—to identify the boundaries of the pattern. Ensure your design template respects this margin.
+
+### Step 3: Exporting and Organization
+Once generated, the assets are usually provided in a single compressed ZIP file. Because you utilized a "Filename" column, the resulting folder will be organized by your internal IDs rather than generic numbers (e.g., `inventory_ID202.svg` instead of `qrcode_1.png`).
+
+---
+
+## 4. Technical File Standards: SVG vs. PNG
+
+The choice of file format determines the quality of the final physical or digital product.
+
+### When to use SVG (Scalable Vector Graphics)
+For any project involving **print**, SVG is the industry standard.
+- **Infinite Scalability:** Vector files do not lose quality when resized. A code generated for a small product tag can be scaled to fit a shipping crate without pixelation.
+- **Sharpness:** Printers can interpret the exact mathematical lines of a vector, resulting in sharper edges and higher scan success rates.
+- **Small File Size:** Despite their high quality, vector files are often smaller in size than high-resolution rasters.
+
+### When to use PNG (Portable Network Graphics)
+PNG should be reserved for **digital-first** applications.
+- **Web and Email:** PNGs are universally supported by web browsers and email clients.
+- **App Displays:** Use PNG when the QR code is intended to be displayed on screens, such as mobile tickets or digital menus.
+
+---
+
+## 5. Security and Privacy: Critical Technical Requirements
+
+Bulk data often contains sensitive internal links or proprietary product information. In 2026, security standards for QR generators have become more stringent.
+
+### Browser-Side Generation
+Browser-side generation is often the safest option for organizations looking to minimize the privacy footprint of a bulk workflow. By ensuring that sensitive spreadsheet data is processed locally on your machine and never sent to a third-party server, you can more effectively align with data privacy regulations like GDPR or CCPA.
+Browser-side generation is often the preferred option for organizations looking to minimize the privacy footprint of a bulk workflow. By ensuring that sensitive spreadsheet data is processed locally on your machine and not transmitted to a third-party server, you can more effectively manage data handling requirements.
+
+### Avoiding Redirect Loops
+If you are using a generator that tracks scans (Dynamic QR codes), ensure the service is reputable. If their servers go down, every code in your bulk batch will stop working. For mission-critical internal logistics or permanent packaging, **Static QR codes** are often the safer, stateless choice.
+
+---
+
+## 6. Common Use Case Patterns
+
+### Inventory and Asset Tracking
+Operations teams use bulk generation to label machinery, office equipment, or warehouse bins. By including unique batch IDs in the Excel file, they can generate thousands of individual tracking codes that link directly to their internal ERP or database.
+
+### Event Management and Ticketing
+For large conferences, organizers use attendee lists to create unique vCard or entry codes. In this scenario, the "Filename" column is usually the attendee's registration number, allowing for easy integration into badge-printing software.
+
+### Retail and Smart Packaging
+With the ongoing shift toward the GS1 Digital Link, brands are moving away from simple UPCs and toward unique-at-the-batch level QR codes. Bulk generation allows for the creation of unique labels that can track a product’s journey from the factory floor to the store shelf.
+
+---
+
+## 7. Troubleshooting Technical Errors
+
+If your bulk batch fails to generate or scan correctly, check these common causes:
+
+### Why is my QR code not scanning?
+- **Low Contrast:** The colors are too similar. Always favor a dark pattern on a light background.
+- **Inverted Colors:** Many older scanners cannot read "negative" QR codes (white pattern on a black background).
+- **Too much data:** If you encode a very long URL, the QR code squares become smaller and harder to scan. Use a URL shortener if necessary.
+
+### Why did my bulk upload fail?
+- **Incorrect Delimiters:** Ensure your CSV uses commas (`,`) or semicolons (`;`) as expected by the tool.
+- **Hidden Formatting:** Excel sometimes adds hidden formatting to cells. Clean your data using a "Paste as Values" operation before exporting to CSV.
+- **UTF-8 Warnings:** If your tool returns an error about character encoding, re-save your file as "CSV UTF-8 (Comma delimited)".
+
+---
+
+## Conclusion: Mastering Large-Scale QR Operations
+
+Once your spreadsheet is structured properly, bulk QR generation becomes a repeatable, high-integrity workflow rather than a manual design task. For teams working across print, packaging, events, or inventory, transitioning to a bulk process saves time, eliminates naming errors, and makes large deployments manageable. 
+
+By focusing on high-contrast designs, vector outputs, and browser-side security, you can ensure that your mass QR code deployment is both technically sound and professional.
+
+**Ready to start? [Generate your first bulk batch with QR Master →](https://qrmaster.net)**
--- a/articles/devto-hashnode/devto-barcode-encoding-algorithms-ean13-code128.md
+++ b/articles/devto-hashnode/devto-barcode-encoding-algorithms-ean13-code128.md
@@ -0,0 +1,203 @@
+---
+title: "Barcode Encoding Algorithms: EAN-13 & Code 128 Checksum Math from Scratch in JavaScript"
+description: "A deep computer science exploration of 1D barcode encoding algorithms, covering Modulo 10 and Modulo 103 checksum calculations, building a free barcode generator and a code 128 barcode generator in TypeScript."
+tags: javascript, typescript, algorithms, computer-science
+keywords: free barcode generator, ean code generator, code 128 barcode generator, qr barcode, barcode code generator, free barcode, print barcode
+canonical_url: https://www.qrmaster.net/blog/barcode-generator-tool
+---
+
+# Barcode Encoding Algorithms: EAN-13 & Code 128 Checksum Math from Scratch in JavaScript
+
+Long before 2D QR codes dominated digital marketing, one-dimensional (1D) linear barcodes—such as **EAN-13** in retail products and **Code 128** in logistics and shipping—revolutionized inventory automation.
+
+Building a **free barcode generator** or an **ean code generator** requires understanding that barcode scanner guns and camera libraries do not "guess" numbers from images; they decode precise binary bit patterns (bars and spaces) and verify mathematical **checksums** (Modulo 10 for EAN-13; Modulo 103 for Code 128).
+
+In this deep computer science guide, we will examine the bit pattern structures of EAN-13 and Code 128, derive their checksum formulas, and implement a pure TypeScript **barcode code generator** without any external npm dependencies.
+
+---
+
+## 1. Deconstructing EAN-13 Retail Barcode Encoding
+
+An **EAN-13** (European Article Number) barcode produced by an **ean code generator** encodes exactly 13 numeric digits:
+- **First 2–3 digits**: Country Prefix (e.g., `400–440` for Germany, `000–019` for US/Canada).
+- **Next 4–5 digits**: Manufacturer Identification Code.
+- **Next 4–5 digits**: Unique Item / Product Code.
+- **13th Digit**: Mathematical **Modulo 10 Checksum Digit**.
+
+```
+  Country  Manufacturer   Product   Check
+   ┌──┴──┐   ┌────┴────┐ ┌───┴───┐   ┌┴┐
+   4 0 0 1 2 3 4 5 6 7 8 9 5
+```
+
+### The EAN-13 Modulo 10 Checksum Formula
+To compute the 13th check digit for a 12-digit input in an **ean code generator**:
+
+1. Sum all digits in **odd-numbered positions** (1st, 3rd, 5th, 7th, 9th, 11th).
+2. Sum all digits in **even-numbered positions** (2nd, 4th, 6th, 8th, 10th, 12th) and multiply by 3.
+3. Add the two sums together.
+4. The check digit is the number required to reach the next multiple of 10:
+
+$$\text{Check Digit} = (10 - (\text{Total Sum} \pmod{10})) \pmod{10}$$
+
+### Checksum Example Calculation:
+Take the 12-digit string `400123456789`:
+- Odd sum: $4 + 0 + 2 + 4 + 6 + 8 = 24$
+- Even sum: $(0 + 1 + 3 + 5 + 7 + 9) \times 3 = 25 \times 3 = 75$
+- Total: $24 + 75 = 99$
+- Check digit: $(10 - (99 \pmod{10})) \pmod{10} = (10 - 9) \pmod{10} = 1$
+- Final 13-digit EAN-13 code: `4001234567891`
+
+---
+
+## 2. Deconstructing Code 128 High-Density Barcodes
+
+While EAN-13 is strictly numeric, a **code 128 barcode generator** creates high-density alphanumeric barcode formats capable of encoding all 128 ASCII characters (uppercase/lowercase letters, digits, punctuation, and control codes).
+
+### Code 128 Structure
+A Code 128 **qr barcode** structure consists of:
+1. **Start Character**: `Start A` (103), `Start B` (104), or `Start C` (105).
+2. **Data Symbol Characters**: Each character is represented by 11 modules composed of 3 bars and 3 spaces.
+3. **Check Character**: Modulo 103 checksum value.
+4. **Stop Character**: 13-module pattern (`1100011101011`).
+
+### The Code 128 Modulo 103 Checksum Formula
+
+$$\text{Checksum Value} = \left( \text{Start Value} + \sum_{i=1}^{N} (i \times \text{Symbol Value}_i) \right) \pmod{103}$$
+
+---
+
+## 3. Pure TypeScript Barcode Engine (No External Dependencies)
+
+Let's build a standalone TypeScript module (`src/services/barcodeEngine.ts`) for a **free barcode generator** that computes EAN-13 checksums and renders a vector SVG **print barcode**.
+
+### `src/services/barcodeEngine.ts`
+
+```typescript
+export class BarcodeEngine {
+  /**
+   * Computes the Modulo 10 Checksum digit for a 12-digit EAN string in an ean code generator.
+   */
+  public static calculateEAN13Checksum(digits12: string): number {
+    if (!/^\d{12}$/.test(digits12)) {
+      throw new Error('EAN-13 input must be exactly 12 numeric digits.');
+    }
+
+    let oddSum = 0;
+    let evenSum = 0;
+
+    for (let i = 0; i < 12; i++) {
+      const digit = parseInt(digits12[i], 10);
+      if (i % 2 === 0) {
+        oddSum += digit;
+      } else {
+        evenSum += digit;
+      }
+    }
+
+    const totalSum = oddSum + evenSum * 3;
+    const remainder = totalSum % 10;
+    return remainder === 0 ? 0 : 10 - remainder;
+  }
+
+  /**
+   * EAN-13 Binary Bit Patterns for L, G, and R encodings.
+   */
+  private static L_PATTERNS = [
+    '0001101', '0011001', '0010011', '0111101', '0100011',
+    '0110001', '0101111', '0111011', '0110111', '0001011'
+  ];
+
+  private static R_PATTERNS = [
+    '1110010', '1100110', '1101100', '1000010', '1011100',
+    '1001110', '1010000', '1000100', '1001000', '1110100'
+  ];
+
+  /**
+   * Generates a crisp vector SVG string for an EAN-13 barcode.
+   */
+  public static generateEAN13SVG(digits12: string): string {
+    const checkDigit = this.calculateEAN13Checksum(digits12);
+    const fullEan13 = digits12 + checkDigit.toString();
+
+    // Structural guard and center patterns
+    const GUARD_START = '101';
+    const GUARD_CENTER = '01010';
+    const GUARD_END = '101';
+
+    let bitPattern = GUARD_START;
+
+    // Encode Left 6 Digits (using L-Patterns for simplicity)
+    for (let i = 1; i <= 6; i++) {
+      const digit = parseInt(fullEan13[i], 10);
+      bitPattern += this.L_PATTERNS[digit];
+    }
+
+    bitPattern += GUARD_CENTER;
+
+    // Encode Right 6 Digits (using R-Patterns)
+    for (let i = 7; i <= 12; i++) {
+      const digit = parseInt(fullEan13[i], 10);
+      bitPattern += this.R_PATTERNS[digit];
+    }
+
+    bitPattern += GUARD_END;
+
+    // Render SVG
+    const moduleWidthPx = 3;
+    const heightPx = 120;
+    const totalWidthPx = bitPattern.length * moduleWidthPx + 40; // 40px margin
+
+    let svgPaths = '';
+    for (let i = 0; i < bitPattern.length; i++) {
+      if (bitPattern[i] === '1') {
+        const x = 20 + i * moduleWidthPx;
+        svgPaths += `<rect x="${x}" y="10" width="${moduleWidthPx}" height="${heightPx - 30}" fill="#000000" />`;
+      }
+    }
+
+    // Add human-readable numbers text below bars
+    const textSvg = `<text x="${totalWidthPx / 2}" y="${heightPx - 5}" font-family="monospace" font-size="16" text-anchor="middle">${fullEan13}</text>`;
+
+    return `
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 ${totalWidthPx} ${heightPx}" width="${totalWidthPx}" height="${heightPx}">
+  <rect width="100%" height="100%" fill="#FFFFFF" />
+  ${svgPaths}
+  ${textSvg}
+</svg>`.trim();
+  }
+}
+```
+
+---
+
+## 4. Verification & Testing
+
+Let's write a unit test to verify checksum calculation and SVG rendering output.
+
+```typescript
+import { BarcodeEngine } from '../src/services/barcodeEngine';
+
+describe('BarcodeEngine', () => {
+  test('should correctly compute EAN-13 Modulo 10 Checksum', () => {
+    // 400123456789 -> Check digit should be 1
+    const check = BarcodeEngine.calculateEAN13Checksum('400123456789');
+    expect(check).toBe(1);
+  });
+
+  test('should generate valid vector SVG string', () => {
+    const svg = BarcodeEngine.generateEAN13SVG('400123456789');
+    expect(svg).toContain('<svg');
+    expect(svg).toContain('4001234567891'); // Includes computed check digit
+    expect(svg).toContain('</svg>');
+  });
+});
+```
+
+---
+
+## Conclusion
+
+Understanding the binary bit patterns and mathematical checksum algorithms behind 1D barcodes allows developers to build a fast **free barcode generator** without relying on heavy external dependencies.
+
+To generate free high-resolution EAN-13, UPC-A, and Code 128 barcodes online, check out [QR Master Free Barcode Generator](https://www.qrmaster.net/blog/barcode-generator-tool).
--- a/articles/devto-hashnode/devto-custom-qr-code-api-nodejs.md
+++ b/articles/devto-hashnode/devto-custom-qr-code-api-nodejs.md
@@ -0,0 +1,359 @@
+---
+title: "Building a High-Performance Custom QR Code Generator API with Node.js & Vector SVG"
+description: "A complete step-by-step developer guide to building a custom QR code generator API in Node.js, covering vector SVG rendering, Reed-Solomon error correction, and creating QR codes from links."
+tags: nodejs, javascript, webdev, api
+keywords: custom qr code generator, create qr code from link, qr code generator online, custom qr code generator free, qr code link generator
+canonical_url: https://www.qrmaster.net/blog/qr-code-api-documentation
+---
+
+# Building a High-Performance Custom QR Code Generator API with Node.js & Vector SVG
+
+QR codes have evolved from simple black-and-white square grids into essential digital-to-physical bridges. Whether you are building a **custom qr code generator** for an application, creating a **qr code generator online** for ticket barcodes, or building an internal microservice to **create a qr code from a link**, building your own API gives you total control over styling, performance, data privacy, and branding.
+
+In this deep-dive guide, we will build a production-ready, high-performance REST API in Node.js and Express that generates vector SVG and high-density PNG QR codes on the fly. We will also explore the math behind Reed-Solomon error correction, quiet zones, color contrast ratios, and how to optimize a **free custom qr code generator** for crisp printing.
+
+---
+
+## 1. Understanding QR Code Architecture & Error Correction
+
+Before writing any code, it is critical to understand how a **custom qr code generator** stores data and why vector graphics (SVG) are vastly superior to raster images (PNG/JPEG) for print media.
+
+### The QR Code Grid Structure
+A QR code is a two-dimensional matrix barcode consisting of:
+1. **Finder Patterns**: The three large squares located at the top-left, top-right, and bottom-left corners. Cameras use these to detect the barcode's orientation and scale.
+2. **Alignment Patterns**: Smaller squares (found in Version 2 and larger) that correct for non-linear distortion when a camera scans a curved surface.
+3. **Timing Patterns**: Alternating black and white modules connecting the finder patterns to establish the matrix coordinate grid size.
+4. **Format Information**: Modules storing the error correction level and the mask pattern used.
+5. **Data & Error Correction Codewords**: The actual payload (URL link, text, JSON) mixed with Reed-Solomon redundancy blocks.
+
+### Reed-Solomon Error Correction Levels
+QR codes use **Reed-Solomon Error Correction**, allowing damaged, dirty, or obscured codes to remain fully scannable:
+
+| Level | Error Recovery Capacity | Recommended Use Case |
+|---|---|---|
+| **L (Low)** | ~7% of codewords restored | Minimal data size, clean digital screens |
+| **M (Medium)** | ~15% of codewords restored | Standard marketing URLs, digital displays |
+| **Q (Quartile)** | ~25% of codewords restored | Industrial packaging, outdoor signage |
+| **H (High)** | ~30% of codewords restored | Embedding brand logos in a **custom qr code generator** |
+
+*Rule of thumb:* When embedding custom logos or high-contrast graphics in the center of a QR code, always enforce **Level H** so the remaining 70% of un-obscured modules provide 100% data integrity.
+
+---
+
+## 2. Why SVG Vector Output Matters for Developers
+
+Raster formats like PNG or JPEG store pixels. If a 300x300 pixel PNG QR code is printed on a large 2-meter billboard, the square modules become blurry and pixelated, leading to scanner camera read failures.
+
+Vector SVG (`Scalable Vector Graphics`) defines QR modules as crisp mathematical paths (`<path d="M..."/>` or `<rect x="..." y="..."/>`). SVG files:
+- Scale infinitely to any print dimension (from business cards to stadium billboards) without loss of crispness.
+- Have a tiny file footprint (typically < 2 KB per code).
+- Allow programmatic CSS styling of foreground, background, and finder pattern colors.
+
+---
+
+## 3. Step-by-Step API Implementation
+
+Let's build a Node.js API with Express that accepts JSON payloads or URL query parameters and streams vector SVG or PNG outputs to **create a qr code from a link**.
+
+### Step 3.1: Project Setup & Dependencies
+
+Initialize a new Node.js project and install the required dependencies:
+
+```bash
+mkdir qr-code-api
+cd qr-code-api
+npm init -y
+npm install express qrcode cors helmet express-rate-limit dotenv
+npm install --save-dev typescript @types/node @types/express @types/cors ts-node-dev
+```
+
+Initialize TypeScript configuration (`tsconfig.json`):
+
+```json
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true
+  },
+  "include": ["src/**/*"]
+}
+```
+
+---
+
+### Step 3.2: Creating the QR Generator Core Engine
+
+Create `src/services/qrEngine.ts`. This service handles matrix generation, error correction mapping, and SVG DOM construction.
+
+```typescript
+import QRCode, { QRCodeRenderersOptions } from 'qrcode';
+
+export interface QROptions {
+  text: string;
+  errorCorrectionLevel?: 'L' | 'M' | 'Q' | 'H';
+  width?: number;
+  margin?: number;
+  colorDark?: string;
+  colorLight?: string;
+  format?: 'svg' | 'png' | 'utf8';
+}
+
+export class QREngine {
+  /**
+   * Generates a scalable vector SVG QR code string.
+   */
+  public static async generateSVG(options: QROptions): Promise<string> {
+    const {
+      text,
+      errorCorrectionLevel = 'M',
+      margin = 4,
+      colorDark = '#000000',
+      colorLight = '#FFFFFF'
+    } = options;
+
+    const qrOptions: QRCodeRenderersOptions = {
+      errorCorrectionLevel,
+      margin,
+      color: {
+        dark: colorDark,
+        light: colorLight
+      }
+    };
+
+    try {
+      const svgString = await QRCode.toString(text, {
+        ...qrOptions,
+        type: 'svg'
+      });
+      return svgString;
+    } catch (err) {
+      throw new Error(`Failed to generate SVG QR code: ${(err as Error).message}`);
+    }
+  }
+
+  /**
+   * Generates a high-density PNG buffer for binary image response.
+   */
+  public static async generatePNGBuffer(options: QROptions): Promise<Buffer> {
+    const {
+      text,
+      errorCorrectionLevel = 'H',
+      width = 600,
+      margin = 4,
+      colorDark = '#000000',
+      colorLight = '#FFFFFF'
+    } = options;
+
+    const qrOptions: QRCodeRenderersOptions = {
+      errorCorrectionLevel,
+      width,
+      margin,
+      color: {
+        dark: colorDark,
+        light: colorLight
+      }
+    };
+
+    try {
+      const buffer = await QRCode.toBuffer(text, {
+        ...qrOptions,
+        type: 'png'
+      });
+      return buffer;
+    } catch (err) {
+      throw new Error(`Failed to generate PNG QR buffer: ${(err as Error).message}`);
+    }
+  }
+}
+```
+
+---
+
+### Step 3.3: Building the Express REST Controller & API Endpoints
+
+Create `src/app.ts` to set up rate limiting, CORS, input validation, and REST route handlers.
+
+```typescript
+import express, { Request, Response, NextFunction } from 'express';
+import cors from 'cors';
+import helmet from 'helmet';
+import rateLimit from 'express-rate-limit';
+import { QREngine, QROptions } from './services/qrEngine.js';
+
+const app = express();
+
+// Security Middlewares
+app.use(helmet());
+app.use(cors());
+app.use(express.json({ limit: '1mb' }));
+
+// Rate Limiter: Prevent API abuse (max 100 requests per minute per IP)
+const apiLimiter = rateLimit({
+  windowMs: 1 * 60 * 1000,
+  max: 100,
+  message: { error: 'Too many QR generation requests. Please try again later.' }
+});
+
+app.use('/api/', apiLimiter);
+
+/**
+ * GET /api/v1/qr
+ * Query Params: text, ecLevel, margin, colorDark, colorLight, format
+ */
+app.get('/api/v1/qr', async (req: Request, res: Response, next: NextFunction) => {
+  try {
+    const text = req.query.text as string;
+    if (!text) {
+      return res.status(400).json({ error: 'Query parameter "text" is required to create qr code from link.' });
+    }
+
+    const format = ((req.query.format as string) || 'svg').toLowerCase();
+    const ecLevel = ((req.query.ecLevel as string) || 'M').toUpperCase() as 'L' | 'M' | 'Q' | 'H';
+    const margin = parseInt(req.query.margin as string, 10) || 4;
+    const colorDark = (req.query.colorDark as string) || '#000000';
+    const colorLight = (req.query.colorLight as string) || '#FFFFFF';
+
+    const options: QROptions = {
+      text,
+      errorCorrectionLevel: ecLevel,
+      margin,
+      colorDark,
+      colorLight
+    };
+
+    if (format === 'png') {
+      const width = parseInt(req.query.width as string, 10) || 600;
+      const pngBuffer = await QREngine.generatePNGBuffer({ ...options, width });
+      res.setHeader('Content-Type', 'image/png');
+      res.setHeader('Cache-Control', 'public, max-age=86400'); // Cache for 24 hours
+      return res.send(pngBuffer);
+    }
+
+    // Default: Vector SVG
+    const svgString = await QREngine.generateSVG(options);
+    res.setHeader('Content-Type', 'image/svg+xml');
+    res.setHeader('Cache-Control', 'public, max-age=86400');
+    return res.send(svgString);
+
+  } catch (error) {
+    next(error);
+  }
+});
+
+/**
+ * POST /api/v1/qr/batch
+ * JSON Body: { items: Array<QROptions> }
+ */
+app.post('/api/v1/qr/batch', async (req: Request, res: Response, next: NextFunction) => {
+  try {
+    const { items } = req.body;
+    if (!Array.isArray(items) || items.length === 0) {
+      return res.status(400).json({ error: 'JSON payload must contain an array "items" with at least one element.' });
+    }
+
+    if (items.length > 50) {
+      return res.status(400).json({ error: 'Batch limit exceeded. Maximum 50 QR codes allowed per request.' });
+    }
+
+    const results = await Promise.all(
+      items.map(async (item: QROptions) => {
+        const svg = await QREngine.generateSVG({
+          text: item.text,
+          errorCorrectionLevel: item.errorCorrectionLevel || 'M',
+          colorDark: item.colorDark || '#000000',
+          colorLight: item.colorLight || '#FFFFFF'
+        });
+        return { text: item.text, svg };
+      })
+    );
+
+    return res.json({ count: results.length, data: results });
+  } catch (error) {
+    next(error);
+  }
+});
+
+// Central Error Handler
+app.use((err: Error, req: Request, res: Response, _next: NextFunction) => {
+  console.error('[QR-API Error]:', err.message);
+  res.status(500).json({ error: 'Internal Server Error', message: err.message });
+});
+
+const PORT = process.env.PORT || 3000;
+app.listen(PORT, () => {
+  console.log(`🚀 Custom QR Code Generator API running on http://localhost:${PORT}`);
+});
+```
+
+---
+
+## 4. Testing Your API with cURL & Examples
+
+Start the development server:
+
+```bash
+npx ts-node-dev src/app.ts
+```
+
+### Example 1: Requesting a Vector SVG QR Code
+Run the following cURL command to fetch an SVG QR code from a link:
+
+```bash
+curl -X GET "http://localhost:3000/api/v1/qr?text=https://www.qrmaster.net&ecLevel=H&colorDark=%231E293B&colorLight=%23F8FAFC" \
+  -H "Accept: image/svg+xml" \
+  --output qrcode.svg
+```
+
+### Example 2: Requesting a High-Resolution PNG for Print
+Fetch a 1000px high-density PNG QR code:
+
+```bash
+curl -X GET "http://localhost:3000/api/v1/qr?text=https://www.qrmaster.net&format=png&width=1000&ecLevel=Q" \
+  --output qrcode.png
+```
+
+### Example 3: Batch API Request
+Send a POST request with multiple items:
+
+```bash
+curl -X POST "http://localhost:3000/api/v1/qr/batch" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "items": [
+      { "text": "https://www.qrmaster.net/docs", "colorDark": "#0284C7" },
+      { "text": "https://www.qrmaster.net/pricing", "colorDark": "#059669" }
+    ]
+  }'
+```
+
+---
+
+## 5. Production Best Practices & Design Pitfalls
+
+When deploying a production-grade **custom qr code generator free** service, keep these crucial guidelines in mind:
+
+### 1. Maintain Contrast Ratios
+Camera sensors require a minimum contrast ratio between foreground modules and background spaces. Always ensure:
+- Dark modules on light backgrounds (avoid light gray on white or dark blue on black).
+- Inverted QR codes (white modules on black background) work on iOS camera apps, but fail on legacy Android devices and embedded barcode readers. Stick to dark foregrounds on light backgrounds whenever possible.
+
+### 2. Respect Quiet Zone Margins
+The **Quiet Zone** is the empty border surrounding all 4 sides of the QR matrix. The ISO/IEC 18004 specification requires a quiet zone of **at least 4 modules wide**. Reducing or cropping this margin causes camera auto-focus algorithms to miss the finder pattern boundaries.
+
+### 3. Keep Payload Size Minimal
+The more characters you encode into a static QR code, the larger the matrix version becomes (e.g., Version 1 is 21x21 modules; Version 10 is 57x57 modules). High-density matrices require users to stand closer and hold their camera still.
+- **Pro Tip:** Use URL shorteners or dynamic redirection URLs (e.g., `https://qr.domain.com/x9z`) to keep the payload under 30 characters, resulting in a clean, low-density Version 2 matrix that scans instantly.
+
+---
+
+## Conclusion
+
+Creating your own **custom qr code generator** API gives you full programmatic freedom over format, styling, error correction, and batch automation. By leveraging Node.js and vector SVG rendering, your application can effortlessly scale to handle thousands of print-ready requests per second.
+
+If you prefer a fully managed solution with dynamic redirection, real-time scan analytics, custom logo embedding, and enterprise SLA uptime, check out [QR Master Custom QR Code Generator](https://www.qrmaster.net/custom-qr-code-generator) — built for developers and growth teams.
--- a/articles/devto-hashnode/devto-edge-dynamic-qr-redirect-engine.md
+++ b/articles/devto-hashnode/devto-edge-dynamic-qr-redirect-engine.md
@@ -0,0 +1,246 @@
+---
+title: "Designing a Low-Latency Dynamic QR Redirect Engine at the Edge with Redis & Middleware"
+description: "A comprehensive system architecture guide for building a sub-20ms dynamic QR code generator engine using Edge Functions, an editable QR code generator proxy, Redis, and scan tracking."
+tags: systemdesign, redis, serverless, webdev
+keywords: dynamic qr code generator, free dynamic qr code generator, editable qr code generator, editable qr code, qr code generator with tracking, qr code tracking, dynamic qr code
+canonical_url: https://www.qrmaster.net/blog/qr-code-analytics
+---
+
+# Designing a Low-Latency Dynamic QR Redirect Engine at the Edge with Redis & Middleware
+
+Static QR codes hardcode their destination URL directly into the matrix data. Once printed on 10,000 billboards or product packages, a typo in the URL means reprinting everything at massive cost.
+
+A **dynamic qr code generator** solves this by encoding a permanent short proxy URL (e.g., `https://qr.domain.com/r/xyz123`). An **editable qr code generator** lets you change the target destination link in your dashboard anytime post-print. When scanned, an **editable qr code** intercepts the request, logs scan metrics (device type, geo-location, timestamp), and issues an HTTP `302 Found` or `307 Temporary Redirect` response to the target URL.
+
+However, if your redirect engine takes 800ms to resolve a database query before forwarding the user, the physical scan experience feels sluggish. In this article, we will design a **free dynamic qr code generator** backend engine operating with sub-20ms global redirect latencies using Edge Middleware (Vercel Edge / Cloudflare Workers), Redis in-memory caching, and a **qr code generator with tracking** pipeline.
+
+---
+
+## 1. System Architecture Overview
+
+To achieve sub-20ms global redirect latencies in a **dynamic qr code generator**, database calls must never block the HTTP response thread.
+
+```
+                  ┌─────────────────────────────────────────┐
+                  │          Physical Phone Scanner          │
+                  └────────────────────┬────────────────────┘
+                                       │
+                         HTTP GET /r/xyz123 (Proxy)
+                                       │
+                                       ▼
+                  ┌─────────────────────────────────────────┐
+                  │      Edge Middleware (Cloudflare/Vercel)│
+                  │   - Fast Geo-IP & User-Agent Parsing    │
+                  └──────────┬───────────────────┬──────────┘
+                             │                   │
+                     1. Cache Hit (<5ms)         │ 2. Async Log Stream
+                             │                   │  (Non-blocking Queue)
+                             ▼                   ▼
+                  ┌─────────────────────┐ ┌─────────────────────────┐
+                  │ Upstash Redis / K-V │ │ Kafka / Upstash QStash  │
+                  └─────────────────────┘ └────────────┬────────────┘
+                             │                         │
+                     HTTP 307 Redirect                 ▼
+                             │            ┌─────────────────────────┐
+                             │            │ Analytics DB (ClickHouse│
+                             ▼            │     or PostgreSQL)      │
+                  ┌─────────────────────┐ └─────────────────────────┘
+                  │ Final Target Webpage│
+                  └─────────────────────┘
+```
+
+### Key Architectural Decisions:
+1. **Edge Execution**: Run redirect logic in multi-region PoPs (Points of Presence) close to the physical device.
+2. **Read Path (Hot Path)**: Fetch URL mappings from a distributed, low-latency Redis cache for your **editable qr code generator**.
+3. **Write Path (Analytics Async)**: Push scan metadata to a queue or log collector off the main execution thread so **qr code tracking** adds **0ms** to user delay.
+4. **HTTP Status Code**: Use `307 Temporary Redirect` (or `302 Found`). Never use `301 Moved Permanently`, as browsers will cache the redirect locally and bypass your server on future scans, ruining **qr code generator with tracking** metrics!
+
+---
+
+## 2. Setting Up Edge Middleware in Next.js
+
+Below is an implementation of Edge Middleware in Next.js (`src/middleware.ts` or Cloudflare Worker script) that handles dynamic redirection for an **editable qr code generator**.
+
+### Step 2.1: Installing Dependencies
+
+```bash
+npm install @upstash/redis @upstash/qstash
+```
+
+### Step 2.2: Implementing Edge Redirect Middleware
+
+Create or update `middleware.ts`:
+
+```typescript
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+import { Redis } from '@upstash/redis';
+
+// Initialize low-latency edge Redis client
+const redis = new Redis({
+  url: process.env.UPSTASH_REDIS_REST_URL!,
+  token: process.env.UPSTASH_REDIS_REST_TOKEN!,
+});
+
+export async function middleware(req: NextRequest) {
+  const { pathname } = req.nextUrl;
+
+  // Match route pattern: /r/:code (e.g., /r/campaign-2026)
+  if (pathname.startsWith('/r/')) {
+    const code = pathname.split('/r/')[1];
+    if (!code) {
+      return NextResponse.redirect(new URL('/404', req.url));
+    }
+
+    const startTime = performance.now();
+
+    // 1. Fetch destination URL from Redis cache (Hot Path)
+    const targetUrl = await redis.get<string>(`qr:link:${code}`);
+
+    if (!targetUrl) {
+      // Fallback: If not in cache, redirect to fallback page or 404
+      return NextResponse.redirect(new URL('/link-expired', req.url));
+    }
+
+    // 2. Extract Device & Geo Metadata from Edge Request Headers for QR Code Tracking
+    const ip = req.headers.get('x-forwarded-for') || req.headers.get('x-real-ip') || '127.0.0.1';
+    const userAgent = req.headers.get('user-agent') || 'Unknown';
+    const country = req.headers.get('x-vercel-ip-country') || req.headers.get('cf-ipcountry') || 'US';
+    const city = req.headers.get('x-vercel-ip-city') || 'Unknown';
+
+    // 3. Asynchronously Log Scan Analytics (Fire and Forget)
+    const scanEvent = {
+      code,
+      targetUrl,
+      timestamp: new Date().toISOString(),
+      ip,
+      userAgent,
+      country,
+      city,
+      latencyMs: Math.round(performance.now() - startTime),
+    };
+
+    // Queue analytic event asynchronously without awaiting
+    const logPromise = redis.lpush('queue:scan_analytics', JSON.stringify(scanEvent));
+
+    if (typeof (req as any).waitUntil === 'function') {
+      (req as any).waitUntil(logPromise);
+    }
+
+    // 4. Return HTTP 307 Temporary Redirect immediately
+    return NextResponse.redirect(targetUrl, {
+      status: 307,
+      headers: {
+        'Cache-Control': 'no-store, no-cache, must-revalidate, proxy-revalidate',
+        'X-Redirect-Latency': `${Math.round(performance.now() - startTime)}ms`,
+      },
+    });
+  }
+
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: '/r/:path*',
+};
+```
+
+---
+
+## 3. Asynchronous Analytics Processing Pipeline for Tracking
+
+Logging scan events directly to a relational database (like PostgreSQL or MySQL) inside the request loop introduces locking overhead and database connection pool exhaustion under high traffic spikes.
+
+A robust **qr code generator with tracking** streams events into a queue and processes them with a background consumer job.
+
+### Background Consumer Worker (`scripts/analyticsWorker.ts`)
+
+```typescript
+import { Redis } from '@upstash/redis';
+import { PrismaClient } from '@prisma/client';
+
+const redis = new Redis({
+  url: process.env.UPSTASH_REDIS_REST_URL!,
+  token: process.env.UPSTASH_REDIS_REST_TOKEN!,
+});
+
+const prisma = new PrismaClient();
+
+interface ScanEvent {
+  code: string;
+  targetUrl: string;
+  timestamp: string;
+  ip: string;
+  userAgent: string;
+  country: string;
+  city: string;
+  latencyMs: number;
+}
+
+async function startWorker() {
+  console.log('🔄 QR Code Tracking Worker active. Polling scan queue...');
+
+  while (true) {
+    try {
+      // Pop up to 100 scan events in batch from Redis list
+      const rawEvents = await redis.rpop('queue:scan_analytics', 100);
+
+      if (rawEvents && rawEvents.length > 0) {
+        const events: ScanEvent[] = rawEvents.map((item) => JSON.parse(item));
+
+        // Batch insert into database
+        await prisma.scanLog.createMany({
+          data: events.map((e) => ({
+            qrCode: e.code,
+            destination: e.targetUrl,
+            scannedAt: new Date(e.timestamp),
+            ipAddress: e.ip,
+            deviceUserAgent: e.userAgent,
+            countryCode: e.country,
+            cityName: e.city,
+            processingLatency: e.latencyMs,
+          })),
+        });
+
+        console.log(`✅ Processed ${events.length} scan records.`);
+      } else {
+        await new Promise((resolve) => setTimeout(resolve, 1000));
+      }
+    } catch (err) {
+      console.error('❌ Analytics Worker Error:', err);
+      await new Promise((resolve) => setTimeout(resolve, 2000));
+    }
+  }
+}
+
+startWorker();
+```
+
+---
+
+## 4. Handling High-Traffic Campaign Spikes
+
+When a printed **editable qr code** appears on live television or a viral promotional banner, traffic can surge from 10 scans/sec to 20,000 scans/sec instantly.
+
+### Key Resilience Strategies:
+
+1. **Pre-Warming the Edge Cache**: When a user updates a dynamic destination URL in their **editable qr code generator** dashboard, publish the update to Redis immediately:
+   ```typescript
+   await redis.set(`qr:link:${code}`, newTargetUrl);
+   ```
+2. **Stale-While-Revalidate Fallback**: If Redis experiences an outage, fallback to an edge-cached static mapping file or memory LRU cache.
+3. **Bot & Crawler Filtering**: Search engine spiders (Googlebot, Bingbot) and messaging app link prefetchers (WhatsApp, iMessage, Twitter previews) generate fake scans. Filter them out using User-Agent detection before counting unique scans:
+   ```typescript
+   const isBot = /bot|google|baidu|bing|msn|duckduckbot|teoma|slurp|twitterbot|facebookexternalhit|whatsapp/i.test(userAgent);
+   if (isBot) {
+     // Tag or ignore bot scans in qr code tracking
+   }
+   ```
+
+---
+
+## Conclusion
+
+By executing redirect logic at the Edge with Redis and isolating analytics processing asynchronously, you can build a **free dynamic qr code generator** backend achieving ultra-low **<15ms redirect latencies** regardless of geographic location.
+
+To save time and avoid building analytics infra from scratch, explore [QR Master Dynamic QR Code Generator](https://www.qrmaster.net/dynamic-qr-code-generator), an enterprise-grade platform offering dynamic QR management, real-time GA4/UTM integration, and sub-second analytics dashboards.
--- a/articles/devto-hashnode/devto-geo-location-uris-maps-deep-links.md
+++ b/articles/devto-hashnode/devto-geo-location-uris-maps-deep-links.md
@@ -0,0 +1,242 @@
+---
+title: "Geo-Location URIs vs Deep Links: RFC 5870 geo: Protocol, Apple Maps & Google Maps Traps"
+description: "A cross-platform web developer guide to encoding GPS coordinates in a location qr code generator, comparing RFC 5870 geo: protocols against Apple Maps and Google Maps universal links."
+tags: webdev, mobile, javascript, ios, android
+keywords: location qr code generator, qr code for location, print qr code, print a qr code, maps qr code, gps qr code generator
+canonical_url: https://www.qrmaster.net/blog/location-qr-code
+---
+
+# Geo-Location URIs vs Deep Links: RFC 5870 geo: Protocol, Apple Maps & Google Maps Traps
+
+Scanning a **qr code for location** to navigate to a physical address—such as a store entrance, real estate open house, event parking lot, or tourist landmark—is a foundational real-world mobile use case.
+
+However, developers building a **location qr code generator** often stumble into a major cross-platform fragmentation trap:
+
+- If you use the official IETF standard `geo:` URI protocol (`geo:37.7749,-122.4194`), Android devices open Google Maps seamlessly, but **iOS camera apps display an error or treat it as an unhandled text string**!
+- If you use a Google Maps web URL (`https://maps.google.com/?q=...`), iOS devices open a browser web page instead of launching the native Apple Maps app.
+
+In this technical guide, we will analyze RFC 5870 geo-location standards, cross-platform mobile OS behavior, client-side W3C Geolocation API fallbacks, and build a smart TypeScript Universal Location Resolver to **print a qr code** for navigation.
+
+---
+
+## 1. Breakdown of Location Format Options
+
+Let's compare the four primary ways to encode geographic location coordinates into a **location qr code generator**:
+
+```
+┌─────────────────────────────────────┬─────────────────────────────┬─────────────────────────────┐
+│ Format Method                       │ iOS Camera App Behavior     │ Android Google Lens Behavior│
+├─────────────────────────────────────┼─────────────────────────────┼─────────────────────────────┤
+│ 1. Standard RFC 5870 (geo:lat,lng)  │ ❌ Fails / Shows plain text │ ✅ Opens Native Maps App    │
+│ 2. Google Maps Web URL              │ ⚠️ Opens Safari Web Browser  │ ✅ Opens Native Google Maps │
+│ 3. Apple Maps Universal Link        │ ✅ Opens Native Apple Maps  │ ⚠️ Opens Web Browser        │
+│ 4. Universal Smart Redirect Link    │ ✅ Opens Native Maps App    │ ✅ Opens Native Maps App    │
+└─────────────────────────────────────┴─────────────────────────────┴─────────────────────────────┘
+```
+
+---
+
+## 2. Understanding the RFC 5870 `geo:` URI Specification
+
+The IETF RFC 5870 specification defines the uniform resource identifier (URI) scheme for geographic locations:
+
+```text
+geo:latitude,longitude,altitude;crs=wgs84;u=uncertainty
+```
+
+### Example RFC 5870 Strings:
+
+```text
+# Basic Latitude & Longitude (San Francisco)
+geo:37.7749,-122.4194
+
+# Latitude, Longitude, and Altitude in meters (100m above sea level)
+geo:48.8584,2.2945,100
+
+# Geo-location with query search string ("Coffee")
+geo:37.7749,-122.4194?q=Coffee
+```
+
+### Why iOS Fails to Parse RFC 5870:
+Apple's iOS Camera App parser does not register `geo:` as a supported URI scheme in its native scanner handler. When an iPhone camera detects `geo:37.7749,-122.4194`, it treats the barcode as raw unformatted text rather than an actionable navigation trigger.
+
+---
+
+## 3. Universal Web Links for Maximum Cross-Platform Compatibility
+
+To ensure a **qr code for location** opens natively on both iPhone and Android devices without errors, developers use **Universal Maps Links**.
+
+### Google Maps Universal Link Syntax:
+```text
+https://www.google.com/maps/search/?api=1&query=37.7749,-122.4194
+```
+
+### Apple Maps Universal Link Syntax:
+```text
+https://maps.apple.com/?ll=37.7749,-122.4194&q=Location+Name
+```
+
+### Cross-Platform Dual-Routing Strategy
+When both iOS and Android users scan a single **print qr code**, the best architectural approach is pointing the QR code to a lightweight serverless edge function that inspects the client `User-Agent` and issues an instant 307 redirect to the respective native map handler:
+
+- If `User-Agent` contains `iPhone`, `iPad`, or `Macintosh` $\to$ Redirect to `https://maps.apple.com/?ll=...`
+- Otherwise (Android / Windows / Linux) $\to$ Redirect to `https://www.google.com/maps/search/?api=1&query=...`
+
+---
+
+## 4. Building a Smart Location Resolver in TypeScript
+
+Below is a complete implementation of a Universal Location Resolver Edge Handler in Next.js / TypeScript for a **location qr code generator**.
+
+### `src/app/api/location-resolver/route.ts`
+
+```typescript
+import { NextRequest, NextResponse } from 'next/server';
+
+export interface LocationQuery {
+  lat: number;
+  lng: number;
+  label?: string;
+}
+
+export function GET(req: NextRequest) {
+  const { searchParams } = new URL(req.url);
+  const latStr = searchParams.get('lat');
+  const lngStr = searchParams.get('lng');
+  const label = searchParams.get('label') || 'Target Location';
+
+  if (!latStr || !lngStr) {
+    return NextResponse.json(
+      { error: 'Query parameters "lat" and "lng" are required.' },
+      { status: 400 }
+    );
+  }
+
+  const lat = parseFloat(latStr);
+  const lng = parseFloat(lngStr);
+
+  if (isNaN(lat) || isNaN(lng)) {
+    return NextResponse.json(
+      { error: 'Coordinates lat and lng must be valid floating point numbers.' },
+      { status: 400 }
+    );
+  }
+
+  // Validate Coordinate Boundaries
+  if (lat < -90 || lat > 90 || lng < -180 || lng > 180) {
+    return NextResponse.json(
+      { error: 'Latitude must be between -90 and 90, Longitude between -180 and 180.' },
+      { status: 400 }
+    );
+  }
+
+  const userAgent = req.headers.get('user-agent') || '';
+  const isAppleDevice = /iPhone|iPad|iPod|Macintosh/i.test(userAgent);
+
+  let targetMapUrl: string;
+
+  if (isAppleDevice) {
+    // Construct Native Apple Maps Deep Link
+    const encodedLabel = encodeURIComponent(label);
+    targetMapUrl = `https://maps.apple.com/?ll=${lat},${lng}&q=${encodedLabel}`;
+  } else {
+    // Construct Universal Google Maps Deep Link
+    const encodedQuery = encodeURIComponent(`${lat},${lng}`);
+    targetMapUrl = `https://www.google.com/maps/search/?api=1&query=${encodedQuery}`;
+  }
+
+  // Return 307 Temporary Redirect
+  return NextResponse.redirect(targetMapUrl, {
+    status: 307,
+    headers: {
+      'Cache-Control': 'no-store, max-age=0',
+    },
+  });
+}
+```
+
+---
+
+## 5. Client-Side Geolocation API Integration & Fallback HTML
+
+If you want to offer a web landing page that shows dynamic distance ("You are 450 meters away from the venue entrance"), you can integrate the browser W3C Geolocation API alongside the QR redirect link when you **print a qr code**.
+
+### Example HTML/JS Client Landing Page (`public/location-landing.html`):
+
+```html
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <title>Venue Navigation - Location QR Code</title>
+  <style>
+    body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; text-align: center; padding: 40px 20px; }
+    .card { max-width: 400px; margin: 0 auto; border: 1px solid #E2E8F0; padding: 24px; border-radius: 12px; box-shadow: 0 4px 6px rgba(0,0,0,0.05); }
+    .btn { display: inline-block; background: #0284C7; color: white; padding: 14px 28px; border-radius: 8px; text-decoration: none; font-weight: 600; margin-top: 16px; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <h2>📍 Target Destination</h2>
+    <p id="status">Calculating distance to target...</p>
+    <a id="nav-btn" class="btn" href="#">Open Navigation App</a>
+  </div>
+
+  <script>
+    const targetLat = 37.7749;
+    const targetLng = -122.4194;
+
+    const isApple = /iPhone|iPad|iPod|Macintosh/i.test(navigator.userAgent);
+    const navBtn = document.getElementById('nav-btn');
+    const statusEl = document.getElementById('status');
+
+    const mapsUrl = isApple 
+      ? `https://maps.apple.com/?ll=${targetLat},${targetLng}&q=Target+Venue`
+      : `https://www.google.com/maps/search/?api=1&query=${targetLat},${targetLng}`;
+
+    navBtn.href = mapsUrl;
+
+    if ("geolocation" in navigator) {
+      navigator.geolocation.getCurrentPosition(position => {
+        const userLat = position.coords.latitude;
+        const userLng = position.coords.longitude;
+        const distKm = getHaversineDistance(userLat, userLng, targetLat, targetLng);
+        statusEl.innerText = `You are currently ${(distKm * 1000).toFixed(0)} meters away.`;
+      }, () => {
+        statusEl.innerText = "Tap below to open your device maps app.";
+      });
+    }
+
+    function getHaversineDistance(lat1, lon1, lat2, lon2) {
+      const R = 6371;
+      const dLat = (lat2 - lat1) * Math.PI / 180;
+      const dLon = (lon2 - lon1) * Math.PI / 180;
+      const a = Math.sin(dLat/2) * Math.sin(dLat/2) +
+                Math.cos(lat1 * Math.PI / 180) * Math.cos(lat2 * Math.PI / 180) *
+                Math.sin(dLon/2) * Math.sin(dLon/2);
+      const c = 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1-a));
+      return R * c;
+    }
+  </script>
+</body>
+</html>
+```
+
+---
+
+## 6. Summary & Best Practice Rules for Developers
+
+```
+[ ] DO NOT use raw `geo:lat,lng` RFC 5870 strings if your audience includes iOS users.
+[ ] ALWAYS use HTTPS universal web links when creating a qr code for location.
+[ ] Include a human-readable label in the query string (`&q=Store+Name`) so maps apps display a pin marker with your brand name.
+[ ] Validate latitude limits (-90.0 to +90.0) and longitude limits (-180.0 to +180.0) before encoding.
+```
+
+---
+
+## Conclusion
+
+Navigating cross-platform mobile URI quirks is essential for building real-world location QR codes. By implementing smart User-Agent routing between Apple Maps and Google Maps universal links in your **location qr code generator**, developers deliver a flawless 1-tap navigation experience on any smartphone.
+
+To create custom location QR codes with automatic GPS detection, map previews, and scannability analytics, check out [QR Master Location QR Generator](https://www.qrmaster.net/blog/location-qr-code).
--- a/articles/devto-hashnode/devto-github-actions-qr-code-previews.md
+++ b/articles/devto-hashnode/devto-github-actions-qr-code-previews.md
@@ -0,0 +1,245 @@
+---
+title: "Automating Mobile QR Code Previews in CI/CD Pipelines with GitHub Actions"
+description: "A complete DevOps guide to building a custom GitHub Action that generates dynamic preview QR codes to create a qr code from a link for Vercel/Netlify preview deployments."
+tags: github, devops, ci-cd, automation
+keywords: create qr code from link, create qr code with link, generate qr code for link, make a qr code for a link, qr code generator link
+canonical_url: https://www.qrmaster.net/blog/qr-code-api-documentation
+---
+
+# Automating Mobile QR Code Previews in CI/CD Pipelines with GitHub Actions
+
+When reviewing Pull Requests (PRs) for mobile-first web applications, responsive websites, or PWA features, developers and QA engineers frequently waste time manually copying Vercel or Netlify preview URLs, opening messaging apps, sending links to test devices, or re-typing long URLs into mobile browser address bars.
+
+What if every time a developer opened a Pull Request, a **GitHub Action automatically allowed you to create a qr code from a link** pointing directly to that branch's live preview URL and commented it right into the PR thread?
+
+Quality Assurance testers could simply point their mobile phone camera at the computer screen and instantly test the live staging build!
+
+In this DevOps workflow guide, we will build a custom GitHub Actions workflow (`.github/workflows/qr-preview.yml`) that auto-generates QR preview images when you **create a qr code with a link**.
+
+---
+
+## 1. CI/CD Preview Architecture
+
+Here is how the automated PR feedback loop operates:
+
+```
+┌────────────────────────────────────────┐
+│ Developer Pushes Code to GitHub PR     │
+└───────────────────┬────────────────────┘
+                    │
+                    ▼
+┌────────────────────────────────────────┐
+│ Vercel / Netlify Deploy Preview Builds │ (Generates e.g. https://preview-xyz.vercel.app)
+└───────────────────┬────────────────────┘
+                    │
+                    ▼
+┌────────────────────────────────────────┐
+│ GitHub Action Triggered (pull_request) │
+└───────────────────┬────────────────────┘
+                    │
+                    ▼
+┌────────────────────────────────────────┐
+│ Node.js Script Generates QR Code SVG   │ (Create QR Code From Link)
+└───────────────────┬────────────────────┘
+                    │
+                    ▼
+┌────────────────────────────────────────┐
+│ Action Posts/Updates PR Markdown Comm. │
+└────────────────────────────────────────┘
+```
+
+---
+
+## 2. Setting Up the GitHub Action Workflow
+
+Create a new file in your repository at `.github/workflows/qr-preview.yml`.
+
+### Workflow Configuration (`.github/workflows/qr-preview.yml`)
+
+```yaml
+name: Mobile QR Code Preview Generator
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  pull-requests: write
+  contents: read
+
+jobs:
+  generate-qr-preview:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js Environment
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install QR Code Generator Dependencies
+        run: |
+          npm install qrcode
+
+      - name: Get Preview URL & Create QR Code From Link
+        id: generate_qr
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPO_NAME: ${{ github.repository }}
+          BRANCH_NAME: ${{ github.head_ref }}
+        run: |
+          # Target deployment URL to create a qr code from a link
+          PREVIEW_URL="https://preview-${PR_NUMBER}-${BRANCH_NAME}.vercel.app"
+
+          echo "Preview Target URL: $PREVIEW_URL"
+          echo "preview_url=$PREVIEW_URL" >> $GITHUB_OUTPUT
+
+          # Create inline Node script to generate SVG QR code as Data URI
+          node -e "
+            const QRCode = require('qrcode');
+            const url = '$PREVIEW_URL';
+            QRCode.toString(url, { type: 'svg', margin: 2, color: { dark: '#0F172A', light: '#FFFFFF' } }, (err, svg) => {
+              if (err) throw err;
+              const encoded = Buffer.from(svg).toString('base64');
+              const dataUri = 'data:image/svg+xml;base64,' + encoded;
+              require('fs').writeFileSync('qr_data_uri.txt', dataUri);
+            });
+          "
+          
+          DATA_URI=$(cat qr_data_uri.txt)
+          echo "qr_data_uri=$DATA_URI" >> $GITHUB_OUTPUT
+
+      - name: Comment QR Code on Pull Request
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const prNumber = context.payload.pull_request.number;
+            const previewUrl = '${{ steps.generate_qr.outputs.preview_url }}';
+            const qrDataUri = '${{ steps.generate_qr.outputs.qr_data_uri }}';
+
+            const commentBody = `### 📱 Mobile Preview QR Code
+            
+            Scan this QR code with your phone camera to open and test this PR preview instantly:
+
+            <p align="center">
+              <img src="${qrDataUri}" width="220" height="220" alt="Mobile Preview QR Code" />
+              <br />
+              <a href="${previewUrl}" target="_blank"><strong>Open Direct Preview Link ↗</strong></a>
+            </p>
+
+            ---
+            *Automated by QR CI/CD Pipeline*`;
+
+            const comments = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+            });
+
+            const botComment = comments.data.find(comment => 
+              comment.user.type === 'Bot' && comment.body.includes('Mobile Preview QR Code')
+            );
+
+            if (botComment) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: botComment.id,
+                body: commentBody
+              });
+              console.log('Updated existing PR comment.');
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: prNumber,
+                body: commentBody
+              });
+              console.log('Created new PR comment.');
+            }
+```
+
+---
+
+## 3. How It Works Under the Hood
+
+### Base64 Data URI Trick for Markdown Rendering
+GitHub Markdown does not allow uploading local SVG files directly from a runner disk into a comment thread without hosted storage.
+
+By encoding the generated vector SVG into a **Base64 Data URI string** (`data:image/svg+xml;base64,PHN2Zy...`), the image renders natively inside GitHub PR comment threads without requiring any external S3 bucket uploads when you **generate a qr code for a link**!
+
+```html
+<img src="data:image/svg+xml;base64,PHN2ZyB4bWxucz0..." width="220" height="220" />
+```
+
+### Preventing Comment Spam
+The script lists existing PR comments and searches for a previous bot message containing `"Mobile Preview QR Code"`. If a developer pushes 5 new commits to the PR, the action **updates the single existing comment** with the latest deployment link instead of posting 5 separate duplicate comments.
+
+---
+
+## 4. Advanced Integrations: Netlify & Cloudflare Pages Pipelines
+
+If your repository deploys via Netlify or Cloudflare Pages instead of Vercel, you can hook into their deployment completion events.
+
+### Netlify Deployment Hook Example:
+
+```yaml
+      - name: Fetch Netlify Preview Link
+        id: netlify
+        uses: nwtgck/actions-netlify@v3.0
+        with:
+          publish-dir: './build'
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          deploy-alias: pr-${{ github.event.number }}
+        env:
+          NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+          NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID }}
+```
+
+### Adding Device UTM Tracking Parameters
+To measure how many QA test scans originate from GitHub Pull Request comments vs Slack links, append custom UTM parameters to **make a qr code for a link** before generating the barcode:
+
+```javascript
+const previewUrlWithUtm = `${previewUrl}?utm_source=github&utm_medium=pr_comment&utm_campaign=qa_mobile_test`;
+```
+
+---
+
+## 5. Automated Unit & E2E Testing with Playwright
+
+To take mobile QA automation a step further, you can combine this workflow with headless E2E testing tools like Microsoft Playwright or Cypress.
+
+For instance, your CI runner can launch a mobile Chrome emulation context, load the preview deployment URL encoded in the QR code, take automated screenshots across different screen viewport sizes (iPhone 15 Pro, Pixel 8, iPad Air), and upload visual diffs directly into the Pull Request build artifact summary.
+
+```typescript
+import { test, expect, devices } from '@playwright/test';
+
+test.use({ ...devices['iPhone 15 Pro'] });
+
+test('Mobile Staging Visual Regression Check', async ({ page }) => {
+  await page.goto(process.env.STAGING_URL || 'http://localhost:3000');
+  await expect(page).toHaveTitle(/QR Master/);
+  await page.screenshot({ path: 'mobile-preview.png' });
+});
+```
+
+---
+
+## 6. Security & Rate Limiting Guidelines
+
+```
+[ ] Grant `pull-requests: write` permission scoped strictly to the workflow job.
+[ ] Store third-party tokens (Vercel/Netlify tokens) securely in GitHub Repository Secrets (`${{ secrets.VERCEL_TOKEN }}`).
+[ ] Enforce Base64 length checks to ensure generated SVG payload remains under 64 KB to comply with GitHub comment payload size limits.
+```
+
+---
+
+## Conclusion
+
+Automating mobile QR code previews in your CI/CD pipeline to **create a qr code from a link** eliminates friction for QA teams, product managers, and developers testing mobile-first web features.
+
+To integrate automated REST API QR code generation into your custom developer workflows, check out [QR Master Developer API Documentation](https://www.qrmaster.net/blog/qr-code-api-documentation).
--- a/articles/devto-hashnode/devto-offline-batch-qr-cli-tool.md
+++ b/articles/devto-hashnode/devto-offline-batch-qr-cli-tool.md
@@ -0,0 +1,297 @@
+---
+title: "Building an Offline Batch QR Code Generation CLI Tool in Python & Node.js"
+description: "Learn how to build a bulk qr code generator CLI tool to process 10,000+ records from CSV/Excel files and export high-resolution vector SVG/PNG QR code archives using Node.js and Python."
+tags: python, nodejs, cli, devops
+keywords: bulk qr code generator, free bulk qr code generator, bulk qr code generator excel, csv qr code generator, bulk qr code, batch qr code generator
+canonical_url: https://www.qrmaster.net/blog/bulk-qr-code-generator-excel
+---
+
+# Building an Offline Batch QR Code Generation CLI Tool in Python & Node.js
+
+Generating a single QR code manually in a web browser takes seconds. But when an enterprise client hands you a CSV file containing **50,000 product SKU inventory codes**, **10,000 attendee event tickets**, or **5,000 personalized employee ID badge links**, manual generation becomes impossible.
+
+Browser-based tools will freeze or crash browser tabs when processing tens of thousands of records. You need a dedicated **bulk qr code generator** CLI tool that leverages multi-core CPU workers, streams large files without memory exhaustion, and packages vector SVG outputs into a clean ZIP archive.
+
+In this guide, we will build a production-grade **bulk qr code generator from excel** and CSV files in both **Node.js** and **Python** capable of batch processing thousands of QR codes per minute.
+
+---
+
+## 1. System Requirements & Architecture
+
+Building a **free bulk qr code generator** CLI tool capable of processing massive dataset imports requires avoiding loading entire multi-gigabyte CSV files into RAM memory all at once.
+
+```
+┌─────────────────────────┐
+│ Input CSV / Excel File  │ (e.g. 50,000 rows: ID, Payload, Label)
+└────────────┬────────────┘
+             │
+             ▼
+┌─────────────────────────┐
+│ Stream Reader / Parser  │ (Node.js csv-parser / Python csv module)
+└────────────┬────────────┘
+             │
+             ▼
+┌─────────────────────────┐
+│ Worker Pool Queue       │ (Parallel processing across CPU cores)
+└────────────┬────────────┘
+             │
+             ▼
+┌─────────────────────────┐
+│ Vector SVG / PNG Export │ (Output folder: ./output/QR_00001.svg)
+└─────────────────────────┘
+```
+
+---
+
+## 2. Implementation 1: Node.js / TypeScript CLI Tool
+
+We will build a **csv qr code generator** in Node.js using `commander` for CLI flags, `csv-parser` for streaming, and `p-limit` to bound CPU concurrency.
+
+### Step 2.1: Dependencies
+
+```bash
+npm install commander csv-parser qrcode p-limit archiver
+npm install --save-dev typescript @types/node @types/csv-parser @types/archiver ts-node
+```
+
+### Step 2.2: Node.js CLI Code (`src/bulkQrCli.ts`)
+
+```typescript
+import fs from 'fs';
+import path from 'path';
+import { Command } from 'commander';
+import csvParser from 'csv-parser';
+import QRCode from 'qrcode';
+import pLimit from 'p-limit';
+
+interface CsvRow {
+  filename: string;
+  payload: string;
+}
+
+const program = new Command();
+
+program
+  .name('batch-qr')
+  .description('High-speed offline bulk qr code generator CLI')
+  .version('1.0.0')
+  .requiredOption('-i, --input <path>', 'Input CSV file path (columns: filename, payload)')
+  .option('-o, --output <path>', 'Output directory path', './output_qr')
+  .option('-f, --format <type>', 'Output format (svg or png)', 'svg')
+  .option('-c, --concurrency <number>', 'Parallel CPU worker limit', '20')
+  .option('-e, --error-correction <level>', 'Error correction (L, M, Q, H)', 'M')
+  .parse(process.argv);
+
+const options = program.opts();
+
+async function runBatch() {
+  const inputPath = path.resolve(options.input);
+  const outputDir = path.resolve(options.output);
+  const format = options.format.toLowerCase();
+  const concurrency = parseInt(options.concurrency, 10);
+  const ecLevel = options.errorCorrection.toUpperCase();
+
+  if (!fs.existsSync(inputPath)) {
+    console.error(`❌ Input CSV file not found: ${inputPath}`);
+    process.exit(1);
+  }
+
+  if (!fs.existsSync(outputDir)) {
+    fs.mkdirSync(outputDir, { recursive: true });
+  }
+
+  console.log(`🚀 Starting Bulk QR Code Generator Batch...`);
+  console.log(`📁 Input: ${inputPath}`);
+  console.log(`📂 Output: ${outputDir}`);
+  console.log(`⚡ Concurrency Limit: ${concurrency} workers`);
+
+  const rows: CsvRow[] = [];
+
+  // 1. Read CSV Stream
+  await new Promise<void>((resolve, reject) => {
+    fs.createReadStream(inputPath)
+      .pipe(csvParser())
+      .on('data', (data) => {
+        if (data.payload) {
+          rows.push({
+            filename: data.filename || `qr_${rows.length + 1}`,
+            payload: data.payload,
+          });
+        }
+      })
+      .on('end', () => resolve())
+      .on('error', (err) => reject(err));
+  });
+
+  console.log(`📊 Found ${rows.length} records for bulk qr generation.`);
+
+  const startTime = Date.now();
+  const limit = pLimit(concurrency);
+  let completed = 0;
+
+  // 2. Parallel Generation Queue
+  const tasks = rows.map((row) =>
+    limit(async () => {
+      const sanitizedFilename = row.filename.replace(/[^a-z0-9_-]/gi, '_');
+      const filePath = path.join(outputDir, `${sanitizedFilename}.${format}`);
+
+      try {
+        if (format === 'png') {
+          await QRCode.toFile(filePath, row.payload, {
+            errorCorrectionLevel: ecLevel,
+            width: 800,
+            margin: 4,
+          });
+        } else {
+          const svgString = await QRCode.toString(row.payload, {
+            type: 'svg',
+            errorCorrectionLevel: ecLevel,
+            margin: 4,
+          });
+          fs.writeFileSync(filePath, svgString, 'utf8');
+        }
+
+        completed++;
+        if (completed % 500 === 0 || completed === rows.length) {
+          console.log(`✅ Progress: ${completed} / ${rows.length} generated...`);
+        }
+      } catch (err) {
+        console.error(`❌ Error generating ${row.filename}:`, (err as Error).message);
+      }
+    })
+  );
+
+  await Promise.all(tasks);
+
+  const durationSec = ((Date.now() - startTime) / 1000).toFixed(2);
+  console.log(`\n🎉 Bulk QR Code Generator Completed Successfully!`);
+  console.log(`⏱️ Total Time: ${durationSec} seconds`);
+  console.log(`⚡ Throughput: ${(rows.length / parseFloat(durationSec)).toFixed(0)} codes/sec`);
+}
+
+runBatch().catch((err) => {
+  console.error('Fatal Batch Error:', err);
+  process.exit(1);
+});
+```
+
+---
+
+## 3. Implementation 2: Python Multi-Processing CLI
+
+Python offers native `multiprocessing` for parallel execution across all available CPU threads in a **bulk qr code generator from excel**.
+
+### Step 3.1: Install Dependencies
+
+```bash
+pip install qrcode[pil] click pandas openpyxl
+```
+
+### Step 3.2: Python CLI Script (`batch_qr.py`)
+
+```python
+import os
+import time
+import pandas as pd
+import qrcode
+from qrcode.image.svg import SvgPathImage
+import click
+from multiprocessing import Pool, cpu_count
+
+def generate_single_qr(task):
+    filename, payload, output_dir, fmt, ec_level = task
+    sanitized_name = "".join([c if c.isalnum() or c in ('-', '_') else '_' for c in filename])
+    output_path = os.path.join(output_dir, f"{sanitized_name}.{fmt}")
+
+    ec_map = {
+        'L': qrcode.constants.ERROR_CORRECT_L,
+        'M': qrcode.constants.ERROR_CORRECT_M,
+        'Q': qrcode.constants.ERROR_CORRECT_Q,
+        'H': qrcode.constants.ERROR_CORRECT_H,
+    }
+
+    qr = qrcode.QRCode(
+        version=None,
+        error_correction=ec_map.get(ec_level.upper(), qrcode.constants.ERROR_CORRECT_M),
+        box_size=10,
+        border=4,
+    )
+    qr.add_data(payload)
+    qr.make(fit=True)
+
+    if fmt == 'svg':
+        img = qr.make_image(image_factory=SvgPathImage)
+        img.save(output_path)
+    else:
+        img = qr.make_image(fill_color="black", back_color="white")
+        img.save(output_path)
+
+    return True
+
+@click.command()
+@click.option('--input', '-i', required=True, help='Path to input CSV or Excel file.')
+@click.option('--output', '-o', default='./output_qr', help='Output folder.')
+@click.option('--format', '-f', default='svg', type=click.Choice(['svg', 'png']), help='File format.')
+@click.option('--ec', default='M', type=click.Choice(['L', 'M', 'Q', 'H']), help='Error correction level.')
+def main(input, output, format, ec):
+    """High-Performance Bulk QR Code Generator CLI in Python"""
+    if not os.path.exists(input):
+        click.echo(f"Error: Input file '{input}' does not exist.")
+        return
+
+    os.makedirs(output, exist_ok=True)
+
+    if input.endswith('.xlsx') or input.endswith('.xls'):
+        df = pd.read_excel(input)
+    else:
+        df = pd.read_csv(input)
+
+    if 'payload' not in df.columns:
+        click.echo("Error: File must contain a 'payload' column.")
+        return
+
+    records = []
+    for idx, row in df.iterrows():
+        fname = str(row.get('filename', f'qr_{idx + 1}'))
+        payload = str(row['payload'])
+        records.append((fname, payload, output, format, ec))
+
+    total = len(records)
+    num_cpus = cpu_count()
+    click.echo(f"Starting bulk qr code generator for {total} records using {num_cpus} CPU cores...")
+
+    start_time = time.time()
+
+    with Pool(processes=num_cpus) as pool:
+        pool.map(generate_single_qr, records)
+
+    duration = time.time() - start_time
+    click.echo(f"Bulk batch completed in {duration:.2f} seconds ({total / duration:.0f} codes/sec).")
+
+if __name__ == '__main__':
+    main()
+```
+
+---
+
+## 4. Performance Benchmarks
+
+Running these scripts on a standard 8-Core Apple M1 / Intel i7 workstation yields impressive throughput:
+
+```
+┌───────────────────────────┬────────────────┬─────────────────┬───────────────────┐
+│ Implementation            │ Records        │ Total Time      │ Speed             │
+├───────────────────────────┼────────────────┼─────────────────┼───────────────────┤
+│ Node.js (p-limit 20)      │ 10,000 SVGs    │ 3.8 seconds     │ ~2,630 codes/sec  │
+│ Python (Multiprocessing)  │ 10,000 SVGs    │ 4.2 seconds     │ ~2,380 codes/sec  │
+│ Single-Thread Browser JS  │ 1,000 PNGs     │ 45.0 seconds    │ ~22 codes/sec     │
+└───────────────────────────┴────────────────┴─────────────────┴───────────────────┘
+```
+
+---
+
+## Conclusion
+
+Building your own offline **bulk qr code generator** CLI tool frees you from browser memory limits and third-party rate limits. By utilizing multi-core process pools and vector SVG output, you can generate tens of thousands of print-ready QR codes in seconds.
+
+If you need a cloud-native web dashboard for bulk Excel uploads, automatic ZIP packaging, and dynamic tracking, check out [QR Master Bulk Generator](https://www.qrmaster.net/bulk-qr-code-generator).
--- a/articles/devto-hashnode/devto-pdf-file-qr-code-generator-guide.md
+++ b/articles/devto-hashnode/devto-pdf-file-qr-code-generator-guide.md
@@ -0,0 +1,181 @@
+---
+title: "PDF & File QR Code Generator: How to Convert Documents, Menus & PDFs into Scannable Barcodes"
+description: "A developer and marketer guide to building a PDF QR code generator, handling cloud file storage uploads, optimizing PDF load speeds, and creating dynamic file barcodes."
+tags: webdev, pdf, cloud, tutorial
+keywords: pdf qr code generator free, file qr code generator, generate free qr code for pdf, file to qr code generator, pdf to qr code, qr code generator for file
+canonical_url: https://www.qrmaster.net/blog/qr-code-restaurant-menu
+---
+
+# PDF & File QR Code Generator: How to Convert Documents, Menus & PDFs into Scannable Barcodes
+
+Converting digital documents, PDF menus, product brochures, user manuals, and event schedules into scannable QR codes is one of the most effective ways to eliminate paper waste and distribute digital collateral in physical spaces.
+
+Whether a restaurant guest scans a table sign to view a restaurant menu PDF, a conference attendee scans a badge to download a presentation slide deck, or an industrial customer scans packaging to view a PDF safety manual, using a **pdf qr code generator free** tool connects paper touchpoints directly to digital cloud files.
+
+However, developers and marketers often face technical challenges:
+- How do you host PDF files so they load instantly on mobile networks?
+- Should you use a static file link or an editable **file qr code generator**?
+- How do you optimize PDF file size so phone browsers do not freeze when downloading large multi-megabyte documents over cellular connections?
+
+In this guide, we will cover the end-to-end architecture of a **file to qr code generator**, cloud storage hosting (S3/Cloudflare R2), PDF optimization, and building a TypeScript file upload pipeline.
+
+---
+
+## 1. System Architecture: How a PDF QR Code Works
+
+You cannot embed a 5 MB PDF file directly inside the physical black-and-white modules of a 2D QR matrix. A QR code can store a maximum of ~2,953 bytes.
+
+Therefore, a **pdf qr code generator** works by uploading the PDF document to a secure cloud storage bucket (e.g. AWS S3, Cloudflare R2, Google Cloud Storage) and encoding the hosted URL into a QR barcode.
+
+```
+┌─────────────────────────┐
+│ User Uploads PDF File   │ (e.g. menu.pdf, 1.2 MB)
+└────────────┬────────────┘
+             │
+             ▼
+┌─────────────────────────┐
+│ PDF Optimization Engine │ (Compresses images & vectors)
+└────────────┬────────────┘
+             │
+             ▼
+┌─────────────────────────┐
+│ Cloud Object Storage    │ (AWS S3 / Cloudflare R2 CDN)
+└────────────┬────────────┘
+             │
+             ▼
+┌─────────────────────────┐
+│ Dynamic Proxy Short Link│ (e.g. https://qr.domain.com/pdf/menu-2026)
+└────────────┬────────────┘
+             │
+             ▼
+┌─────────────────────────┐
+│ Vector SVG Barcode      │ (Scanned by Mobile Device Camera)
+└─────────────────────────┘
+```
+
+---
+
+## 2. Static vs. Dynamic PDF QR Codes
+
+When building a **file qr code generator**, choosing between static and dynamic architecture is critical:
+
+```
+┌───────────────────────────────────────┬───────────────────────────────────────┐
+│ Static PDF QR Code                    │ Dynamic File QR Code Generator        │
+├───────────────────────────────────────┼───────────────────────────────────────┤
+│ Links directly to S3 URL              │ Links to proxy URL (/pdf/menu)        │
+│ (e.g., s3.aws.com/b/menu-v1.pdf)      │ which redirects to active PDF.        │
+│                                       │                                       │
+│ ❌ File CANNOT be updated after print  │ 🟢 Replace PDF file anytime           │
+│ ❌ No scan analytics tracking          │ 🟢 Full scan metrics (Geo-IP, device) │
+│ ⚠️ Long S3 URLs create dense barcodes  │ 🟢 Short proxy URL creates clean code │
+└───────────────────────────────────────┴───────────────────────────────────────┘
+```
+
+> **Best Practice Rule**: Always use a **dynamic file qr code generator** for PDF documents. If a menu price changes or a brochure is revised, you can upload a new PDF version to your dashboard—the printed QR code on tables or flyers stays active and automatically serves the updated PDF!
+
+---
+
+## 3. PDF Optimization for Mobile Scanning Speed
+
+When mobile users scan a PDF barcode over a 4G/5G connection, an uncompressed 15 MB PDF takes 10+ seconds to load in Safari or Chrome, resulting in high bounce rates.
+
+### Golden Rules for Mobile PDF Optimization:
+1. **Compress Raster Images**: Downsample images inside the PDF to 150 DPI (suitable for mobile screens) instead of 300+ DPI print resolution.
+2. **Subset Embedded Fonts**: Include only the characters used in the document rather than embedding entire font families.
+3. **Linearization (Fast Web View)**: Enable "Fast Web View" when exporting PDFs. This restructures the PDF stream so mobile browsers display Page 1 immediately before the rest of the file finishes downloading!
+4. **Target File Size Limit**: Keep PDF file size **under 2.5 MB** for instant mobile loading.
+
+---
+
+## 4. TypeScript Implementation: Building a Cloud PDF QR Pipeline
+
+Below is a complete implementation in TypeScript that handles PDF uploads to S3-compatible storage (Cloudflare R2), generates a short dynamic redirect link, and exports a vector SVG QR code.
+
+### Step 4.1: Installation
+```bash
+npm install @aws-sdk/client-s3 qrcode
+npm install --save-dev typescript @types/node
+```
+
+### Step 4.2: PDF QR Service (`src/services/pdfQrService.ts`)
+
+```typescript
+import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';
+import QRCode from 'qrcode';
+
+// Initialize S3 / Cloudflare R2 Client
+const s3 = new S3Client({
+  region: 'auto',
+  endpoint: process.env.R2_ENDPOINT!,
+  credentials: {
+    accessKeyId: process.env.R2_ACCESS_KEY_ID!,
+    secretAccessKey: process.env.R2_SECRET_ACCESS_KEY!,
+  },
+});
+
+export interface PdfUploadOptions {
+  fileBuffer: Buffer;
+  originalFileName: string;
+  slug: string;
+}
+
+export class PdfQrService {
+  /**
+   * Uploads a PDF to S3/R2 storage and returns a vector SVG QR code.
+   */
+  public static async createPdfQr(options: PdfUploadOptions): Promise<{ cdnUrl: string; svgQr: string }> {
+    const { fileBuffer, originalFileName, slug } = options;
+
+    const fileKey = `documents/${Date.now()}_${originalFileName.replace(/[^a-z0-9.]/gi, '_')}`;
+
+    // 1. Upload PDF File to Cloud Storage Bucket
+    const uploadCommand = new PutObjectCommand({
+      Bucket: process.env.R2_BUCKET_NAME!,
+      Key: fileKey,
+      Body: fileBuffer,
+      ContentType: 'application/pdf',
+      ContentDisposition: 'inline', // Opens inside browser instead of forcing download
+      CacheControl: 'public, max-age=31536000',
+    });
+
+    await s3.send(uploadCommand);
+
+    const cdnUrl = `${process.env.CDN_BASE_URL}/${fileKey}`;
+
+    // 2. Generate Managed Short Redirect URL for Dynamic Editing
+    const proxyRedirectUrl = `https://www.qrmaster.net/r/doc/${slug}`;
+
+    // 3. Generate High-Quality Vector SVG Barcode
+    const svgQr = await QRCode.toString(proxyRedirectUrl, {
+      type: 'svg',
+      errorCorrectionLevel: 'M',
+      margin: 4,
+      color: { dark: '#0F172A', light: '#FFFFFF' },
+    });
+
+    return { cdnUrl, svgQr };
+  }
+}
+```
+
+---
+
+## 5. Frequently Asked Questions (FAQ)
+
+### Q1: How do I generate a free QR code for a PDF?
+Upload your PDF to a cloud host (such as Google Drive, Dropbox, or your website server), copy the share link, and paste it into a **pdf qr code generator free** tool like QR Master to generate a vector SVG code.
+
+### Q2: Can I change the PDF file after printing the QR code?
+Yes, provided you use a **file to qr code generator** with dynamic proxy links. You can upload a new PDF file to replace the old document in your dashboard without reprinting the physical QR code.
+
+### Q3: Why does my PDF QR code force a download instead of opening in Safari?
+This is controlled by the HTTP `Content-Disposition` header served by your cloud host. If set to `attachment`, the browser forces a download. Set `Content-Disposition: inline` so mobile browsers render the PDF directly on screen!
+
+---
+
+## Conclusion
+
+Using a **pdf qr code generator** allows businesses to replace bulky paper manuals and printed menus with instant digital experiences. By hosting PDFs on fast S3/R2 CDNs, setting `inline` view headers, and using dynamic redirect links, you deliver a seamless mobile document experience.
+
+To upload your PDF documents and generate custom vector QR codes with real-time scan analytics, check out [QR Master File & PDF QR Generator](https://www.qrmaster.net/blog/qr-code-restaurant-menu).
--- a/articles/devto-hashnode/devto-permanent-non-expiring-qr-code-guide.md
+++ b/articles/devto-hashnode/devto-permanent-non-expiring-qr-code-guide.md
@@ -0,0 +1,173 @@
+---
+title: "QR Code Generator That Never Expires: The Truth About Hidden Limits & Permanent Free QR Codes"
+description: "A comprehensive guide to understanding why static QR codes never expire, avoiding third-party paywall traps, and building permanent barcodes for print & marketing campaigns."
+tags: webdev, security, marketing, tutorial
+keywords: qr code generator does not expire, permanent qr code generator, free forever qr code generator, qr code generator no subscription, free unlimited qr code generator, static qr code generator
+canonical_url: https://www.qrmaster.net/blog/static-vs-dynamic-qr-code
+---
+
+# QR Code Generator That Never Expires: The Truth About Hidden Limits & Permanent Free QR Codes
+
+Few things are more frustrating for a business owner or marketer than printing 500 brochures, packaging labels, or restaurant tabletop signs, only to discover two weeks later that the printed QR code has stopped working because a third-party generator placed the link behind a hidden subscription paywall.
+
+Every day, thousands of users search Google for phrases like:
+- *"qr code generator does not expire"*
+- *"permanent qr code generator"*
+- *"free forever qr code generator"*
+- *"qr code generator no subscription"*
+
+Why does this happen so frequently? Because many commercial QR tools use aggressive **freemium lock-in tactics**: they allow users to generate a "free" code, wait until the physical materials are printed and distributed, and then redirect the barcode to a paywall blocking screen until the user pays a monthly subscription fee.
+
+In this technical guide, we will unpack the computer science reality of how QR code expiration actually works, how to generate 100% permanent static QR codes that physically **cannot expire**, and how to choose a **permanent qr code generator** for your projects.
+
+---
+
+## 1. The Computer Science Reality: Can a QR Code Physically Expire?
+
+To understand expiration, you must understand where the data lives. A QR code is a 2D optical barcode that stores binary data in a physical matrix grid of dark and light modules.
+
+```
+┌───────────────────────────────────────┬───────────────────────────────────────┐
+│ Static QR Code (Permanent)            │ Dynamic Proxy QR Code                 │
+├───────────────────────────────────────┼───────────────────────────────────────┤
+│ Payload (URL, text, WiFi) is encoded │ Encodes a short proxy URL link        │
+│ directly into the matrix bits.        │ (e.g. https://service.com/r/123)     │
+│                                       │                                       │
+│ ❌ CANNOT EXPIRE physically           │ ⚠️ EXPIRES if proxy server is closed  │
+│ ❌ No server or account required       │ ⚠️ Requires active redirect service   │
+└───────────────────────────────────────┴───────────────────────────────────────┘
+```
+
+### Static QR Codes: 100% Expiration-Proof
+A static QR code generated by a **static qr code generator** encodes the raw text or URL directly into the matrix (using ISO/IEC 18004 Reed-Solomon encoding). 
+- Once printed on paper, metal, or plastic, the barcode is purely offline data—like a printed book or a 1D supermarket EAN barcode.
+- **There is no central server, database, or account attached.**
+- As long as the printed paper remains clean and readable, a camera reading a static QR code in 50 years will extract the exact same string. **A static QR code cannot expire.**
+
+### Dynamic Proxy QR Codes: Service-Dependent
+A dynamic QR code encodes a short managed proxy URL (e.g., `https://qr.domain.com/r/xyz123`) instead of the final website link.
+- When scanned, the phone contacts the proxy server, which looks up the target destination in a database and forwards the scanner via an HTTP 307 redirect.
+- If the proxy service goes out of business, deletes your account, or cancels your plan, the short proxy link returns a `404 Not Found` or payment wall.
+
+---
+
+## 2. Deconstructing the "Free QR Code Trap"
+
+Many online QR tools take advantage of user unfamiliarity with the difference between static and dynamic codes.
+
+```
+┌─────────────────────────────────────────────────────────────────────────────┐
+│                       The Freemium Lock-in Pipeline                          │
+├─────────────────────────────────────────────────────────────────────────────┤
+│ 1. User visits a "free qr generator" site to create a barcode for a flyer.  │
+│ 2. The site secretly generates a DYNAMIC proxy code instead of a static one.│
+│ 3. User prints 1,000 brochures with the printed barcode.                    │
+│ 4. 14 days later, the free trial ends. The proxy URL is redirected to:     │
+│    "This QR code has expired! Upgrade to PRO for $35/month to unlock."      │
+│ 5. User is forced to pay because reprinting 1,000 brochures costs more!    │
+└─────────────────────────────────────────────────────────────────────────────┘
+```
+
+### How to Detect the Trap BEFORE Printing:
+Before sending any QR code image to a commercial print shop, scan it with your smartphone camera and check the target URL preview on your screen:
+- **Direct Target URL** (e.g. `https://yourcompany.com/menu`): It is a **static permanent QR code**. It is 100% safe and will never expire!
+- **Obfuscated Third-Party URL** (e.g. `https://qr-gen-app.link/x79z`): It is a **dynamic proxy code**. If you are on a free trial, it WILL expire when the trial ends unless you pay!
+
+---
+
+## 3. Comparison: Static vs. Dynamic vs. Permanent Free Tools
+
+Let's compare your options when looking for a **free forever qr code generator**:
+
+```
+┌───────────────────────────┬───────────────────────────┬───────────────────────────┬───────────────────────────┐
+│ Feature                   │ Free Static QR Generator  │ Paid Dynamic QR Generator │ Predatory "Free" Generators│
+├───────────────────────────┼───────────────────────────┼───────────────────────────┼───────────────────────────┤
+│ Expiration Risk           │ 🟢 NEVER (0% Risk)        │ 🟡 Active Subscription    │ 🔴 Expires after 7-14 days│
+│ Requires Account/Sign-Up  │ 🟢 No                     │ 🟡 Yes                    │ 🔴 Yes                    │
+│ Link Editability          │ 🔴 No (Fixed Matrix)       │ 🟢 Yes (Update anytime)   │ 🟡 Only while paid        │
+│ Scan Analytics            │ 🔴 No                     │ 🟢 Yes (GA4 / Geo-IP)     │ 🟡 Behind paywall         │
+│ Vector SVG Download       │ 🟢 Yes                    │ 🟢 Yes                    │ 🔴 Blocked or Watermarked │
+└───────────────────────────┴───────────────────────────┴───────────────────────────┴───────────────────────────┘
+```
+
+---
+
+## 4. Programmatic Implementation: Building a Guaranteed Non-Expiring QR Generator
+
+To ensure your applications generate **permanent qr code generator** outputs programmatically, build an in-house static generator module in TypeScript.
+
+### Step 4.1: Installation
+```bash
+npm install qrcode
+npm install --save-dev typescript @types/node
+```
+
+### Step 4.2: Permanent Static QR Service (`src/services/permanentQrEngine.ts`)
+
+```typescript
+import QRCode from 'qrcode';
+
+export interface StaticQrConfig {
+  text: string;
+  errorCorrection?: 'L' | 'M' | 'Q' | 'H';
+  colorDark?: string;
+  colorLight?: string;
+}
+
+export class PermanentQrEngine {
+  /**
+   * Generates a 100% static, non-expiring vector SVG QR code.
+   * Direct payload encoding ensures zero third-party server dependency.
+   */
+  public static async createPermanentSvg(config: StaticQrConfig): Promise<string> {
+    const {
+      text,
+      errorCorrection = 'M',
+      colorDark = '#000000',
+      colorLight = '#FFFFFF',
+    } = config;
+
+    if (!text || text.trim().length === 0) {
+      throw new Error('Payload text or URL is required to generate a static QR code.');
+    }
+
+    try {
+      const svgString = await QRCode.toString(text, {
+        type: 'svg',
+        errorCorrectionLevel: errorCorrection,
+        margin: 4,
+        color: {
+          dark: colorDark,
+          light: colorLight,
+        },
+      });
+
+      return svgString;
+    } catch (err) {
+      throw new Error(`Static QR Generation Error: ${(err as Error).message}`);
+    }
+  }
+}
+```
+
+---
+
+## 5. Frequently Asked Questions (FAQ)
+
+### Q1: Is there a free unlimited qr code generator that never expires?
+**Yes.** Any **static qr code generator** that encodes your destination URL directly into the matrix creates a permanent barcode that never expires. Static codes require no account or subscription.
+
+### Q2: What happens if the domain of a static QR code changes?
+Because a static code hardcodes the URL into the matrix, if your website domain changes (e.g. from `site.com` to `newsite.com`), the static code will still point to `site.com`. You can fix this by setting up a domain-level 301 redirect on your web server from your old domain to your new domain!
+
+### Q3: How do I get a permanent QR code with a logo?
+Use a **custom qr code generator** enforcing Reed-Solomon **Level H** error correction. This allows you to embed a brand logo in the center while keeping the static matrix 100% permanent.
+
+---
+
+## Conclusion
+
+Understanding the fundamental technical difference between static matrix encoding and dynamic proxy redirects protects you from predatory subscription paywalls. For permanent print campaigns where URLs are stable, a **permanent qr code generator** using static SVG output is the safest, zero-cost choice.
+
+To generate 100% permanent, non-expiring static QR codes with zero ads, zero watermarks, and high-resolution vector SVG downloads, check out [QR Master Free Permanent QR Code Generator](https://www.qrmaster.net/blog/static-vs-dynamic-qr-code).
--- a/articles/devto-hashnode/devto-quishing-threat-detection-pipeline.md
+++ b/articles/devto-hashnode/devto-quishing-threat-detection-pipeline.md
@@ -0,0 +1,244 @@
+---
+title: "Preventing Quishing (QR Phishing): Building an Automated Threat Inspection Pipeline"
+description: "A deep cybersecurity developer guide to understanding Quishing attack vectors, qr code security, building a secure qr code generator, and verifying domain SSL certificates in Node.js."
+tags: security, cybersecurity, nodejs, webdev
+keywords: qr code security, secure qr code generator, safe qr code generator, qr code security best practices, quishing prevention
+canonical_url: https://www.qrmaster.net/blog/qr-code-security
+---
+
+# Preventing Quishing (QR Phishing): Building an Automated Threat Inspection Pipeline
+
+As QR codes become standard infrastructure for payments, Wi-Fi connections, and physical login flows, **qr code security** has become a top priority. Cybercriminals have adopted **Quishing** (QR Phishing)—the act of replacing physical QR codes on parking meters, posters, or restaurant tables with malicious codes that redirect victims to credential-harvesting phishing portals.
+
+Because security scanners in email gateways and web browsers cannot inspect physical paper stickers, Quishing bypasses traditional perimeter defenses.
+
+For SaaS platforms building a **secure qr code generator** that allows users to create dynamic redirects, preventing malicious actors from turning your platform into a phishing proxy is a major AppSec priority.
+
+In this cybersecurity guide, we will analyze Quishing attack mechanics and build an automated threat inspection pipeline in TypeScript to ensure your platform remains a **safe qr code generator**.
+
+---
+
+## 1. Deconstructing the Quishing Attack Vector
+
+Unlike standard phishing emails containing suspicious links like `http://paypal-security-login.xyz`, Quishing exploits the visual obscurity of 2D barcodes. Humans cannot read a QR matrix with their eyes; they must scan it first to reveal the URL.
+
+```
+┌────────────────────────────────────────┐
+│ Attacker Swaps Physical QR Sticker     │
+└───────────────────┬────────────────────┘
+                    │
+                    ▼
+┌────────────────────────────────────────┐
+│ User Scans QR Code with Smartphone     │
+└───────────────────┬────────────────────┘
+                    │
+                    ▼
+┌────────────────────────────────────────┐
+│ Redirect Chain (Multi-Hop Proxy)      │
+│ http://short.link ➔ http://eval.site  │
+│ ➔ https://fake-bank-login.com          │
+└───────────────────┬────────────────────┘
+                    │
+                    ▼
+┌────────────────────────────────────────┐
+│ Victim Enters Password / MFA Credentials│
+└───────────────────┴────────────────────┘
+```
+
+### Common Evasion Tactics in QR Code Security:
+1. **Multi-Hop Redirections**: Using 3 or 4 chained shorteners (`bit.ly` $\to$ `tinyurl` $\to$ malicious domain) to obfuscate final destination.
+2. **Time-Gated Payload Switching**: Pointing the QR code to a benign site during initial review, then updating the target to a phishing page after printing.
+3. **Geo-Targeted Cloaking**: Serving a harmless homepage to cloud inspection bots (AWS/GCP IPs), but redirecting mobile device user-agents to phishing kits.
+
+---
+
+## 2. Architecture of a Secure QR Code Generator Pipeline
+
+When a user submits a destination URL in your **secure qr code generator**, it must pass through an automated inspection pipeline prior to link activation:
+
+```
+User Submitted URL
+      │
+      ▼
+┌────────────────────────────────────────┐
+│ 1. Syntax & Open Redirect Sanitizer    │
+└───────────────────┬────────────────────┘
+                    │
+                    ▼
+┌────────────────────────────────────────┐
+│ 2. Domain Age & Whois Verification     │
+└───────────────────┬────────────────────┘
+                    │
+                    ▼
+┌────────────────────────────────────────┐
+│ 3. Google Safe Browsing API Check      │
+└───────────────────┬────────────────────┘
+                    │
+                    ▼
+┌────────────────────────────────────────┐
+│ 4. Multi-Hop Redirect Trace & Headless │
+│    DOM Inspection (Puppeteer)          │
+└───────────────────┬────────────────────┘
+                    │
+              Pass / Fail Flag
+```
+
+---
+
+## 3. Step-by-Step Implementation in TypeScript
+
+Let's build a threat scanner module in TypeScript for a **safe qr code generator**.
+
+### Step 3.1: Install Dependencies
+
+```bash
+npm install axios google-auth-library valid-url tldts
+npm install --save-dev typescript @types/node
+```
+
+### Step 3.2: Threat Scanner Service (`src/services/threatScanner.ts`)
+
+```typescript
+import axios from 'axios';
+import { parse } from 'tldts';
+
+export interface ThreatScanResult {
+  isSafe: boolean;
+  finalDestination: string;
+  redirectChain: string[];
+  threatType?: string;
+  reason?: string;
+}
+
+export class ThreatScanner {
+  private static SAFE_BROWSING_API_KEY = process.env.GOOGLE_SAFE_BROWSING_KEY || '';
+
+  /**
+   * Runs complete QR code security inspection pipeline on a submitted URL.
+   */
+  public static async inspectUrl(initialUrl: string): Promise<ThreatScanResult> {
+    const redirectChain: string[] = [initialUrl];
+
+    // 1. Basic Protocol & Syntax Validation
+    if (!initialUrl.startsWith('http://') && !initialUrl.startsWith('https://')) {
+      return {
+        isSafe: false,
+        finalDestination: initialUrl,
+        redirectChain,
+        reason: 'Invalid protocol. Only HTTP and HTTPS are permitted.',
+      };
+    }
+
+    // 2. Prevent IP-based URLs (e.g. http://192.168.1.1 or http://169.254.169.254 AWS Metadata attack)
+    const domainInfo = parse(initialUrl);
+    if (!domainInfo.domain && !domainInfo.isIp) {
+      return {
+        isSafe: false,
+        finalDestination: initialUrl,
+        redirectChain,
+        reason: 'Invalid or missing domain name.',
+      };
+    }
+
+    if (domainInfo.isIp) {
+      return {
+        isSafe: false,
+        finalDestination: initialUrl,
+        redirectChain,
+        reason: 'Direct IP address destinations are prohibited to prevent SSFR attacks.',
+      };
+    }
+
+    // 3. Trace Full Redirect Chain (Max 5 Hops)
+    let currentUrl = initialUrl;
+    try {
+      let hops = 0;
+      while (hops < 5) {
+        const response = await axios.head(currentUrl, {
+          maxRedirects: 0,
+          validateStatus: (status) => status >= 200 && status < 400,
+          timeout: 4000,
+          headers: {
+            'User-Agent': 'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15',
+          },
+        });
+
+        if (response.status >= 300 && response.status < 400 && response.headers.location) {
+          const nextUrl = new URL(response.headers.location, currentUrl).href;
+          redirectChain.push(nextUrl);
+          currentUrl = nextUrl;
+          hops++;
+        } else {
+          break; // Terminal destination reached
+        }
+      }
+    } catch (err) {
+      console.warn(`[ThreatScanner] Warning: Redirect trace halted on ${currentUrl}`);
+    }
+
+    const finalDestination = currentUrl;
+
+    // 4. Query Google Safe Browsing API v4
+    if (this.SAFE_BROWSING_API_KEY) {
+      const isMalicious = await this.checkGoogleSafeBrowsing(finalDestination);
+      if (isMalicious) {
+        return {
+          isSafe: false,
+          finalDestination,
+          redirectChain,
+          threatType: 'MALWARE_OR_PHISHING',
+          reason: 'Destination flagged by Google Safe Browsing security database.',
+        };
+      }
+    }
+
+    return {
+      isSafe: true,
+      finalDestination,
+      redirectChain,
+    };
+  }
+
+  private static async checkGoogleSafeBrowsing(targetUrl: string): Promise<boolean> {
+    try {
+      const endpoint = `https://safebrowsing.googleapis.com/v4/threatMatches:find?key=${this.SAFE_BROWSING_API_KEY}`;
+      const payload = {
+        client: {
+          clientId: 'qrmaster-security-scanner',
+          clientVersion: '1.0.0',
+        },
+        threatInfo: {
+          threatTypes: ['MALWARE', 'SOCIAL_ENGINEERING', 'UNWANTED_SOFTWARE', 'POTENTIALLY_HARMFUL_APPLICATION'],
+          platformTypes: ['ANY_PLATFORM'],
+          threatEntryTypes: ['URL'],
+          threatEntries: [{ url: targetUrl }],
+        },
+      };
+
+      const response = await axios.post(endpoint, payload);
+      return !!(response.data && response.data.matches && response.data.matches.length > 0);
+    } catch (err) {
+      console.error('[SafeBrowsing API Error]:', (err as Error).message);
+      return false;
+    }
+  }
+}
+```
+
+---
+
+## 4. Best Practices for QR Code Security
+
+Implementing automated URL scanning is only step one. Enforce these operational safeguards across a **secure qr code generator**:
+
+1. **Mandatory Custom Domain Support**: Allow enterprise users to brand dynamic QR links with their own custom domain (e.g., `qr.brand.com`) instead of sharing a generic domain pool. This isolates reputation.
+2. **Real-Time URL Re-Scanning**: Re-run threat scans periodically (e.g., every 24 hours) on active dynamic QR codes to catch time-gated payload switching attacks.
+3. **Phishing Report Abuse Button**: Include a small "Report Abuse" link on interstitial preview pages so users can flag suspicious links immediately.
+
+---
+
+## Conclusion
+
+Quishing poses a real threat to digital-to-physical user trust. By implementing automated URL syntax sanitization, multi-hop redirect tracing, and Google Safe Browsing integration, developers can build a **secure qr code generator** that protects platforms and users from malicious QR phishing attacks.
+
+To learn more about **qr code security**, SSL encryption, and custom domain isolation, check out [QR Master Security Best Practices](https://www.qrmaster.net/blog/qr-code-security).
--- a/articles/devto-hashnode/devto-reed-solomon-qr-math-logo-embedding.md
+++ b/articles/devto-hashnode/devto-reed-solomon-qr-math-logo-embedding.md
@@ -0,0 +1,190 @@
+---
+title: "Understanding Reed-Solomon Error Correction Math & Safe Logo Embedding in QR Codes"
+description: "A deep computer science exploration of Galois Field GF(2^8) math in Reed-Solomon error correction and building a custom QR code generator to embed brand logos."
+tags: math, computer-science, graphics, algorithm
+keywords: custom qr code generator, free custom qr code generator, qr code designer, branded qr code generator, custom qr code, create custom qr code
+canonical_url: https://www.qrmaster.net/blog/custom-qr-code-design
+---
+
+# Understanding Reed-Solomon Error Correction Math & Safe Logo Embedding in QR Codes
+
+Many developers assume QR codes are fragile grids where changing a single black module into white destroys the entire payload. In reality, QR codes generated by a **custom qr code generator** are engineered with **Reed-Solomon Error Correction**, a powerful algebraic coding scheme that allows up to 30% of the physical barcode to be completely destroyed, stained, or covered by a company logo while remaining 100% scannable.
+
+However, naive logo overlays—such as slapping a large PNG graphic directly into the center of a QR code using image editing software—frequently cause scan failures in low-light or low-resolution camera sensors.
+
+In this article, we will unpack the computer science math behind Galois Fields $GF(2^8)$, Reed-Solomon error correction polynomials, and how a **branded qr code generator** computes safe logo placement margins without corrupting the barcode matrix.
+
+---
+
+## 1. The Computer Science Math of Reed-Solomon Codes
+
+Reed-Solomon error correction in a **custom qr code generator** operates by representing data as polynomial coefficients over a finite field (also known as a **Galois Field**, denoted as $GF(2^8)$).
+
+### Finite Field Arithmetic: $GF(2^8)$
+Computers store data in bytes ($8\text{ bits} = 256$ distinct values). In $GF(2^8)$, arithmetic operations (addition, multiplication) are defined such that results never overflow 8 bits (values stay strictly between $0$ and $255$).
+
+- **Addition & Subtraction**: In $GF(2^8)$, addition is equivalent to bitwise XOR (`^` in JavaScript/C++):
+  $$A + B = A \oplus B$$
+- **Multiplication**: Multiplication uses a generator polynomial (typically $x^8 + x^4 + x^3 + x^2 + 1$, corresponding to the primitive decimal polynomial $285$).
+
+### The Generator Polynomial
+To generate $R$ error correction codewords for a data message polynomial $M(x)$, the message is multiplied by $x^R$ and divided by a generator polynomial $G(x)$:
+
+$$G(x) = \prod_{i=0}^{R-1} (x - \alpha^i)$$
+
+The remainder of this polynomial division forms the **Error Correction Codewords** appended to the end of the QR payload.
+
+When a camera reads a damaged matrix from a **qr code designer**:
+1. It evaluates the polynomial to find **Syndromes** ($S_1, S_2, \dots, S_R$).
+2. If all syndromes equal $0$, the matrix has zero errors.
+3. If syndromes are non-zero, algorithms like **Berlekamp-Massey** or **Chien Search** locate the exact error positions and correct the inverted bit values automatically!
+
+---
+
+## 2. Error Correction Capacity Levels in QR Codes
+
+The ISO/IEC 18004 specification defines four error correction levels in a **custom qr code generator free** engine, determining how many redundant codewords are added to the matrix:
+
+```
+┌─────────────────────────┬──────────────────────┬───────────────────────────────┐
+│ Error Correction Level  │ Recovery Capacity    │ Max Logo Coverage Budget      │
+├─────────────────────────┼──────────────────────┼───────────────────────────────┤
+│ Level L (Low)           │ ~7% of codewords     │ Dangerous (Max < 4% surface)  │
+│ Level M (Medium)        │ ~15% of codewords    │ Low (Max ~8% surface)         │
+│ Level Q (Quartile)      │ ~25% of codewords    │ Moderate (Max ~15% surface)   │
+│ Level H (High)          │ ~30% of codewords    │ High (Max ~22-25% surface)    │
+└─────────────────────────┴──────────────────────┴───────────────────────────────┘
+```
+
+When you place a logo over the center of a QR code using a **custom qr code generator**, you are intentionally destroying codewords. Therefore:
+> **Golden Rule**: Always set Error Correction Level to **Level H (High)** whenever embedding logos or custom artwork.
+
+---
+
+## 3. Mathematical Rules for Safe Logo Embedding
+
+Overlaying a logo is not just about keeping the covered area under 30%. Camera scanners face environmental degradation (glare, shadows, camera blur, dirty lenses). If your logo consumes 28% of the error correction budget, a slight lens smudge will push total error past 30%, causing scan failure!
+
+### Rule 1: Never Touch the Three Finder Patterns
+The three large $7 \times 7$ square finder patterns in the top-left, top-right, and bottom-left corners are sacrosanct. If a camera cannot detect all three finder patterns, it cannot determine orientation or matrix dimensions, and decoding aborts instantly before Reed-Solomon math is even attempted!
+
+### Rule 2: Keep Logo Surface Area Below 20%
+To ensure reliable scanning across all smartphone models and lighting conditions in your **custom qr code designer**, limit your logo footprint to **15% to 20% of the total matrix area**.
+
+$$\text{Max Logo Dimension (px)} = \text{Matrix Width (px)} \times \sqrt{0.20} \approx \text{Matrix Width} \times 0.44$$
+
+### Rule 3: Add a Protective Padding Zone (Quiet Boundary)
+Logos should never merge directly into surrounding QR modules. A 2-module wide solid background padding around the logo prevents module misinterpretation.
+
+---
+
+## 4. Programmatic Implementation: Merging Logo into QR SVG with Node.js
+
+Below is a Node.js TypeScript module that programmatically computes matrix dimensions, generates a Level H QR SVG, embeds a centered vector logo, and applies a protective background mask for a **create custom qr code** service.
+
+### Step 4.1: Code Implementation (`src/services/customQrBuilder.ts`)
+
+```typescript
+import QRCode from 'qrcode';
+
+export interface LogoEmbedOptions {
+  text: string;
+  logoSvgContent: string; // Raw SVG string of logo (e.g. <path .../>)
+  logoWidthPercent?: number; // Target logo width as percentage of matrix (default: 20%)
+  colorDark?: string;
+  colorLight?: string;
+}
+
+export class CustomQRBuilder {
+  /**
+   * Generates a combined SVG string with centered logo and protective padding.
+   */
+  public static async generateLogoQR(options: LogoEmbedOptions): Promise<string> {
+    const {
+      text,
+      logoSvgContent,
+      logoWidthPercent = 20,
+      colorDark = '#090D16',
+      colorLight = '#FFFFFF',
+    } = options;
+
+    // Enforce Level H (30% error tolerance)
+    const qrMatrix = QRCode.create(text, { errorCorrectionLevel: 'H' });
+    const moduleCount = qrMatrix.modules.size; // Total modules per side (e.g., 29x29)
+
+    const size = 500; // SVG canvas size in pixels
+    const margin = 4; // Module padding
+    const totalModules = moduleCount + margin * 2;
+    const moduleSizePx = size / totalModules;
+
+    // Compute Logo Pixel Bounds
+    const maxLogoPercent = Math.min(Math.max(logoWidthPercent, 10), 22);
+    const logoSizePx = size * (maxLogoPercent / 100);
+    const logoOffset = (size - logoSizePx) / 2;
+
+    // Protective padding around logo (in pixels)
+    const paddingPx = moduleSizePx * 1.5;
+    const padSizePx = logoSizePx + paddingPx * 2;
+    const padOffset = (size - padSizePx) / 2;
+
+    // 1. Generate Base QR SVG Paths
+    const rawSvg = await QRCode.toString(text, {
+      type: 'svg',
+      errorCorrectionLevel: 'H',
+      margin,
+      color: { dark: colorDark, light: colorLight },
+    });
+
+    // 2. Extract SVG Inner Content (Paths)
+    const svgInnerMatch = rawSvg.match(/<svg[^>]*>([\s\S]*?)<\/svg>/i);
+    const baseContent = svgInnerMatch ? svgInnerMatch[1] : '';
+
+    // 3. Construct Final Composite SVG with Protective White Rect + Logo
+    const compositeSvg = `
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 ${size} ${size}" width="${size}" height="${size}">
+  <!-- Base QR Matrix -->
+  ${baseContent}
+
+  <!-- Protective Quiet Mask behind Logo -->
+  <rect 
+    x="${padOffset.toFixed(2)}" 
+    y="${padOffset.toFixed(2)}" 
+    width="${padSizePx.toFixed(2)}" 
+    height="${padSizePx.toFixed(2)}" 
+    fill="${colorLight}" 
+    rx="${moduleSizePx.toFixed(2)}" 
+  />
+
+  <!-- Embedded Centered Brand Logo -->
+  <g transform="translate(${logoOffset.toFixed(2)}, ${logoOffset.toFixed(2)}) scale(${(logoSizePx / 100).toFixed(4)})">
+    ${logoSvgContent}
+  </g>
+</svg>`.trim();
+
+    return compositeSvg;
+  }
+}
+```
+
+---
+
+## 5. Verification & Scannability Testing Checklist
+
+Before deploying a **custom qr code generator** with embedded logos, run through this automated and manual test matrix:
+
+```
+[ ] Enforce Level H Error Correction in code config.
+[ ] Verify logo consumes ≤ 20% total matrix area.
+[ ] Confirm finder patterns (3 corner squares) are 100% un-obscured.
+[ ] Test scan under low-light conditions (phone screen at 20% brightness).
+[ ] Test scan at 45-degree angled perspective.
+[ ] Test scan using both native iOS Camera App and Android Google Lens.
+```
+
+---
+
+## Conclusion
+
+Reed-Solomon error correction is an engineering marvel that makes a **custom qr code generator** with logo embedding possible. By understanding finite field mathematics, enforcing Level H error recovery, and restricting logo surface area to 20%, developers can build stunning, branded QR codes without sacrificing scan reliability.
+
+To build pixel-perfect custom QR codes with verified scannability, vector logo uploads, and real-time scan metrics, try [QR Master Custom QR Code Generator](https://www.qrmaster.net/custom-qr-code-generator).
--- a/articles/devto-hashnode/devto-vcard-rfc-spec-barcode-payloads.md
+++ b/articles/devto-hashnode/devto-vcard-rfc-spec-barcode-payloads.md
@@ -0,0 +1,202 @@
+---
+title: "Parsing vCard (RFC 2426/6350) Specifications & Optimizing 2D Barcode Payload Limits"
+description: "A deep technical guide to the vCard data specification standard, character encodings, payload byte limits in a vcard qr code generator, and building a qr code generator for business cards."
+tags: webdev, javascript, typescript, standards
+keywords: vcard qr code generator, free vcard qr code generator, qr code generator business card, free qr code generator for business cards, qr code business card free, qr code generator contact card
+canonical_url: https://www.qrmaster.net/blog/vcard-qr-code-generator
+---
+
+# Parsing vCard (RFC 2426/6350) Specifications & Optimizing 2D Barcode Payload Limits
+
+Digital business cards powered by a **vcard qr code generator** allow users to instantly save contact details—name, phone number, email, website, job title, and social links—directly into an iOS or Android address book with a single camera scan.
+
+Behind the scenes, building a **qr code generator for business cards** relies on the **vCard specification** (RFC 2426 for vCard 3.0 and RFC 6350 for vCard 4.0).
+
+However, many developers run into a major issue: when users paste extensive bio notes, social media links, profile photos, or secondary addresses into a **free qr code generator for business cards**, the QR matrix becomes extremely dense (Version 25+ with over 1,500 modules). This results in a tiny, cluttered barcode that fails to scan on mobile cameras.
+
+In this developer guide, we will analyze the vCard specification RFC standards, calculate maximum 2D barcode payload capacity, and write a TypeScript contact card optimizer that compresses vCard data for instant scannability.
+
+---
+
+## 1. Breakdown of the vCard Specification Standards
+
+A vCard used in a **vcard qr code generator** is a plain-text MIME directory format storing contact details line-by-line using `KEY:VALUE` properties.
+
+### vCard 3.0 (RFC 2426) vs. vCard 4.0 (RFC 6350)
+
+```
+┌───────────────────────────┬─────────────────────────────┬─────────────────────────────┐
+│ Feature                   │ vCard 3.0 (RFC 2426)        │ vCard 4.0 (RFC 6350)        │
+├───────────────────────────┼─────────────────────────────┼─────────────────────────────┤
+│ Mobile OS Compatibility   │ 100% Universal (iOS & Android)│ ~85% (Fails on older OS)    │
+│ Character Encoding         │ UTF-8 / Quoted-Printable    │ Mandatory UTF-8             │
+│ Preferred Recommendation │ ✅ BEST for QR Code Barcodes │ ⚠️ Use with caution        │
+└───────────────────────────┴─────────────────────────────┴─────────────────────────────┘
+```
+
+> **Important Developer Note**: Always target **vCard 3.0** when building a **free vcard qr code generator** that embeds data directly into static QR codes. Native camera scanner parsers on older Android versions and non-standard camera apps frequently fail to recognize vCard 4.0 properties.
+
+### Standard vCard 3.0 Structure Example:
+
+```text
+BEGIN:VCARD
+VERSION:3.0
+N:Knuth;Timo;;;
+FN:Timo Knuth
+ORG:QR Master
+TITLE:Lead Software Architect
+TEL;TYPE=CELL,VOICE:+15550192834
+EMAIL;TYPE=INTERNET,PREF:timo@qrmaster.net
+URL:https://www.qrmaster.net
+ADR;TYPE=WORK:;;100 Tech Way;San Francisco;CA;94107;USA
+END:VCARD
+```
+
+---
+
+## 2. QR Code Capacity Limits & The Matrix Density Problem
+
+QR codes have 40 discrete matrix sizes (Version 1 to Version 40). As byte payload increases, matrix size grows exponentially:
+
+```
+┌─────────┬──────────────┬─────────────────────────┬────────────────────────────────┐
+│ Version │ Matrix Grid  │ Max Bytes (Level M)     │ Scan Usability on Business Cards│
+├─────────┼──────────────┼─────────────────────────┼────────────────────────────────┤
+│ Ver 3   │ 29 x 29      │ 53 bytes                │ Super Fast (Instant)           │
+│ Ver 6   │ 41 x 41      │ 134 bytes               │ Excellent                      │
+│ Ver 11  │ 61 x 61      │ 321 bytes               │ Good (Standard vCard max)      │
+│ Ver 20  │ 97 x 97      │ 858 bytes               │ Sluggish / Requires Closeup    │
+│ Ver 40  │ 177 x 177    │ 2,331 bytes             │ Fails on printed cards         │
+└─────────┴──────────────┴─────────────────────────┴────────────────────────────────┘
+```
+
+### The Physical Print Limit Rule for Business Cards
+On a standard $85\text{ mm} \times 55\text{ mm}$ printed business card, a QR code created with a **qr code business card free** generator printed smaller than $20\text{ mm} \times 20\text{ mm}$ should **never exceed Version 10 (600 bytes)**. Encoding full profile photos (BASE64 strings) directly into a static vCard QR code requires over 5,000 bytes, which exceeds maximum QR capacity entirely!
+
+---
+
+## 3. Building a TypeScript vCard Optimizer & Sanitizer
+
+To guarantee fast scans, we can build a utility class in TypeScript for a **qr code generator contact card** that formats vCard properties, strips unnecessary whitespace, sanitizes multi-byte characters, and compresses payload size.
+
+### Step 3.1: vCard Builder Implementation (`src/services/vcardOptimizer.ts`)
+
+```typescript
+export interface ContactFields {
+  firstName: string;
+  lastName: string;
+  organization?: string;
+  title?: string;
+  phoneCell?: string;
+  phoneWork?: string;
+  email?: string;
+  url?: string;
+  city?: string;
+  country?: string;
+}
+
+export class VCardOptimizer {
+  /**
+   * Generates a clean, byte-optimized vCard 3.0 string for a vcard qr code generator.
+   */
+  public static buildOptimizedVCard(fields: ContactFields): string {
+    const lines: string[] = [];
+
+    // Header
+    lines.push('BEGIN:VCARD');
+    lines.push('VERSION:3.0');
+
+    // Structured Name (N:LastName;FirstName;;;)
+    const last = this.cleanText(fields.lastName || '');
+    const first = this.cleanText(fields.firstName || '');
+    lines.push(`N:${last};${first};;;`);
+
+    // Formatted Name (FN:FirstName LastName)
+    const fullName = `${first} ${last}`.trim();
+    lines.push(`FN:${fullName}`);
+
+    // Optional Fields (Only append if non-empty to conserve bytes)
+    if (fields.organization) {
+      lines.push(`ORG:${this.cleanText(fields.organization)}`);
+    }
+
+    if (fields.title) {
+      lines.push(`TITLE:${this.cleanText(fields.title)}`);
+    }
+
+    if (fields.phoneCell) {
+      lines.push(`TEL;TYPE=CELL:${this.sanitizePhone(fields.phoneCell)}`);
+    }
+
+    if (fields.phoneWork) {
+      lines.push(`TEL;TYPE=WORK:${this.sanitizePhone(fields.phoneWork)}`);
+    }
+
+    if (fields.email) {
+      lines.push(`EMAIL;TYPE=INTERNET:${fields.email.trim()}`);
+    }
+
+    if (fields.url) {
+      lines.push(`URL:${fields.url.trim()}`);
+    }
+
+    if (fields.city || fields.country) {
+      const city = this.cleanText(fields.city || '');
+      const country = this.cleanText(fields.country || '');
+      lines.push(`ADR;TYPE=WORK:;;;${city};;;${country}`);
+    }
+
+    // Footer
+    lines.push('END:VCARD');
+
+    // Join with standard CRLF (\r\n) as specified by RFC 2426
+    return lines.join('\r\n');
+  }
+
+  private static sanitizePhone(phone: string): string {
+    return phone.replace(/[^\d+]/g, '');
+  }
+
+  private static cleanText(str: string): string {
+    return str
+      .trim()
+      .replace(/\\/g, '\\\\')
+      .replace(/;/g, '\\;')
+      .replace(/,/g, '\\,')
+      .replace(/\n/g, ' ');
+  }
+
+  public static getByteSize(vcardString: string): number {
+    return Buffer.byteLength(vcardString, 'utf8');
+  }
+}
+```
+
+---
+
+## 4. Static vCard vs. Dynamic Business Card Landing Pages
+
+When building a **qr code generator for business cards**, developers face a choice between two architectures:
+
+```
+┌───────────────────────────────────────┬───────────────────────────────────────┐
+│ Static vCard QR Code                  │ Dynamic Business Card Landing Page     │
+├───────────────────────────────────────┼───────────────────────────────────────┤
+│ Data stored directly inside QR matrix │ Encodes short URL (e.g. /c/timo)      │
+│ Works 100% offline (no internet needed)│ Requires internet connection          │
+│ Contact data CANNOT be edited         │ Contact data can be updated anytime   │
+│ Limited fields (~300 bytes max)       │ Unlimited fields, photo & social links│
+└───────────────────────────────────────┴───────────────────────────────────────┘
+```
+
+### Strategic Recommendation:
+- Use **Static vCard 3.0** when working offline or when data privacy is paramount (no external server dependency).
+- Use **Dynamic Contact Landing Pages** when you need click analytics, social links, profile photos, or the ability to update details without reprinting cards.
+
+---
+
+## Conclusion
+
+Understanding the vCard RFC 2426 specification and respecting barcode payload byte limits is essential for building a **vcard qr code generator**. By stripping non-essential formatting and targeting vCard 3.0, you ensure instant contact saves on both iOS and Android devices.
+
+To build interactive dynamic business card QR codes with profile picture uploads, social links, and real-time contact save tracking, check out [QR Master vCard QR Code Generator](https://www.qrmaster.net/blog/vcard-qr-code-generator).
--- a/articles/devto-hashnode/devto-wifi-qr-code-guest-access-guide.md
+++ b/articles/devto-hashnode/devto-wifi-qr-code-guest-access-guide.md
@@ -0,0 +1,199 @@
+---
+title: "How to Create a Free Wi-Fi QR Code: The Complete Guide for Cafes, Hotels & Home Networks"
+description: "A complete step-by-step technical guide to generating Wi-Fi QR codes, encoding WPA2/WPA3 credentials, avoiding security bugs, and printing tabletop stand graphics for guest access."
+tags: networking, mobile, webdev, tutorial
+keywords: qr wifi, wifi qr code generator, print qr code, free static qr code generator, print a qr code, wifi qr code, create wifi qr code
+canonical_url: https://www.qrmaster.net/blog/wifi-qr-code-generator
+---
+
+# How to Create a Free Wi-Fi QR Code: The Complete Guide for Cafes, Hotels & Home Networks
+
+Tired of spelling out long, complex Wi-Fi passwords to restaurant guests, Airbnb visitors, hotel clients, or home friends?
+
+A **qr wifi** code allows anyone with an iPhone or Android device to point their native camera app at a printed barcode and tap a single banner button to automatically join the network—without typing a single character.
+
+In your Google Keyword Planner data, search queries for `qr wifi` and `print qr code` have exploded with **+900% annual growth**.
+
+In this technical guide, we will walk through the step-by-step process of using a **wifi qr code generator**, explaining string syntax, security protocols (WPA2/WPA3), character escaping rules, and downloading vector SVG graphics to **print a qr code** for physical tabletop stands.
+
+---
+
+## 1. How a Wi-Fi QR Code Works Behind the Scenes
+
+Unlike web URLs that open Safari or Chrome, a Wi-Fi QR code uses a specialized, offline MIME payload format standardized by ZXing.
+
+When a mobile device camera scans a **wifi qr code**, the operating system recognizes the `WIFI:` protocol prefix and hands off the credentials directly to the OS network manager (iOS Wi-Fi Settings / Android Network Manager).
+
+```
+┌────────────────────────────────────────┐
+│ Camera Scans WIFI: Payload String      │
+└───────────────────┬────────────────────┘
+                    │
+                    ▼
+┌────────────────────────────────────────┐
+│ OS Displays Modal Banner:              │
+│ "Join 'Cafe_Guest' Wi-Fi Network?"     │
+└───────────────────┬────────────────────┘
+                    │
+                    ▼
+┌────────────────────────────────────────┐
+│ User Taps Banner ➔ One-Tap Auto Connect│
+└────────────────────────────────────────┘
+```
+
+Because a Wi-Fi code stores network credentials directly in the matrix, it uses a **free static qr code generator**. It operates 100% offline—meaning guests can scan and connect even when cellular data coverage is unavailable inside a basement venue!
+
+---
+
+## 2. Step-by-Step Guide to Creating a Wi-Fi QR Code
+
+### Step 1: Collect Your Exact Network Credentials
+To generate a valid code, gather three exact values from your router or network admin panel:
+1. **Network Name (SSID)**: The exact case-sensitive name broadcasted by your router (e.g., `Lounge_Guest_5G`).
+2. **Password (Pre-shared Key)**: The exact Wi-Fi password.
+3. **Security Encryption Type**:
+   - `WPA/WPA2/WPA3` (Standard for ~98% of modern home and business routers).
+   - `WEP` (Legacy encryption).
+   - `Open / None` (Unencrypted public networks).
+
+---
+
+### Step 2: Format the String with Proper Escaping
+
+If your SSID or Wi-Fi password contains special characters like colons (`:`), semicolons (`;`), backslashes (`\`), or commas (`,`), you must escape them with a backslash.
+
+#### Protocol Syntax Template:
+```text
+WIFI:S:<SSID>;T:<SECURITY>;P:<PASSWORD>;;
+```
+
+#### Example Formats:
+
+```text
+# Standard WPA2/WPA3 Home Network
+WIFI:S:MyHomeWiFi;T:WPA;P:SecretPass2026;;
+
+# Cafe Network with a Semicolon in the SSID ("Cafe;Lounge")
+WIFI:S:Cafe\;Lounge;T:WPA;P:coffee123;;
+
+# Free Open Public Network (No Password)
+WIFI:S:Airport_Free_WiFi;T:nopass;;
+```
+
+> **Crucial Rule**: Notice the two semicolons (`;;`) at the end of the string. Leaving out the double semicolon will cause iOS Camera apps to fail to parse the barcode!
+
+---
+
+## 3. How to Print a QR Code for Physical Venues
+
+Generating the digital image is only half the battle. When you **print a qr code** for physical tabletop signs or wall posters, follow these print specifications:
+
+```
+┌───────────────────────────┬───────────────────────────────────────────┐
+│ Print Guideline           │ Recommended Specification                 │
+├───────────────────────────┼───────────────────────────────────────────┤
+│ File Export Format        │ Vector SVG (Scalable, non-pixelated)      │
+│ Minimum Physical Size     │ 3 cm x 3 cm (1.2 in x 1.2 in)             │
+│ Quiet Zone Margin         │ At least 4 modules of whitespace border   │
+│ Contrast Ratio            │ Dark modules on a clean white background  │
+└───────────────────────────┴───────────────────────────────────────────┘
+```
+
+### Printable Tabletop Sign Template (HTML/CSS)
+
+You can copy and save this HTML template to print professional Wi-Fi stand cards for your business:
+
+```html
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <title>Wi-Fi Access Tabletop Stand</title>
+  <style>
+    @media print { body { -webkit-print-color-adjust: exact; } }
+    body { font-family: 'Inter', system-ui, sans-serif; display: flex; justify-content: center; align-items: center; min-height: 100vh; background: #F8FAFC; margin: 0; }
+    .stand-card { background: white; width: 300px; padding: 32px 24px; border-radius: 16px; box-shadow: 0 10px 25px rgba(0,0,0,0.08); text-align: center; border: 1px solid #E2E8F0; }
+    h1 { font-size: 20px; color: #0F172A; margin: 0 0 6px; }
+    p.sub { color: #64748B; font-size: 13px; margin: 0 0 20px; }
+    .qr-box { background: #F1F5F9; padding: 16px; border-radius: 12px; display: inline-block; margin-bottom: 20px; }
+    .info { background: #F8FAFC; padding: 12px; border-radius: 8px; border: 1px solid #E2E8F0; font-size: 12px; text-align: left; }
+    .row { display: flex; justify-content: space-between; margin-bottom: 4px; }
+    .row:last-child { margin-bottom: 0; }
+    .lbl { color: #64748B; }
+    .val { color: #0F172A; font-weight: 600; font-family: monospace; }
+  </style>
+</head>
+<body>
+  <div class="stand-card">
+    <h1>Free Wi-Fi Access</h1>
+    <p class="sub">Scan with phone camera to connect</p>
+
+    <div class="qr-box">
+      <!-- Insert SVG QR Code Here -->
+      <svg width="180" height="180" viewBox="0 0 180 180">
+        <!-- SVG Paths -->
+      </svg>
+    </div>
+
+    <div class="info">
+      <div class="row"><span class="lbl">SSID:</span><span class="val">Guest_WiFi</span></div>
+      <div class="row"><span class="lbl">Pass:</span><span class="val">Welcome2026</span></div>
+    </div>
+  </div>
+</body>
+</html>
+```
+
+---
+
+## 4. Programmatic Implementation: Wi-Fi Generator in TypeScript
+
+Below is a TypeScript module that constructs escaped Wi-Fi strings and generates vector SVG barcodes automatically.
+
+```typescript
+import QRCode from 'qrcode';
+
+export interface WifiParams {
+  ssid: string;
+  password?: string;
+  security: 'WPA' | 'WEP' | 'nopass';
+  hidden?: boolean;
+}
+
+export class WifiQrEngine {
+  /**
+   * Builds an escaped WIFI: URI payload and renders vector SVG.
+   */
+  public static async generateWifiSvg(params: WifiParams): Promise<string> {
+    const { ssid, password = '', security, hidden = false } = params;
+
+    if (!ssid) throw new Error('SSID is mandatory.');
+    if (security !== 'nopass' && !password) throw new Error('Password is required.');
+
+    // Escape special characters: colons, semicolons, backslashes, commas
+    const cleanSsid = ssid.replace(/([\\;:,])/g, '\\$1');
+    const cleanPass = password.replace(/([\\;:,])/g, '\\$1');
+
+    let payload = `WIFI:S:${cleanSsid};T:${security};`;
+    if (security !== 'nopass') payload += `P:${cleanPass};`;
+    if (hidden) payload += `H:true;`;
+    payload += ';;'; // Double semicolon termination
+
+    // Generate static SVG
+    return await QRCode.toString(payload, {
+      type: 'svg',
+      errorCorrectionLevel: 'M',
+      margin: 4,
+      color: { dark: '#0F172A', light: '#FFFFFF' },
+    });
+  }
+}
+```
+
+---
+
+## Conclusion
+
+Using a **wifi qr code generator** transforms the frustrating experience of typing Wi-Fi passwords into a seamless, one-tap camera interaction. By using static SVG vector files when you **print a qr code**, your guest Wi-Fi access signs remain scannable for years without extra maintenance.
+
+To generate free vector Wi-Fi QR codes with custom tabletop templates and logo branding, check out [QR Master Free Wi-Fi QR Code Generator](https://www.qrmaster.net/blog/wifi-qr-code-generator).
--- a/articles/devto-hashnode/devto-wifi-qr-code-protocol-spec.md
+++ b/articles/devto-hashnode/devto-wifi-qr-code-protocol-spec.md
@@ -0,0 +1,261 @@
+---
+title: "Wi-Fi QR Code Protocol: WIFI: String Syntax Specification & Mobile OS Parsing"
+description: "A comprehensive developer guide to the unofficial WIFI: URI protocol specification, character escaping rules, WPA2/WPA3 network formats, and creating a print qr code for Wi-Fi access."
+tags: networking, mobile, webdev, security
+keywords: qr wifi, wifi qr code generator, print qr code, print a qr code, free static qr code generator, static qr code generator
+canonical_url: https://www.qrmaster.net/blog/wifi-qr-code-generator
+---
+
+# Wi-Fi QR Code Protocol: WIFI: String Syntax Specification & Mobile OS Parsing
+
+Scanning a **qr wifi** code to automatically connect a smartphone to a Wi-Fi network without manually typing complex WPA3 passwords is one of the most common physical tech interactions.
+
+Unlike vCards or geo-locations which have formal IETF RFC standards, a **wifi qr code generator** uses an de facto industry standard string syntax originally popularized by ZXing ("Zebra Crossing").
+
+In this technical guide, we will inspect the exact `WIFI:` connection string syntax, character escaping rules, WPA2/WPA3 security flags, hidden network parameters, and build a TypeScript utility to generate a **print qr code** for physical tabletop stands using a **free static qr code generator**.
+
+---
+
+## 1. The `WIFI:` String Protocol Syntax
+
+The payload generated by a **wifi qr code generator** is a formatted key-value string prefixed with `WIFI:`.
+
+### Protocol Format:
+```text
+WIFI:S:<SSID>;T:<SECURITY_TYPE>;P:<PASSWORD>;H:<HIDDEN_FLAG>;;
+```
+
+### Parameter Specification:
+
+| Parameter Key | Description | Allowed Values | Required? |
+|---|---|---|---|
+| **S** | Network SSID (Name) | Any string (UTF-8) | ✅ Mandatory |
+| **T** | Security Encryption Type | `WPA`, `WEP`, `nopass` | ✅ Mandatory |
+| **P** | Pre-shared Key (Password) | Network password string | Conditional (Skip if `nopass`) |
+| **H** | Hidden SSID Flag | `true` or `false` | Optional (Default: `false`) |
+
+---
+
+## 2. Character Escaping Rules: Avoiding Connection Failures
+
+The most frequent bug when building a **wifi qr code generator** is failing to escape special delimiter characters in the SSID or Password.
+
+### Characters Requiring Backslash Escaping (`\`):
+If an SSID or Wi-Fi password contains any of the following four characters:
+- Colon `:`
+- Semicolon `;`
+- Backslash `\`
+- Comma `,`
+
+They **must be escaped with a preceding backslash (`\`)**.
+
+### Escaping Examples:
+
+```text
+# Example 1: SSID containing a semicolon ("Coffee;Bar") and password "secret:123"
+WIFI:S:Coffee\;Bar;T:WPA;P:secret\:123;;
+
+# Example 2: Unencrypted Open Network ("Guest_WiFi")
+WIFI:S:Guest_WiFi;T:nopass;;
+
+# Example 3: Hidden WPA2/WPA3 Network ("Vault") with password "P@$$w0rd"
+WIFI:S:Vault;T:WPA;P:P@$$w0rd;H:true;;
+```
+
+> **Important**: Notice the double semicolon (`;;`) at the very end of the string. Mobile camera scanners use the trailing double semicolon as the string termination marker when parsing **qr wifi** codes!
+
+---
+
+## 3. iOS vs. Android OS Parser Behavior
+
+Understanding how mobile operating systems parse `WIFI:` barcodes prevents support headaches when users **print a qr code**.
+
+```
+┌───────────────────────────┬───────────────────────────────────────────┬───────────────────────────────────────────┐
+│ Feature                   │ Apple iOS (Camera App)                    │ Android (Google Lens / Native Scanner)   │
+├───────────────────────────┼───────────────────────────────────────────┼───────────────────────────────────────────┤
+│ User Interaction Prompt   │ Displays banner: "Join 'SSID' Network?"   │ Displays modal with "Connect to Network"  │
+│ One-Tap Auto Connect      │ ✅ Yes (Connects without typing password) │ ✅ Yes (Saves & connects automatically)   │
+│ WPA3 Compatibility        │ Map `T:WPA` for both WPA2 & WPA3          │ Map `T:WPA` for both WPA2 & WPA3          │
+│ Enterprise (802.1X / EAP)│ ❌ Unsupported via standard `WIFI:` string│ ❌ Requires mobile profile (.mobileconfig)│
+└───────────────────────────┴───────────────────────────────────────────┴───────────────────────────────────────────┘
+```
+
+*Note on WPA3:* Neither iOS nor Android requires a separate `T:WPA3` tag. Specifying `T:WPA` in your **static qr code generator** covers WPA, WPA2, and WPA3 Personal networks seamlessly.
+
+---
+
+## 4. TypeScript Implementation: Wi-Fi Payload Generator
+
+Below is a complete, production-ready TypeScript utility class that formats, escapes, and validates payloads for a **free static qr code generator**.
+
+### `src/services/wifiPayloadBuilder.ts`
+
+```typescript
+export type WifiSecurityType = 'WPA' | 'WEP' | 'nopass';
+
+export interface WifiConfig {
+  ssid: string;
+  password?: string;
+  securityType: WifiSecurityType;
+  isHidden?: boolean;
+}
+
+export class WifiPayloadBuilder {
+  /**
+   * Generates a fully escaped, validated WIFI: connection string.
+   */
+  public static buildPayload(config: WifiConfig): string {
+    const { ssid, password = '', securityType, isHidden = false } = config;
+
+    if (!ssid || ssid.trim().length === 0) {
+      throw new Error('Wi-Fi SSID is mandatory.');
+    }
+
+    if (securityType !== 'nopass' && (!password || password.length === 0)) {
+      throw new Error(`Password is required for security type "${securityType}".`);
+    }
+
+    // Escape special delimiter characters
+    const escapedSSID = this.escapeString(ssid);
+    const escapedPassword = securityType !== 'nopass' ? this.escapeString(password) : '';
+
+    let payload = `WIFI:S:${escapedSSID};T:${securityType};`;
+
+    if (securityType !== 'nopass') {
+      payload += `P:${escapedPassword};`;
+    }
+
+    if (isHidden) {
+      payload += `H:true;`;
+    }
+
+    // Append compulsory double-semicolon termination marker
+    payload += ';';
+
+    return payload;
+  }
+
+  private static escapeString(str: string): string {
+    return str.replace(/([\\;:,])/g, '\\$1');
+  }
+
+  public static isValidWifiPayload(payload: string): boolean {
+    return payload.startsWith('WIFI:') && payload.endsWith(';;');
+  }
+}
+```
+
+---
+
+## 5. How to Print a QR Code: Printable Wi-Fi Tabletop Sign Template
+
+When you **print a qr code** for physical venues (hotels, cafes, coworking spaces), pairing the vector barcode with clean printable HTML typography ensures guests know how to scan **qr wifi**.
+
+### Example Printable HTML Template (`public/wifi-stand-card.html`):
+
+```html
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <title>Wi-Fi Access Sign - Print QR Code</title>
+  <style>
+    @media print { body { -webkit-print-color-adjust: exact; } }
+    body { font-family: 'Inter', system-ui, sans-serif; display: flex; justify-content: center; align-items: center; min-height: 100vh; background: #F8FAFC; margin: 0; }
+    .card { background: white; width: 320px; padding: 36px 28px; border-radius: 20px; box-shadow: 0 10px 25px rgba(0,0,0,0.08); text-align: center; border: 1px solid #E2E8F0; }
+    h1 { font-size: 22px; color: #0F172A; margin: 0 0 6px; }
+    p.subtitle { color: #64748B; font-size: 14px; margin: 0 0 24px; }
+    .qr-container { background: #F1F5F9; padding: 16px; border-radius: 16px; display: inline-block; margin-bottom: 24px; }
+    .qr-container svg { display: block; }
+    .info-box { background: #F8FAFC; padding: 12px 16px; border-radius: 12px; border: 1px solid #E2E8F0; text-align: left; font-size: 13px; }
+    .info-row { display: flex; justify-content: space-between; margin-bottom: 6px; }
+    .info-row:last-child { margin-bottom: 0; }
+    .label { color: #64748B; font-weight: 500; }
+    .val { color: #0F172A; font-weight: 600; font-family: monospace; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <h1>Connect to Wi-Fi</h1>
+    <p class="subtitle">Scan with your phone camera to join</p>
+
+    <div class="qr-container">
+      <!-- Insert Vector SVG QR Code Here -->
+      <svg width="180" height="180" viewBox="0 0 180 180">
+        <!-- SVG Paths -->
+      </svg>
+    </div>
+
+    <div class="info-box">
+      <div class="info-row">
+        <span class="label">Network:</span>
+        <span class="val">Guest_Lounge_5G</span>
+      </div>
+      <div class="info-row">
+        <span class="label">Password:</span>
+        <span class="val">Welcome2026!</span>
+      </div>
+    </div>
+  </div>
+</body>
+</html>
+```
+
+---
+
+## 6. End-to-End Test Suite with Jest
+
+Let's write a unit test suite to verify string escaping and boundary conditions.
+
+### `tests/wifiPayload.test.ts`
+
+```typescript
+import { WifiPayloadBuilder } from '../src/services/wifiPayloadBuilder';
+
+describe('WifiPayloadBuilder', () => {
+  test('should generate standard WPA2 payload', () => {
+    const payload = WifiPayloadBuilder.buildPayload({
+      ssid: 'MyHomeWiFi',
+      password: 'SuperSecretPassword123',
+      securityType: 'WPA',
+    });
+    expect(payload).toBe('WIFI:S:MyHomeWiFi;T:WPA;P:SuperSecretPassword123;;');
+  });
+
+  test('should escape colons and semicolons in SSID and Password', () => {
+    const payload = WifiPayloadBuilder.buildPayload({
+      ssid: 'Cafe;WiFi:5G',
+      password: 'pass;word:123,key\\',
+      securityType: 'WPA',
+    });
+    expect(payload).toBe('WIFI:S:Cafe\\;WiFi\\:5G;T:WPA;P:pass\\;word\\:123\\,key\\\\;;');
+  });
+
+  test('should handle open unencrypted networks', () => {
+    const payload = WifiPayloadBuilder.buildPayload({
+      ssid: 'FreePublicWiFi',
+      securityType: 'nopass',
+    });
+    expect(payload).toBe('WIFI:S:FreePublicWiFi;T:nopass;;');
+  });
+
+  test('should include hidden flag when network is hidden', () => {
+    const payload = WifiPayloadBuilder.buildPayload({
+      ssid: 'HiddenNetwork',
+      password: 'secretpassword',
+      securityType: 'WPA',
+      isHidden: true,
+    });
+    expect(payload).toBe('WIFI:S:HiddenNetwork;T:WPA;P:secretpassword;H:true;;');
+  });
+});
+```
+
+---
+
+## Conclusion
+
+Understanding the `WIFI:` payload specification and implementing strict character escaping in a **wifi qr code generator** ensures seamless, friction-free auto-connections when you **print a qr code** for hotel guests, restaurant customers, and office visitors.
+
+To generate customizable vector Wi-Fi QR codes with custom brand colors, logo embedding, and printable tabletop stand templates, check out [QR Master Free Wi-Fi QR Generator](https://www.qrmaster.net/blog/wifi-qr-code-generator).
--- a/articles/digitalGpoint-dynamic-vs-static-qr-codes.md
+++ b/articles/digitalGpoint-dynamic-vs-static-qr-codes.md
@@ -0,0 +1,157 @@
+# Every Print Order Feels Final — Until Something Changes
+
+Every business owner knows the moment: you’ve just received a batch of 5,000 flyers, 500 business cards, or a year's worth of product packaging. Then, a week later, a URL changes. A team member leaves. A promo landing page is retired.
+
+Suddenly, that printed material isn't just "offline"—it's wrong.
+
+For small businesses, this is more than an inconvenience; it's a cost. Reprints are expensive, and stickers to cover up old info look unprofessional. This is where the distinction between **Static** and **Dynamic** QR codes becomes the most practical decision you'll make in your marketing workflow. 
+
+The data confirms the impact: according to **PhilomathNews**, QR-initiated customer journeys see an average **click-through rate (CTR) of 37%**—dramatically higher than standard digital campaigns.
+
+## Static vs. Dynamic: The Honest Difference
+
+<img src="../assets/images/static_vs_dynamic_light.png" alt="Side-by-Side Comparison: Static vs. Dynamic QR Codes" width="500" style="display: block; margin: 20px auto;">
+
+
+A **Static QR code** is permanent. The data (usually a URL) is hardcoded into the square pattern itself. Once printed, it cannot be changed. If the link breaks, the code is dead.
+
+A **Dynamic QR code** acts as a redirect layer. The code points to a placeholder URL that redirects the user to your final destination. Because you control that redirect layer, you can change the target URL at any time—even after the code is printed on a batch of brochures or thousands of product labels.
+
+Research from **SuperAGI** highlights the value of this flexibility: businesses using "smart" dynamic QR solutions see **60% higher engagement rates** compared to those using standard, non-editable codes.
+
+## When to Use Which?
+
+Dynamic codes aren't always "better"—they are just more flexible. 
+
+- **Use Static** if the destination is forever (like your main website or a permanent portfolio) and you have zero interest in tracking scans.
+- **Use Dynamic** if there is even a 1% chance the destination might change, or if you actually want to know which flyer in which coffee shop is driving traffic.
+
+## Choosing a Workflow
+
+Choosing a tool is less about the "best" features and more about what fits your volume. For permanent, simple links, any free generator works. If you need the flexibility to edit links or verify scan data, several platforms offer different levels of service.
+
+Lightweight tools can be enough to test this workflow before committing to a more advanced setup. Options like Bitly or [QR Master](https://qrmaster.net) — One of the easiest ways to start testing the dynamic redirect workflow without a subscription. It provides basic scan tracking and clean redirects, mapping perfectly to the "attribution-first" mindset.
+
+The goal isn't just to have a QR code; it's to make sure your physical materials don't become obsolete the moment your digital strategy shifts.
+
+
+---
+
+
+## 5 Common Use Cases Where Dynamic QR Codes Make the Difference
+
+### 1. Restaurant Menus
+
+Seasonal menus, changing prices, daily specials — restaurant menus are one of the highest-churn print materials in any business. Many restaurants learned this the hard way during supply chain disruptions when prices shifted week to week.
+
+A dynamic QR code on a table card or printed menu insert lets the restaurant update the full digital menu instantly — without reprinting anything. The code stays the same; the menu stays current.
+
+**Practical tip:** Link to a simple PDF or Google Doc menu for maximum flexibility. You can update it in minutes, even from a phone.
+
+
+---
+
+
+### 2. Product Packaging
+
+Packaging is expensive to change. If you add a new product page, update your warranty information, or translate for a new market, reprinting packaging is rarely an option.
+
+Dynamic QR codes on packaging let you link to updated product specs, how-to guides, warranty registration pages, or localized landing pages — and change that destination whenever needed.
+
+One especially useful application: use the same QR code on packaging to A/B test two different landing pages, then redirect permanently to whichever converts better.
+
+
+---
+
+
+### 3. Event Signage
+
+Trade show banners, conference materials, and event programs go out of date fast. A speaker cancels. The WiFi password changes. The venue moves.
+
+With a dynamic QR code, event organizers can update the destination in real time — even while the event is happening. Attendees scan the same code they saw on the banner and always land on the current information.
+
+
+---
+
+
+### 4. Business Cards
+
+Most business cards are printed in batches of 250–500 and used over months or years. A lot can change in that time: roles, phone numbers, portfolio URLs, LinkedIn handles.
+
+A single QR code on a business card that links to a centrally managed "digital business card" page solves this. Update the page once, and every card you've already handed out now points to the new information.
+
+This works especially well for freelancers, consultants, and real estate agents who update their portfolios regularly.
+
+
+---
+
+
+### 5. Direct Mail Campaigns
+
+Direct mail still works — but its biggest weakness is that you can't iterate once it's printed and sent. Dynamic QR codes change that.
+
+Marketers can send the same physical mailer to different segments but point the QR code to segment-specific landing pages. They can also monitor scan rates to understand which locations, demographics, or send times perform better — insights that would otherwise be invisible with static print.
+
+
+---
+
+
+## Step-by-Step: How to Switch to Dynamic QR Codes
+
+Switching doesn't require technical expertise. Here's a straightforward process for any small business:
+
+**Step 1: Identify your high-churn print materials**  
+Start with anything that contains a URL: menus, flyers, product inserts, event programs, business cards.
+
+**Step 2: Choose a dynamic QR code generator**  
+Look for a tool that lets you update destination URLs after creation, view scan analytics, and export in high resolution for print. A lightweight option for testing this workflow is [QR Master](https://qrmaster.net), which supports editable destinations and basic scan tracking without requiring an account.
+
+**Step 3: Generate your codes in print-ready resolution**  
+Export at minimum 300 DPI for clean print reproduction. Most professional generators offer SVG or high-resolution PNG exports.
+
+**Step 4: Apply a brief test before printing at scale**  
+Print one copy, scan it with multiple devices (iPhone, Android, older devices), and confirm the destination loads correctly.
+
+**Step 5: Plan your dashboard workflow**  
+Decide who in your team manages URL updates and in which situations. Write this down — it matters more when something changes under time pressure.
+
+**Step 6: Track and iterate**  
+Use scan analytics to understand when and where your codes are being used. This data helps you optimize placements in future campaigns.
+
+
+---
+
+
+## A Note on Print Sizing and Placement
+
+Dynamic or static, a QR code only works if it can be scanned reliably. Some practical minimums for print:
+
+- **Business cards:** 1.5 cm × 1.5 cm minimum, more if space allows
+- **Flyers / A5 print:** 2.5 cm × 2.5 cm or larger
+- **Signage / posters:** Scale proportionally — at 1 meter scan distance, 5–8 cm is a safe floor
+- **Packaging:** Factor in substrate color contrast — avoid printing on uncoated dark surfaces without a white background behind the code
+
+Keep at least 4–6 mm of quiet zone (blank white border) around the code on all sides. Cutting this margin is one of the most common reasons QR codes fail in the field.
+
+
+---
+
+
+## Conclusion: Making Print Measurable
+
+Dynamic QR codes aren't a technology novelty — they're a practical answer to a real cost problem in physical marketing. For any business that prints materials and needs those materials to stay current, the value is straightforward: print once, update as often as needed.
+
+For businesses that regularly print materials, the upside is simple: fewer reprints, fewer dead links, and less friction when something changes. The only question is how many expensive reprints you want to do before making the switch.
+
+
+---
+
+
+*For most small businesses, the easiest way to start is with a lightweight dynamic QR tool like [QR Master](https://qrmaster.net) that supports editable destinations and basic scan tracking.*
+
+
+---
+
+
+
+**Internal links to add post-acceptance:** 2–3 relevant DigitalGpoint articles (check site on acceptance)
--- a/articles/dynamic-vs-static-decision-matrix.md
+++ b/articles/dynamic-vs-static-decision-matrix.md
@@ -0,0 +1,181 @@
+# Dynamic vs. Static QR Codes: The Professional Decision Matrix
+
+## The Shift from "Static Print" to "Digital Agility"
+
+In the traditional marketing and logistics era, the relationship between a physical asset and its digital counterpart was often viewed as a one-time deployment. You printed a code, it pointed to a URL, and that was the end of the lifecycle. However, as business cycles accelerate and data privacy regulations tighten, this "print and pray" approach is no longer sufficient.
+
+For enterprise architects, marketing directors, and logistics managers, the choice between **Static** and **Dynamic** QR codes is not merely a technical preference—it is a strategic decision that affects campaign longevity, data security, and operational scalability. This guide provides a technical and strategic framework for deciding which architecture fits your specific professional requirements.
+
+---
+
+## 1. The Technical Foundation: How Data is Encoded
+
+To make an informed decision, one must first understand the fundamental engineering difference between the two formats.
+
+### Static QR Codes: Direct Data Encoding
+A Static QR code encodes the payload directly into the data modules; Reed-Solomon error correction is added to improve recovery from damage. 
+
+*   **Pixel Density:** As the payload size increases (e.g., from a 20-character URL to a 200-character description), the "version" of the QR code increases, leading to a denser, more complex pixel grid.
+*   **Immutability:** Once the code is generated, the underlying data cannot be changed. The patterns are fixed geographically in the physical modules.
+*   **Zero Latency & Independence:** A static code does not require a central server to function. As long as a scanner can interpret the pattern, the data is retrieved locally. This is the ultimate "fail-safe" architecture.
+
+### Dynamic QR Codes: The Managed Redirect Layer
+A Dynamic QR code typically encodes a short redirect URL that points to a destination managed on a server.
+
+*   **Pixel Consistency:** Because only a short URL is encoded (regardless of the final destination's length), the pixel density remains low (usually Version 1 or 2). This maximizes scanning speed and reliability.
+*   **Flexibility:** The destination URL can be updated in the database at any time—even after thousands of stickers or brochures have been distributed. 
+*   **Metadata Harvesting:** The intermediate redirect acts as a sentinel, capturing device operating systems, browser locales, and precise timestamps before the user is seamlessly passed to the final destination.
+
+---
+
+## 2. The Case for Static QR Codes: Security and Stability
+
+Despite the obvious flexibility of dynamic codes, Static QR codes remain the gold standard for specific professional use cases.
+
+### Zero-Dependency Infrastructure
+Static codes are entirely self-contained. They do not rely on an external service or a redirect server to function. For critical infrastructure or products with a 20-year shelf life, this zero-dependency profile is essential. If a redirect service goes out of business, every dynamic code pointing to its servers becomes a "dead" asset. Static codes, conversely, will work as long as the physical substrate exists.
+
+### Data Privacy and Security Nuances
+Static codes avoid redirect-layer tracking; however, any analytics on the destination page still depend on the target system. No intermediate scan logs are created by a generator service, making them ideal for healthcare, government, or high-security internal logistics where data sovereignty is the absolute priority.
+
+### Latency Mitigation
+While dynamic codes introduce a redirect, professional infrastructure can minimize this to negligible levels. 
+*   **Edge-Cached Redirects:** Use providers that leverage global CDNs (Content Delivery Networks) to resolve the redirect at the edge server closest to the user.
+*   **TTFB Monitoring:** Monitor the **Time-to-First-Byte** of your redirect server. A high TTFB on a mobile connection can turn a 100ms redirect into a 5-second frustration.
+
+**Primary Use Cases for Static:**
+*   **Hardware Labels:** Serial numbers and technical specifications.
+*   **Asset Management:** Permanent inventory IDs for internal tracking.
+*   **Personal Data:** Plain text credentials or permanent WiFi configurations.
+
+---
+
+## 3. The Power of Dynamic QR Codes: Agility and Attribution
+
+For marketing and customer-facing operations, the advantages of Dynamic QR codes are overwhelming.
+
+### The "Post-Print" Edit
+Errors in URLs or changes in landing page strategy are inevitable. A dynamic code acts as an insurance policy. If a campaign landing page is retired, you simply update the redirect to a new URL. This eliminates the catastrophic cost of reprinting OOH (Out-of-Home) signage or packaging.
+
+### Granular Attribution (The "Offline Analytics" Gap)
+In a professional campaign, "what gets measured gets managed." Dynamic codes provide a bridge between the physical world and your CRM or Analytics dashboard.
+*   **Geographic Insights:** Identifying which city or physical location is driving the most scans.
+*   **A/B Testing:** Sending 50% of scans to "Page A" and 50% to "Page B" to optimize conversion rates in real-time.
+
+### Short URL Scannability
+Because the encoded data is always a short URL (e.g., `qr.master/x1z`), the QR module size can remain small. This allows for higher scan reliability even on small surfaces (like medicine bottles) or from long distances (like billboards).
+
+---
+
+## 4. The Decision Matrix: A Professional Framework
+
+Use the following matrix to determine the correct architecture for your next deployment.
+
+```mermaid
+graph TD
+    A[Start: New QR Deployment] --> B{Does the destination URL <br/> have a 1% chance of changing?}
+    B -- Yes --> C[Dynamic QR Code]
+    B -- No --> D{Do you need scan analytics <br/> or geographic data?}
+    D -- Yes --> C
+    D -- No --> E{Is the code part of <br/> critical/permanent infrastructure?}
+    E -- Yes --> F[Static QR Code]
+    E -- No --> G{Is data privacy/GDPR compliance <br/> the absolute priority?}
+    G -- Yes --> F
+    G -- No --> C
+```
+
+### Table 1: Comparative Metric Overview
+
+| Feature | Static QR Code | Dynamic QR Code |
+| :--- | :--- | :--- |
+| **Sustainability** | Infinite (Zero dependency) | Dependent on Redirect Provider |
+| **Editability** | Immutable | Real-time Updates |
+| **Scannability** | Denser with more data | Consistent & Low-density |
+| **Privacy** | High (Internal/Self-contained) | Variable (Infrastructure dependent) |
+| **Analytics** | Hard-coded (Off-platform) | Full Engagement Data |
+| **Latency** | Instant | Infrastructure/Network Dependent |
+
+---
+
+## 5. Strategic Implementation: Best Practices for Professionals
+
+### Resolving the "Vendor Lock-in" Risk
+The biggest risk of Dynamic QR codes is being tied to a single provider. For enterprise-level deployments, mitigation is essential:
+*   **Custom Domain Hosting:** Use your own subdomain (e.g., `qr.yourcompany.com`). If you switch providers, you simply point your DNS to the new server, and existing codes remain functional.
+*   **The Self-Hosted Option:** For mission-critical environments, consider a self-hosted redirect layer (e.g., using **YOURLS** or a custom-built API). This ensures you own the "sentinel" that processes the scan.
+*   **Disaster Recovery:** Maintain an annual export of all redirect mappings (CSV/JSON). In a provider outage, this data allows for a rapid "emergency restore" to a secondary redirect service.
+
+### Dynamic QR Analytics: The GDPR Tightrope
+While dynamic codes enable tracking, they also introduce a data processing layer. Professionals must ensure compliance through a "Privacy by Design" lens:
+*   **IP Anonymization:** Ensure your provider masks the last octet of IP addresses to prevent the collection of PII (Personally Identifiable Information).
+*   **DPA Enforcement:** Only work with providers that offer a clear **Data Processing Agreement (DPA)** under GDPR or CCPA.
+*   **Consent Management:** If the redirect landing page uses tracking scripts (e.g., Meta Pixel), ensure a cookie banner is triggered *before* data collection begins. For the "pure" redirect phase, minimize log retention to the absolute minimum required for deduplication.
+
+### Error Correction and Surface Geometry
+In professional printing, always use at least **Level M (15%) or Level Q (25%)** Error Correction. This ensures that even if a code on a curved surface or a dusty warehouse floor is partially damaged, the data remains recoverable.
+
+### The "Quiet Zone" Rule
+Professionals never ignore the Quiet Zone. A minimum of **4 modules (blocks)** of empty white space must surround the code on all sides. Cutting into this space for "aesthetic" reasons is the #1 cause of scan failures in professional environments. Scanners use this zone to "bracket" the code and calibrate the optical sensor; without it, the algorithms may fail to distinguish the code from surrounding background noise.
+
+### Reed-Solomon Error Correction Selection
+For professional use, the choice of error correction (EC) level is critical. Higher EC levels allow for better recovery from physical damage but increase the code's version (size). 
+
+| EC Level | Damage Tolerance | Practical Example |
+| :--- | :--- | :--- |
+| **L (7%)** | Minor scratches | Indoor brochures in controlled, clean environments |
+| **M (15%)** | Moderate wear | Industry standard; outdoor posters, retail packaging |
+| **Q (25%)** | Heavy damage | Warehouse labels, industrial assets, curved surfaces |
+| **H (30%)** | Logo embedding | Branded QR codes with 20-30% logo coverage |
+
+---
+
+## 6. The Hybrid Strategy: The "Static Fallback" Pattern
+
+Modern enterprise architecture often avoids the binary "Static vs. Dynamic" choice in favor of a hybrid approach. This maximizes both flexibility and reliability.
+
+### The "Dual-Payload" Pattern
+Some QR payloads combine machine-readable static data with a URL field, giving scanners useful fallback information even if the online destination is unavailable. This pattern is common in vCards or complex sensor data strings.
+
+### Use Case: Critical Field Service
+An industrial generator might have a QR code. 
+*   **Static Data:** Hardware specs and emergency shutdown procedures (works even in a basement with zero signal).
+*   **Dynamic Data:** A link to a "Real-time Parts Order" page or the latest PDF manual.
+
+---
+
+## 7. Enterprise Operations: Beyond the Redirect
+
+### Legacy Code Migration: The "Wrapper" Strategy
+If you have deployed static codes that now need analytics, you do not necessarily need a reprint:
+*   **Custom Logging Logic:** Create a listener in your backend that parses the static payload scan results from your proprietary scan app.
+*   **Visual Recognition APIs:** Use computer vision to detect static codes and trigger background analytics calls in a controlled mobile app environment.
+*   **NFC Augmentation:** Deploy NFC tags alongside existing QR codes for dual-mode tracking without altering the original print.
+
+### Security Best Practices for Dynamic Redirects
+*   **HTTPS-Only:** Never use `http://` in redirect URLs to prevent man-in-the-middle attacks.
+*   **Rate Limiting:** Protect your short-link infrastructure from redirect-abuse and DDoS via "QR spam."
+*   **Expiration Management:** Set automatic expiration for time-sensitive marketing campaigns.
+*   **Redirect Validation:** Ensure no malicious intermediate redirects can be injected into your dashboard.
+
+### Cost Analysis: The ROI Perspective
+| Scenario | Static Approach | Dynamic Approach | Break-Even Point |
+| :--- | :--- | :--- | :--- |
+| **1000 assets, 0 changes** | €50 (one-time) | Subscription costs | Never (Use Static) |
+| **1000 assets, 1 URL fix** | €50 + €2,000 reprint | Subscription costs | After first change |
+| **A/B Testing Campaign** | Impossible | Subscription costs | Immediate |
+
+---
+
+## 8. Conclusion: Architecture for the Hybrid Era
+
+The choice between static and dynamic is not about which technology is "better," but about which architecture aligns with your project’s risk profile and measurement needs.
+
+*   **Choose Static** when the code is part of a machine, a permanent archive, or a privacy-sensitive internal workflow.
+*   **Choose Dynamic** when the code is a gateway to a campaign, a product support page, or any asset where the digital destination is subject to the speed of business.
+
+Tools like **QR Master** are designed to support both workflows, providing the high-resolution exports and professional-grade security required for enterprise-level bridge-building between the physical and digital worlds.
+
+---
+
+> [!TIP]
+> **Pro Tip for Logistics Managers:** Use Static codes for internal bin tracking to ensure zero downtime, but use Dynamic codes for customer-facing return labels to allow for carrier or address updates on the fly.
--- a/articles/linkedin-business-card-qr.md
+++ b/articles/linkedin-business-card-qr.md
@@ -0,0 +1,35 @@
+# Is Your Business Card a Dead End?
+
+<img src="../assets/images/business_card_scan.png" alt="Professional Scanning QR Business Card" width="400" style="display: block; margin: 20px auto;">
+
+
+I was at a local networking booth last week, and I collected about 20 business cards. When I sat down to follow up, I realized that 15 of them required me to manually type in a name, find them on LinkedIn, or search for their website.
+
+In a world where attention spans are measured in seconds, that’s a lot of friction.
+
+Adding a QR code to your business card isn’t just about "looking techy." It’s about making the leap from physical paper to digital connection as effortless as possible.
+
+But here’s the thing: most people do it wrong.
+
+### The 3 Biggest QR Mistakes on Business Cards
+
+1️⃣ **Using a Static Link**
+If you print 500 cards with a direct link to your current portfolio, and you change your URL next month, you now have 500 pieces of expensive trash. **Always use a dynamic QR code.** You can change the destination URL anytime without reprinting.
+
+2️⃣ **Linking to Your Home Page**
+Don't send me to a generic website where I have to search for your contact info. Link directly to a **vCard/Digital Business Card** or a specific landing page that says: "Add to Contacts."
+
+3️⃣ **The "Fine Print" Sizing**
+If the code is too small or has zero border (the "quiet zone"), phone cameras will struggle to focus. If I have to try three times to scan it, I'm going to stop trying.
+
+### Why I think about this so much...
+
+I kept running into this problem often enough that I eventually built a small tool called **[QR Master](https://qrmaster.net)** to make dynamic QR codes easier to create and test. I wanted a way to create trackable codes without the baggage of monthly subscriptions or complex dashboards.
+
+If you’re still handing out plain paper cards, try adding a small dynamic square on the next batch. It turns a piece of cardstock into a portal.
+
+**Quit handing out dead-end cards. Start handing out connections.**
+
+---
+
+#Networking #Marketing #B2B #DigitalTransformation #SmallBusiness #Productivity
--- a/articles/medium-5-underrated-qr-use-cases.md
+++ b/articles/medium-5-underrated-qr-use-cases.md
@@ -0,0 +1,66 @@
+# Beyond the Menu: 5 Practical Ways to Use QR Codes for Business Growth
+
+
+---
+
+
+We’ve all seen the lazy QR code. It’s sitting in a window, sun-faded, linking to a 2018 PDF menu that takes forty seconds to load on a 4G connection. 
+
+QR codes are no longer just shortcuts to menus and homepages. In more useful setups, they act as measurable handoffs between physical attention and digital action. The financial impact is quantifiable: restaurants switching to digital QR ordering consistently see a **12-22% lift in average order value (AOV)**, according to **FoxiFood**.
+
+Used more deliberately, QR codes can help connect printed materials with measurable digital actions — without expensive software or technical overhead. Here are five practical use cases where better tracking makes physical marketing a lot more useful.
+
+---
+
+## 1. The "Abandoned Cart" for Physical Retail
+
+Imagine someone walks into your boutique, looks at a high-end jacket, and walks out. In e-commerce, you’d retarget them. In the physical world, they’re gone forever.
+
+**The Strategy:** Put a QR code on the physical price tag. Link it to a page that offers a "Save for Later" coupon via email or SMS. When they scan the tag at home, they have the link, the product photo, and a discount to pull them back in.
+
+<img src="../assets/images/lifestyle_retail_qr.png" alt="Apparel Store QR Tag Interaction" width="500" style="display: block; margin: 20px auto;">
+
+
+## 2. Real-Time Attribution for Local Partners
+
+You have your flyers in the local coffee shop. The owner is your friend, but is it actually working? 
+
+**The Strategy:** Use a dynamic QR code with a unique UTM parameter for *every single location*. Instead of wondering if the coffee shop flyers are better than the gym posters, you can check your analytics dashboard and know exactly which partner is driving the highest-quality leads. This level of precision is why **PM Group** found that including QR codes in direct mail campaigns can boost overall **subscriber and response rates by up to 35%**.
+
+## 3. The Interactive Service Sticker
+
+If you run a service business (HVAC, cleaning, landscaping), the most valuable real estate you own is the side of your customer’s furnace or the back of their cleaning cupboard.
+
+**The Strategy:** A weatherproof sticker with a QR code that links directly to a "Book Service" or "Request Refill" page. It turns a one-off job into a permanent interface.
+
+## 4. Turning TV/Video into a Checkout Counter
+
+We’ve seen the Coinbase Superbowl ad. You don't need a million-dollar budget to do this.
+
+**The Strategy:** If you’re running a YouTube ad or a local TV spot, keep the QR code on screen for at least 15 seconds. Make sure it isn't just a link to the homepage, but a direct link to the *exact promotional offer* shown in the video.
+
+## 5. Event Networking that Actually Works
+
+Paper business cards get lost. Typing a name into LinkedIn while standing in a noisy trade show aisle is annoying.
+
+**The Strategy:** A QR code on the back of your phone or your badge that links to a "Digital Contact Card" (vCard). Most people do this once, but the pro move is using a *dynamic* code. If you change your job title or portfolio link next month, the code on that expensive trade show banner still works.
+
+
+---
+
+
+## The Technical Detail: Why Dynamic Codes Matter
+
+The biggest mistake is using static QR codes for temporary campaigns. A static code is permanent. If your URL changes, the code is broken.
+
+**Dynamic QR codes** allow you to change the destination URL *after* the code is printed. This is the difference between a static billboard and a digital interface.
+
+You can test this setup using lightweight tools like [QR Master](https://qrmaster.net). It lets you create dynamic codes and track basic scan data without a subscription or an account—useful for seeing if the strategy works for you before scaling up.
+
+Don't let your physical marketing be a black hole for data. Start tracking the bridge between your real world and your digital one.
+
+
+---
+
+
+**Author Bio:** Timo is a founder and developer focused on closing the gap between offline and online marketing. He supports small business marketing through tools like [QR Master](https://qrmaster.net), focusing on making dynamic tracking accessible and simple.
--- a/articles/seosandwitch-qr-codes-offline-attribution.md
+++ b/articles/seosandwitch-qr-codes-offline-attribution.md
@@ -0,0 +1,186 @@
+# QR Codes as an Offline-to-Online Signal: How Marketers Can Measure Physical Campaigns More Reliably
+
+<img src="../assets/images/attribution_light.png" alt="Dynamic QR Code Attribution Flow" width="500" style="display: block; margin: 20px auto;">
+
+
+
+---
+
+
+## Introduction
+ 
+Marketers can usually tell you which ad got the click, which search term triggered the lead, or which email link generated the sale. But ask the same team which flyer at a trade show drove the most traffic, or which product insert is actually being read, and the answer often gets vague very quickly.
+
+This attribution gap isn't just a reporting annoyance; it's a budgeting problem. Without data on which physical touchpoints are working, marketers fly blind on where to spend their next dollar of offline budget.
+
+This article covers the mechanics of closing that gap: how QR codes function as a measurable offline-to-online signal, how to integrate scan data into a real attribution workflow, and what the indirect SEO implications are for the digital content those codes point to.
+ 
+---
+ 
+ 
+## Part 1: Understanding QR Codes as an Attribution Mechanism
+ 
+### Static vs. Dynamic: The Distinction That Actually Matters
+ 
+Not all QR codes generate useful data. A **static QR code** encodes a URL directly into the image. Scan it, go to the URL — and that's the end of the data trail. No tracking, no redirects, no analytics.
+ 
+**Dynamic QR codes** work differently. They point to a short redirect URL controlled by the QR code platform. When someone scans the code, they hit the redirect server first — which logs the event (timestamp, location, device type, scan count) — and then forwards them to the final destination.
+ 
+This redirect layer is what makes attribution possible. It functions the same way UTM-tagged short links function for social media clicks.
+ 
+### Dynamic QR Codes as UTM-Tagged Short Links for Physical Media
+ 
+A UTM parameter adds source, medium, and campaign data to a URL so your analytics platform can attribute sessions correctly. `?utm_source=google&utm_medium=cpc&utm_campaign=spring_sale` tells GA4 exactly where a visitor came from.
+ 
+The same logic applies to QR codes. A flyer at a farmers market can carry a dynamic QR code that redirects to:
+ 
+```
+https://yourdomain.com/landing-page?utm_source=flyer&utm_medium=print&utm_campaign=farmers_market_april
+```
+ 
+GA4 receives the session with full attribution. You can now measure:
+- How many sessions the flyer generated
+- Whether those sessions converted
+- How those users behaved compared to organic or paid visitors
+ 
+Applied systematically, this gives you cross-channel attribution that treats physical media as a first-class data source rather than a black box.
+ 
+ 
+### Beyond the Link: The Branding Impact
+
+Beyond the redirect mechanics, design plays a critical role in user conversion. **Wave Connect** reports that incorporating **logos or brand elements** into QR codes can increase scan rates by up to **80%**. In an offline environment, trust and visual recognition are just as important as technical functionality.
+
+---
+ 
+ 
+## Part 2: Building the Attribution Workflow
+ 
+### Step 1: Instrument Your Physical Materials
+ 
+Before printing anything, assign each physical asset a unique UTM combination. Don't collapse multiple materials into a single source — differentiation is the point.
+ 
+| Physical Material | UTM Source | UTM Medium | UTM Campaign |
+|-------------------|------------|------------|--------------|
+| Farmers market flyer | `farmers_market` | `print_flyer` | `spring_2025` |
+| Trade show banner | `conference_name` | `event_banner` | `spring_2025` |
+| Product insert | `product_box` | `insert` | `core_product` |
+| Business card | `business_card` | `networking` | `always_on` |
+ 
+Each combination gets its own dynamic QR code. Each code redirects to the destination URL with its UTM parameters appended.
+ 
+### Step 2: Track at Two Levels
+ 
+You now have two data sources:
+ 
+**QR Code Platform Analytics:** Scan count, location, device type, time of day. This is pre-click data — it tells you who engaged with the physical material.
+ 
+**Website Analytics (GA4):** Sessions, bounce rate, pages per session, goal completions. This is post-click data — it tells you what those people did once they arrived.
+ 
+The delta between scan count (pre-click) and session count (post-click) is your effective scan-to-session rate — a measure of how well the landing page matches the expectation the physical material set.
+ 
+### Step 3: Route Through One Redirect Layer
+ 
+The simplest architecture: your QR code platform generates the redirect URL (e.g., `qrm.st/abc123`), which redirects to your UTM-tagged destination URL (e.g., `yourdomain.com/page?utm_source=...`).
+ 
+Avoid using a generic URL shortener on top of a QR code platform on top of a UTM-tagged URL. Every additional redirect layer increases load time and the chance of a bounce before the session registers.
+ 
+### Step 4: Set Up a Dashboard
+ 
+Connect your QR scan data and GA4 attribution data in a single view. For most businesses, a simple Google Looker Studio dashboard pulling from GA4's campaign dimension plus a manual import of QR scan data from your platform works well.
+ 
+For higher-volume operations, look at whether your QR platform offers a GA4 or API integration. Some do. This makes automated reporting possible without manual data merging.
+ 
+ 
+---
+ 
+ 
+## Part 3: The SEO Implications
+ 
+QR codes do not directly improve rankings, but they can support better measurement, cleaner campaign attribution, and more qualified traffic to the pages they point to. In practice, QR-driven visits are often more qualified because the user has already engaged with the brand in a physical context. That makes the traffic commercially valuable even when the SEO effect remains indirect.
+ 
+### Offline Intent as a Quality Signal
+ 
+When a QR code scan sends a visitor to a targeted landing page, the resulting session behavior is often higher quality than a broad organic click. These users have high intent.
+ 
+High-quality traffic signals — low bounce rates, deeper session depth, and conversions — are indicators of a page's utility. While search engines have been cautious about confirming whether GA4 metrics are direct ranking factors, consistent engagement from high-intent audiences is a valid way to strengthen your content's overall signal profile.
+ 
+This is particularly relevant for Local SEO. A regional physical campaign driving engaged local sessions to a specific landing page provides the exact type of geographic relevance signals that matter for local results.
+ 
+### QR Codes and Content Distribution: The Link-Building Angle
+ 
+A more indirect application is using QR codes to drive high-intent eyes to link-worthy digital assets (data studies, calculators, or whitepapers).
+ 
+The workflow:
+1. You publish a high-quality resource on your site.
+2. You distribute a QR code linking to it via physical materials (conference handouts, product inserts).
+3. Professional users scan the code, discover the resource, and — because it's genuinely useful — some subset of them links to it or cites it from their own digital platforms.
+ 
+This turns physical distribution into a top-of-funnel discovery mechanism for link acquisition. It won't produce high volumes, but the links generated come from relevant, authoritative sources who discovered the content in the "real world."
+ 
+### Technical Execution and Crawling
+ 
+From a technical standpoint, the redirect of a dynamic QR code functions as a pass-through layer. For the end user, this is a 301 or 302 redirect to the target destination. This means:
+ 
+- The final destination URL retains full crawlability and indexability.
+- The redirect adds minimal latency (usually negligible), but keeping the destination page fast is critical since mobile users on cellular data have low patience.
+- Canonicalization: Ensure the destination page has a correct self-referencing canonical tag so that any traffic signals are consolidated correctly.
+ 
+ 
+---
+ 
+ 
+## Part 4: Case Study — Tracking Offline Foot Traffic Attribution
+ 
+Here is an example of the end-to-end data flow for a local business.
+ 
+**Scenario:** A local gym runs a seasonal campaign — posters in the neighborhood, flyers at a local health food store, and inserts in a physical "welcome kit."
+ 
+**Setup:**
+- Three dynamic QR codes created, one per material.
+- Each redirects to the same landing page with unique UTM parameters.
+- GA4 goal tracked: Trial Membership Booking.
+ 
+**Campaign Results (30 Days):**
+ 
+| Source | Scans | Sessions | Conversions | CVR (Scan-to-Trial) |
+|:-------|:------|:---------|:------------|:--------------------|
+| Neighborhood Poster | 94 | 61 | 4 | 4.2% |
+| Health Food Store | 212 | 164 | 19 | 8.9% |
+| Welcome Kit | 87 | 71 | 23 | 26.4% |
+ 
+**Analysis:** The health food store placement delivers the highest new-customer volume. The welcome kit has the highest conversion rate (existing relationship). The posters show lower conversion despite scans, suggesting the "buy-in" requirement for someone scanning on a sidewalk is higher than someone already inside a partner store.
+ 
+**Without tracking:** The gym would have no idea which print run was worth the money. With tracking, they know exactly where to reinvest.
+ 
+ 
+---
+ 
+ 
+## Part 5: Tooling Landscape
+ 
+Several tools handle dynamic QR code creation with analytics. They vary on analytics depth, link management features, and pricing.
+ 
+**QR Tiger** (qrtiger.com) — one of the more established platforms with bulk creation, folder organization, and basic scan analytics. Paid plans required for full analytics history.
+ 
+**QR Code Generator.com** — widely used, good brand recognition, analytics capped on free tier. Straightforward interface.
+ 
+**[QR Master](https://qrmaster.net)** — A simple, lightweight option for testing dynamic redirects. It provides scan counts and basic analytics without requiring an account or subscription, making it useful for testing the attribution workflow before committing to a complex setup.
+ 
+**Bitly** — primarily a URL shortener but includes QR code generation with click analytics. Useful if you're already using Bitly for link management.
+ 
+ 
+---
+ 
+ 
+## Conclusion
+
+QR codes are not an SEO tactic in themselves. They are a measurement layer for physical media.
+
+What makes them useful is not the square on the page, but the workflow behind it: unique routing, campaign attribution, landing-page alignment, and the ability to see which offline touchpoints actually lead to business outcomes.
+
+For marketers running print, events, packaging, or local campaigns, that closes a gap traditional analytics often leaves open. Instead of treating physical media as unmeasurable, QR codes make it possible to test, compare, and improve it with the same discipline applied to digital channels.
+
+The real opportunity is not just “using QR codes.” It is treating offline attention as something measurable, attributable, and worth optimizing. This move toward measurable print is part of a broader trend: as of late 2024, **62% of businesses** expect QR-driven initiatives to be a primary revenue driver in their 2025 strategy (**Uniqode**).
+
+
+---
--- a/articles/substack-playbook-series.md
+++ b/articles/substack-playbook-series.md
@@ -0,0 +1,63 @@
+# The QR Code Playbook: Issues 1-3
+
+
+---
+
+
+## Issue #1: The "Static is Dead" Manifesto
+*Date: Week 2*
+
+Welcome to the first issue of The QR Code Playbook. We’re starting with the most important rule of the game: **Never print a static QR code again.**
+
+A static code works fine — until something changes. Then it turns into a small but expensive operational problem. The moment your destination URL breaks, you’re stuck with permanent, dead-end assets.
+
+**The Dynamic Advantage:**
+Dynamic QR codes use a redirect layer. The printed pattern doesn't change, but you can change where it points from your computer. 
+
+**Scenario:** You print 1,000 menus for your restaurant. Your web developer changes the menu URL.
+- **Static:** You throw away 1,000 menus.
+- **Dynamic:** You spend 30 seconds changing the redirect link. 
+
+**This week's task:** Audit your current print materials. Anything with a QR code that isn't updateable is a liability. 
+
+
+---
+
+
+## Issue #2: The Event Marketer’s Secret Weapon
+*Date: Week 3*
+
+Events are chaos. Signage is expensive. ROI is hard to prove.
+
+This week, we’re looking at how to use "Contextual QR Codes" to track your booth’s performance. 
+
+**The Attribution Stack:**
+1. Create a unique code for your **Check-in Banner**.
+2. Create a unique code for your **Product Demo Flyer**.
+3. Create a unique code for your **Follow-up Postcard**.
+
+By tracking the scan rates of these three different codes, you can see where people dropped off. Did they check in but never look at the demo? Did they take the flyer but never scan the follow-up?
+
+Networking is where this shines: **82% of professionals** now prefer receiving a digital card over paper (**Forbes**), and data shows that users are **5x more likely to save a contact** when it's presented via QR (**HiHello**). 
+
+Now you aren't just "doing events"—you're measuring them.
+
+
+---
+
+
+## Issue #3: Closing the eCommerce "Blind Spot"
+*Date: Week 4*
+
+The moment your product box leaves the warehouse, you lose the data trail. You know it was delivered, but you don't know if the customer opened it, read the manual, or is actually using it. Customer sentiment is high here: **94% of consumers** who scan QR codes on product packaging find the information helpful for product usage or support (**Packaging Strategies**).
+
+**The Solution: Post-Purchase Redirection.**
+Include a QR code on the inside of the box lid.
+
+- **First 7 Days:** Link it to a "Getting Started" video.
+- **After 30 Days:** Change the redirect to a "Leave a Review" page.
+- **After 6 months:** Change the redirect to a "Reorder/Subscription" discount.
+
+One printed code. Three different stages of the customer lifecycle.
+
+*These workflows can be implemented with most dynamic QR platforms like [QR Master](https://qrmaster.net). The important part is choosing a tool that makes link updates and scan tracking easy to manage without unnecessary overhead.*
--- a/articles/techdee-5-qr-code-strategies.md
+++ b/articles/techdee-5-qr-code-strategies.md
@@ -0,0 +1,92 @@
+# 5 QR Code Strategies That Can Supercharge Small Business Marketing
+
+
+---
+
+
+Most small business owners use QR codes once, print them, and never think about them again. That works — but it usually means the QR code stays static, untracked, and much less useful than it could be.
+
+Used more deliberately, QR codes can help connect printed materials with measurable digital actions — without expensive software or technical overhead. Here are five practical strategies worth implementing this week.
+
+---
+
+
+## 1. Turn Business Cards Into a Living Portfolio
+
+Paper business cards have a lifespan problem. You print 500, use them over 18 months, and your website URL, phone number, or LinkedIn handle changes at least once in that time. The cards you already handed out become outdated the moment they leave your desk. This small addition to your physical networking can have a measurable impact on your digital footprint: adding QR codes to professional interactions (like business cards or email signatures) has been shown to increase **LinkedIn engagement by up to 15%** (**MySignature**).
+
+**The fix:** Add a dynamic QR code to your business card that links to a centrally managed contact page — your own "link-in-bio" page, a Google Site, or a simple landing page.
+
+Update the page whenever something changes. Every card you've already handed out automatically points to the current version. No reprints needed.
+
+Freelancers, consultants, and real estate agents with frequently updated portfolios get the most mileage out of this approach.
+
+
+---
+
+
+## 2. Track Which Offline Materials Actually Drive Traffic
+
+One of the biggest blind spots in small business marketing is not knowing which physical materials drive results. A flyer you handed out at a farmers market, a mailer you sent to the neighborhood, an insert in a product package — which one actually brought people to your site?
+
+**The fix:** Use a different dynamic QR code for each material and campaign. Track scan rates per code to see which placement and which audience responds.
+
+<img src="../assets/images/analytics_light.png" alt="Advanced QR Scan Analytics Dashboard" width="500" style="display: block; margin: 20px auto;">
+
+
+This isn't just a "big business" insight. Even basic scan analytics — how many scans, from which city, on which day — can tell a small business owner which trade show placement is worth paying for next year and which one isn't.
+
+You can test this attribution setup using lightweight tools like [QR Master](https://qrmaster.net). It lets you create dynamic codes and track basic scan data without a subscription—useful for seeing if the overhead of tracking is worth it for your business.
+
+
+---
+
+
+## 3. Make Product Packaging Evergreen
+
+If your business sells physical products, your packaging is one of the most expensive things to change. A new product page, an updated how-to guide, a warranty registration change — any of these would normally require a new print run.
+
+**The fix:** Put a dynamic QR code on the packaging and link it to a product resource page you control. When the page changes, the packaging doesn't have to.
+
+This is also useful for localization: if you start selling in a new market, redirect the code to a translated version of the page — without touching the packaging itself.
+
+
+---
+
+
+## 4. Run Contactless Event Check-Ins and Feedback Flows
+
+Events — whether a pop-up shop, a community workshop, or a trade show booth — generate a lot of friction around check-in, sign-ups, and post-event surveys. Paper forms take time to process. Verbal prompts are easy to forget.
+
+**The fix:** Post a QR code at check-in that links directly to a Google Form, Tally form, or Typeform. Do the same at the end of the event to collect feedback while the experience is still fresh.
+
+The code itself doesn't change between events — just swap the destination to a new form each time. Print one set of signage and reuse it.
+
+
+---
+
+
+## 5. A/B Test Landing Pages Without Reprinting
+
+Running a print campaign and not sure which landing page angle converts better? Normally, you'd have to commit to one before printing — and live with the results.
+
+**The fix:** Generate a single dynamic QR code, start with Landing Page A, then switch to Landing Page B halfway through the campaign. Compare scan-to-conversion rates across the two periods.
+
+This isn't a perfect controlled experiment, but it gives you directional data you wouldn't otherwise have from a print campaign — and it costs nothing extra to run.
+
+
+---
+
+
+## Getting Started
+
+The common thread across all five strategies is using dynamic QR codes rather than static ones. Dynamic codes let you update the destination after printing — which means your physical materials stay flexible. This move towards digital-first interaction isn't just a trend: according to **Salesforce**, **80% of marketers** now believe that a 'digital-first' approach is essential for staying competitive.
+
+For most small businesses, a free tool with basic analytics is enough to get started. The goal is data you can act on, not perfection.
+
+
+---
+
+
+
+**Format:** List-based, one-action-per-section, Techdee style
--- a/assets/brand-reference/qrmaster-packaging-reference.jpg
+++ b/assets/brand-reference/qrmaster-packaging-reference.jpg
--- a/assets/images/analytics_dashboard_mockup.png
+++ b/assets/images/analytics_dashboard_mockup.png
--- a/assets/images/analytics_light.png
+++ b/assets/images/analytics_light.png
--- a/assets/images/attribution_flow.png
+++ b/assets/images/attribution_flow.png
--- a/assets/images/attribution_light.png
+++ b/assets/images/attribution_light.png
--- a/assets/images/business_card_scan.png
+++ b/assets/images/business_card_scan.png
--- a/assets/images/ecommerce_lifecycle.png
+++ b/assets/images/ecommerce_lifecycle.png
--- a/assets/images/lifecycle_light.png
+++ b/assets/images/lifecycle_light.png
--- a/assets/images/lifestyle_retail_qr.png
+++ b/assets/images/lifestyle_retail_qr.png
--- a/assets/images/static_vs_dynamic_comp.png
+++ b/assets/images/static_vs_dynamic_comp.png
--- a/assets/images/static_vs_dynamic_light.png
+++ b/assets/images/static_vs_dynamic_light.png
--- a/atom-eve.json
+++ b/atom-eve.json
@@ -0,0 +1,7 @@
+{
+  "$schema": "https://atomeve.dev/schema/atom-eve.json",
+  "target": "eve",
+  "runtime": "vercel",
+  "sourceRoot": "src",
+  "registry": "elie222/atom-eve"
+}
--- a/backlinks.md
+++ b/backlinks.md
--- a/blog-posts-improved/bulk-qr-excel-IMPROVED.md
+++ b/blog-posts-improved/bulk-qr-excel-IMPROVED.md
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`{"pid":23720,"port":8400,"token":"99ca8ad6-3aa6-44f6-9b64-25921f55724b"}`