Barcode data stays on your device. Fields you type into the generator are used in the browser to build and draw the barcode. They are never sent to our servers, never logged, and never stored.
01What we collect
| Data | Why |
|---|---|
| Email address | Sign-in, account identification |
| Display name | Shown in the account chip and admin directory |
| Password | Stored only as a salted hash by our authentication provider; we never see it |
| Credit balance and ledger | Amount, type, description, resulting balance, timestamp for each entry |
| Account timestamps | Created, last sign-in, last update |
| Payment reference and amount | Only if you buy credits — the Paystack reference, amount, method and channel of a settled payment |
Payments are processed by Paystack, who handle your card or mobile-money details on their own checkout page and are responsible for them as a payment processor. We never see or store your card number, your M-Pesa PIN, or your bank credentials. What reaches us is Paystack's reference for the transaction, the amount, the method used (M-Pesa, Airtel Money or card) and whether it succeeded. We do not run advertising trackers and we do not build profiles. Optional analytics are off unless you turn them on: they are described in section 02 and load only after you accept.
02Cookies and local storage
barcify_sess— a session cookie holding your access token, so the server can tell you are signed in. Secured withSecureandSameSite=Lax, and it expires with the token, within an hour.barcify-auth— local storage entry holding your session so you stay signed in between visits.bc_splash_seen— session storage flag so the opening animation plays once per visit.
No advertising or cross-site tracking cookies are set, and nothing about you is sold or shared for advertising.
Optional analytics. The site can measure which pages are used, in aggregate, to decide what to build next. That measurement is disabled unless the operator switches it on, and even then it loads only after you choose “Accept analytics” in the cookie banner. If you choose “Essential only” — or dismiss the banner — no analytics script is fetched at all, and the choice is remembered in this browser only. Clearing site data resets the question. Turning it on sends the page address, the referring page and coarse device information to Google Analytics; it does not send the contents of any barcode, your email address or your payment details, because those are never in the page when it is measured.
03Third parties
- Supabase — authentication and database, hosted in the European Union (
eu-central-1). Holds the account data listed above. - Vercel — hosting and the edge network that serves these pages.
- Google Fonts — supplies the typefaces. This request reveals your IP address and browser to Google.
We do not sell or share your data with anyone else, and we disclose it only where legally required.
04Backups
A snapshot of account data (profiles, balances, ledger) is written nightly to private storage and kept for 30 days, after which it is deleted. Snapshots are used only to restore the service after a failure.
05How long we keep it
Account data is kept while your account is open. When you ask us to close the account, your profile, balance, and ledger entries are deleted; a residual copy may survive in a backup snapshot for up to 30 days.
06Your rights
You can ask us to show you the data we hold, correct it, export it, or delete it, and you can object to a particular use. Write to bacify4@gmail.com and we will respond within 30 days. We may ask you to verify control of the account first.
07Security
Traffic is encrypted in transit. Database access is governed by row-level security, so one account cannot read another’s rows even with a valid token. Administrative functions are restricted to an explicitly flagged admin account and enforced in the database rather than in the interface.
08Children
Barcify is intended for adults. Accounts are not knowingly created for anyone under 18; if we learn of one, we will delete it.
09Changes
If this policy changes materially, the version number and effective date above will change too.