That would help make it more private but also less accessible

I like having a qr code that an ordinary mobile device can scan with their regular camera, and boom, there's instantly money inside

It means there is less need for instructions like "Make sure you download the Tor browser first and then open the link in there"

I think a possibly-better solution is to wrap all queries to the api endpoints via a proxy such as corsproxy.io -- that would hide each user's ip address from the endpoint, but (1) it would put further strain on the infrastructure of that public service, which will surely stop working at some point (2) you've really just shifted the privacy problem to corsproxy.io -- now *the proxy* knows all the data I'm trying to conceal from the endpoint