That is correct, we are not using GPS data. But to avoid abuse of the system, we are only verifying that the QR code sticker is indeed being scanned at the place where it was first installed. When that happened, an abstract digital fingerprint of its geo-location was sent to the server, to be checked at every scan. To be able to get the location and re-compute that digital fingerprint for verification, your phone needs access to your location. That’s it: outside of this verification, we are not using any GPS data.