Both panels run the same ospr.js implementation as this repo.
The QR is real: it comes out of CBOR → DEFLATE → CRC-32 → base32 and
tools/ospr_ref.py decodes it without changing a byte. There is no server. None of this leaves your browser.