RestroQR – Free Digital QR Menu & Table Ordering System

Full-stack restaurant management platform. Owners manage menus, tables & orders via a Flutter Android app. Customers scan a table QR code and place orders directly from their browser — no app download needed. Features multi-table encrypted QR ordering, real-time push notifications, earnings dashboard, and item analytics.

RoleFull Stack Lead Engineer

TimelineJun 2026 - Jul 2026

TeamPersonal Product

Tech Stack11 Technologies

Mission Brief

RestroQR is a comprehensive digital dining and restaurant operations platform. Restaurant owners manage their operations via a Flutter Android application, while dine-in customers scan AES-256-GCM encrypted QR codes on their tables to browse menus, customize dishes, and place orders directly in their phone browser without installing any app. Backed by Node.js, Express, Neon PostgreSQL (12 relational tables), Next.js 14, and Firebase Cloud Messaging, it streamlines the entire order lifecycle.

Key Features

Restaurant Owner Mobile App (Flutter)

Digital Menu Builder: Category management, photo uploads via Cloudinary, veg/non-veg tags, and pricing
Multi-Table QR Generator: Generate and export encrypted QR codes per table or single restaurant QR
Live Order Dispatch: Instant audio & push notifications on new orders with state lifecycle (Accept → Complete → Paid)
Revenue & Dish Analytics: Daily/monthly sales breakdowns and best-seller performance metrics

Customer Web Ordering (Next.js 14)

Zero-Install Dining: Instant menu loading in mobile browser upon scanning table QR code
Live Cart & Checkout: Real-time dish customization, special instructions, and order placement
Unique Reference IDs: Structured order tracking codes (e.g., ORD-ABC123) with live preparation status

Security & Backend Architecture

AES-256-GCM QR Encryption: Cryptographically secured table tokens preventing URL tampering or table enumeration
Robust Testing Suite: 17 property-based invariant tests with fast-check and supertest guaranteeing order integrity
Tenant Isolation: Strict database isolation ensuring owners access only their proprietary business telemetry

Engineering Chronicles

Malicious users could alter table numbers in the URL to submit fake food orders to other dining tables.

SolutionImplemented AES-256-GCM cryptographic encryption with initialization vectors and auth tags for all table QR URLs, causing invalid tokens to safely fail with generic 404s.

Deleting or editing menu items could corrupt past financial and order history reports.

SolutionImplemented immutable order item snapshots that preserve historical dish titles and prices at time-of-order even if the menu item is later modified or deleted.