Comment by tecleandor

But the QR code in the card doesn't contain the Spotify link. The mapping between the QR code and the Spotify link is done by the companion app, pulling a database from another URL that was found by the poster on the RE process.