A SAVITAS QR Code represents a very large random number and looks like this image.
It translates to a URL like this:
There are three components that make up that complete URL:
Upon scanning, the single web application is loaded from savitas.io (part 1 of the URL). Parts 2 and 3 remain on the phone. The web application on the phone determines that indeed the number (part 2) is a unique SAVITAS number, digitally signed (part 3). It then hashes the number (part 2) with a timeslot, and stores it on the phone as a hashed Space-Time-Slot (STS). The server receives no data whatsoever.
This STS is actually the functional combination of space and time: it states that the scanning device was in the neighbourhood of the QR code within a specific timeframe.