Privacy Policy

1. Who We Are

Barcode.codes is a website with free barcode tools, operated by Barcode.codes ("we", "us"). We are the controller of the personal data described in this policy. You can reach us at support@barcode.codes about anything in it.

This policy applies to the website at https://barcode.codes/ (also reachable at www.barcode.codes). It does not apply to other websites we link to; they have their own policies.

2. Summary

• The barcode tools run on your device. The data you encode and the files you download are not sent to us.
• The barcode lookup page, and the barcode scanner and reader when you ask for a product's name, search an open product registry only when you click. The number then goes from your browser straight to the registry, not to us.
• The scanner pages can keep your scans in your browser's local storage so they survive a reload. They stay on your device, and you can turn this off.
• We use Google Analytics 4 to see how the site is used. Visitors in the EEA, the UK and Switzerland are asked first, and no analytics cookies are set unless they accept. Visitors elsewhere are measured by default.
• Our hosting provider, Cloudflare, processes technical request data (such as your IP address) to deliver the site and protect it from abuse.
• If you contact us, we use your name, email address and message only to answer you.
• We do not sell or share your personal data, and we do not use it for advertising.

3. Data We Never Collect

Barcodes, QR codes and their settings are created by code that runs in your browser. The content you type, the images the tools produce and the files you download stay on your device. We do not receive, log or store them, and we cannot see them.

The scanner and reader pages keep the codes you scan, the session list, its history and your scanner settings in your browser's local storage (under keys containing "scanner-session", "scanner-history" and "scanner-settings"), so they are still there after a reload. They are never sent to us. New session, Clear and Delete remove scans; turning off "Save the session and history in this browser" under Settings deletes all saved scans and keeps only the settings.

If you switch between the light and dark theme with the button in the header, your choice is saved in your browser's local storage (key "site-theme") so the next page opens in the same theme. It is never sent to us.

The barcode lookup page lists your last eight lookups under "Recent lookups", saved in your browser's local storage (key ending in "lookup-recent"). They stay on your device; the Clear link deletes them.

The barcode generators keep the presets you save (key ending in "generator-presets": a name and the settings, without your data or logo) and your last ten downloads (key ending in "generator-history": the type, the data, the format and the settings) in your browser's local storage. They stay on your device; Delete removes a preset and Clear history removes the list.

The bulk barcode generator keeps the presets you save (key ending in "bulk-presets": a name and the settings, without your values, column choices or logo) and your last ten batches (key ending in "bulk-history": the file name, the number of barcodes and the settings, not the values or the files) in your browser's local storage. They stay on your device; Delete removes a preset and Clear history removes the list.

The barcode scanner to Excel page keeps your count sessions (the codes, their types, quantities, notes, sources and scan times) in your browser's IndexedDB storage (a database ending in "-inventory"), so a count survives a reload and works offline. They stay on your device and are never sent to us; Delete all data removes them, and clearing this site's data in your browser does too.

To work without a connection, the site installs a service worker after a page has loaded (not when your browser asks to save data). It keeps a copy of the site's offline page, styles, fonts and icons in your browser's cache (the names start with the site's address; the copies of the shell and the tools carry a version number), and, after you open the barcode generator, a scanner or reader, the check digit calculator or the inventory counter, those tools with their scripts. If you choose "Save the whole site in this browser" on the Offline use page, it also keeps every page and its files; Remove deletes that copy. The copies hold no data of yours: the service worker only downloads the site's own files, and never keeps the analytics script, the barcode API, registry searches or form submissions. Clearing this site's data in your browser deletes the copies.

4. Open Registry Searches on the Lookup, Scanner and Reader Pages

The barcode lookup page analyzes the number you type or photograph in your browser. It can also search three open registries, but only when you click the button for one of them: Open Food Facts (world.openfoodfacts.org), Open Beauty Facts (world.openbeautyfacts.org) and Open Library (openlibrary.org, for books).

The barcode scanner and barcode reader pages offer the same search through a "Find product name" button on the result of a product number. It tries the registries that fit the number one after the other and stops at the first one that knows it. The QR code scanner and reader never search a registry.

When you click, your browser sends the barcode number directly to that registry, with the technical data every web request carries, such as your IP address and browser. The request does not pass through our servers, and we do not log it or see the answer. Each registry is an independent service and handles the request under its own privacy policy.

Nothing is sent to a registry before you click. A photo, PDF or camera frame you use to read a number is decoded on your device and is not uploaded.

5. Website Delivery and Security

When you open a page, your browser sends a request to the servers of Cloudflare, Inc., which hosts and delivers Barcode.codes. Like any web server, Cloudflare receives technical data with each request: your IP address, the date and time, the page requested, your browser and operating system (user agent), the referring page and the approximate location derived from the IP address.

This data is processed to deliver pages, keep the site available and protect it against attacks and abuse, for example by limiting how often one address can send the contact form. The legal basis is our legitimate interest in running a secure website (Article 6(1)(f) GDPR). We do not use this data to identify you or to build a profile of you.

The barcode API (addresses starting with /render/) draws the image from the data in the request address and returns it. Barcode.codes does not store the request or its data; Cloudflare keeps the image in its cache under that address, so the same request is answered from the cache, and counts recent requests per IP address to apply the API's rate limit. Do not put personal data in an API address.

6. The Contact Form and Email

When you send the contact form or write to support@barcode.codes, we receive:

• your name and email address;
• the topic you chose and your message;
• the time it was sent and the country it was sent from (provided by Cloudflare; we do not receive your full IP address through the form).

We use this information only to read and answer your message and to follow up on it, for example to fix a problem you reported. The legal basis is our legitimate interest in answering the people who write to us, and, where your message concerns a request about our service, taking steps at your request (Article 6(1)(b) and (f) GDPR).

To filter automated spam, the form contains a hidden field and checks how quickly it was filled in. Your IP address is used for a short time to limit the number of messages one address can send per minute; it is not stored with your message.

Messages from the form are delivered to our support mailbox through Cloudflare Email Routing. Please do not send passwords, payment details or other sensitive information.

7. Cookies and Analytics

We use Google Analytics 4 to understand how Barcode.codes is used: which pages and tools are visited, from which countries and types of device, and how visitors find the site. This helps us decide what to improve and which tools to build next.

When a page loads, our own script asks our server whether your country requires consent (the server reads only the country Cloudflare derives from your connection and answers yes or no; nothing is stored). It then loads Google Analytics with Google Consent Mode:

• In the European Economic Area, the United Kingdom and Switzerland, you are asked first. Until you accept, analytics storage is off: no analytics cookies are set and no visitor identifier is stored, and Google may receive only basic page-view signals without cookies, which it uses in aggregate. If we cannot tell where you are, we treat you the same way. The legal basis for analytics cookies is your consent (Article 6(1)(a) GDPR).
• Everywhere else, including the United States, you are measured by default and analytics cookies are used without a banner. The legal basis, where one is needed, is our legitimate interest in understanding how the site is used.

When analytics storage is on, Google Analytics sets these first-party cookies:

• _ga: distinguishes visitors; expires after 2 years.
• _ga_ followed by our measurement ID: keeps the state of your session; expires after 2 years.

Google Analytics 4 does not log or store full IP addresses. We have not enabled advertising features, Google signals or user-ID tracking, and Consent Mode's advertising signals (ad storage, ad user data and ad personalization) are denied for every visitor, wherever you are. We show no ads, and we do not combine analytics data with anything you send through the contact form.

If you are asked for consent, your choice is saved in your browser's local storage (key "site-analytics-consent"). "Cookie settings" at the bottom of every page then lets you change it at any time; withdrawing consent also removes the Google Analytics cookies. Wherever you are, you can block or delete cookies in your browser settings or install Google's opt-out add-on.

Google Analytics opt-out browser add-on

The barcode data you type into the tools is never uploaded, to us or to Google: barcodes are drawn in your browser. Apart from Google Analytics, Barcode.codes sets no cookies. Cloudflare may set strictly necessary security cookies in rare cases, for example when it shows a check to block automated traffic.

How Google uses data from sites that use its services

8. Who Processes Data for Us

• Cloudflare, Inc. (hosting, content delivery, security, rate limiting and email routing).
• Google Ireland Limited and Google LLC (Google Analytics 4).
• The email provider that hosts our support mailbox, which stores the messages you send us.

These providers process data on our behalf and under their own security and privacy commitments. We do not sell personal data and do not give it to anyone for their own marketing.

Cloudflare privacy policy

9. International Transfers

Cloudflare and Google run global networks, so data may be processed in countries other than yours, including the United States. Both describe the legal safeguards they use for such transfers in their privacy policies and data processing terms.

10. How Long We Keep Data

• Barcode tool data: never received, so never stored.
• Scans saved by the scanner pages: in your browser only, until you clear them or turn saving off; we never receive them.
• Contact messages: as long as needed to answer you and handle any follow-up, and no longer than 24 months after our last exchange, unless the law requires us to keep them longer.
• Analytics data: kept in Google Analytics for the retention period set in our account, at most 14 months, then deleted automatically.
• Technical request data: kept by Cloudflare for the periods set out in its own policies; we do not keep separate copies.

11. Your Rights

If you are in the European Economic Area, the United Kingdom or Switzerland, data protection law gives you the right to:

• ask for a copy of the personal data we hold about you (access);
• have inaccurate data corrected (rectification);
• have your data deleted (erasure);
• ask us to limit how we use your data (restriction);
• object to processing based on our legitimate interests;
• receive your data in a portable format, where applicable;
• complain to the data protection authority in the country where you live or work.

To use any of these rights, write to support@barcode.codes or choose "Privacy or data request" in the contact form. We may ask you to confirm that the request comes from you, and we answer within one month.

12. United States Privacy Rights

We do not sell personal information and do not share it for cross-context behavioural advertising: Google Analytics is used only to measure the site, with advertising features off and no ads. Residents of California and other US states with privacy laws can opt out of analytics with their browser settings or Google's opt-out add-on, and can ask what personal information we hold about them and ask us to delete or correct it by writing to support@barcode.codes. We will not treat you differently for using these rights.

13. Children

Barcode.codes is a general-audience tool site and is not directed at children under 13 (under 16 in the European Economic Area). We do not knowingly collect personal data from children. If you believe a child has sent us personal data, write to us and we will delete it.

14. Security

The site is served only over HTTPS with HSTS and uses a strict content security policy that allows no third-party scripts except Google Analytics, which our own script loads. Contact messages are handled through Cloudflare's network and our mailbox provider; access to the mailbox is limited to the people who answer support requests.

15. Changes to This Policy

We update this policy when the way we handle data changes, for example before adding advertising. The date at the top shows the current version.

16. Contact

Questions or requests about your data: support@barcode.codes, or the contact form with the topic "Privacy or data request".

Open the contact form