A scanned place can be handed to somebody in more than one way. It exports to a single file — the world map, the simplified mesh, a thumbnail, and a manifest carrying the place's name, its floor area and its waypoints — and that file can be sent directly, opened on the other iPhone, and walked. That works when the two people know each other.
The other route is a code on a wall. A place can be published as a QR code and a printable A4 sheet, carrying the place's name and a link that can also be typed in. Somebody standing in the corridor scans it and gets the map.
The difference between the two is not the file. It is that a sheet glued to a wall is a physical object with its own lifetime, and once it is up there, it is nobody's job to maintain it. That single fact sets most of the design.
The address has to outlive the map
Publishing a place returns a 32-byte token, and that token never changes.
This matters because a map is not finished the first time it is saved. Update Map re-enters the same scanning view as a first scan, seeded with the place's existing map: densely re-scanned areas replace the old data, walk-through glances and unvisited areas are kept, and the place keeps its name and its waypoints. A place that is actually used gets re-walked.
If the published address were derived from the contents of the map, every one of those updates would break the sheets already on the wall. So the token is fixed when the place is first published and left alone afterwards. A code glued to a corridor wall is not reprinted when the map behind it is re-walked.
Unpublishing is the deliberate exception. It returns 404 to every printed code at once, and the app says so before doing it. The sheets already printed stop working the moment it happens, and that is stated rather than discovered.
The download happens in the worst place for one
The person scanning the code is, by definition, standing in a building they do not know, on that building's wifi. That is the reason the map download is resumable rather than all-or-nothing: the connection it runs over is the one least likely to hold.
Size is the other half of that. The current mesh format stores positions, indices and per-face classification as separately compressed blocks and derives vertex normals on load instead of storing them. On a 5.3-million-triangle building that is 43.8 MB where the original layout was 132.8 MB. That number is the one the download in the corridor has to carry.
Nothing is asked of the person who scans it
Whoever scans the code gets the map and can be guided around it, needing no account.
That is not a courtesy. Scanning a place, finding yourself in one, tagging spots, and opening a place someone else shared all work with no account at all, and with no signal. An ICIDO account is needed only to back up places or to publish one — that is, only on the side that is giving something away.
Backup is off until it is switched on, and switching it off deletes the copies held. Account deletion is in-app, under Settings then Account, and removes everything held for the account. Only the place itself ever travels: its shape, its layout, and the names and tags given to it. What never leaves the iPhone, backup on or off, is anything said to ICIDO, anything the camera remembered, visit history, and location. There is no setting that uploads those.
Publishing means publishing
A code printed and stuck on a wall is readable by anyone who walks past it. A published place should therefore be treated as a public map, not a shared one. A code on a corridor wall becomes a code on the open internet the moment somebody photographs it. Publishing can be undone; it cannot be un-seen.
This is worth being blunt about, because a scan of an indoor space is a floor plan of somewhere real. The choice to publish is a choice to make that floor plan available to strangers, and the app's job is to make sure nobody arrives at that outcome by accident.
The scanner is narrow on purpose
A QR code is an arbitrary string produced by an unknown printer. Anyone can print one and stick it next to a real one.
So the in-app code scanner trusts icido.org and nothing else, caps the token at 128 characters, and accepts only an ASCII base64url alphabet. A code that does not match is not a code. This is a small amount of work that exists entirely because the input arrives from a wall in a building no one controls.
The printed side gets the same treatment from the other direction: the QR is generated at error-correction level H, on the assumption that a sheet on a wall gets scuffed.
What the constraint is really doing
Every decision above follows from one property of paper: it does not update. The token is stable because the sheet cannot be reissued. The download resumes because the reader is somewhere unfamiliar. The scanner is strict because the input is physical and public. The account sits on the publishing side because the reading side is a stranger who should not have to negotiate anything to find a door.
Software that talks to the physical world inherits the physical world's timescales. A wall outlasts a build.
Scanning needs the LiDAR sensor, which means an iPhone 12 Pro or a later Pro model.