Privacy Policy

Version: 1.1 | Effective Date: April 20, 2026

Data Controller: Adorján Williger (yokicode.com)

1. Executive Summary

The "Barcode" application is designed with Privacy-by-Design principles. It operates primarily as an offline-first tool, minimizing data collection and maximizing user agency over their information.

2. Data Inventory & Flow (GDPR Art. 30)

Data Category	Data Type	Storage Location	Processing Type	Retention
Scanned Content	Text, URLs, WiFi SSIDs/Pass, VCards	Local Room DB (Encrypted at rest by OS)	On-device (ML Kit)	Until user deletes
Biometric Metadata	Fingerprint/Face ID result	Android Keystore / TEE	OS-Level (App never sees raw data)	Not stored by app
Network Data	IP Address (transient)	Volatile Memory	URL Title Fetching	Not persisted
Exported Data	CSV files	User-defined storage	User-initiated export	User-managed

3. Key Privacy Features

3.1. Local-Only Processing

The application utilizes Google ML Kit for barcode recognition. Processing occurs entirely on-device. No image data is transmitted to remote servers for scanning purposes.

3.2. Privacy Mode (Incognito Scanning)

The "Privacy Mode" allows users to scan and generate barcodes without persisting data to the database, fulfilling the "Data Minimization" principle (GDPR Art. 5).

3.3. Biometric Vault

Sensitive history is gated behind the BiometricPrompt API. The app leverages the Android Trusted Execution Environment (TEE) and never accesses raw biometric templates.

3.4. URL Title Scraping

When scanning a URL, the app fetches the <title> tag. This involves a standard HTTP GET request to the target domain with a generic User-Agent.

4. User Rights (GDPR / CCPA)

Right to Access: Users can view all stored data in the History tab.
Right to Portability: Supported via CSV Export functionality.
Right to Erasure: Users can delete individual entries or clear the entire database within settings.
Right to Object: Users can opt-out of data persistence by enabling "Privacy Mode."

5. Third-Party Disclosures & Sub-processors

Google ML Kit: Used for barcode detection. Governed by Google's Privacy Policy. No PII from the scan is shared with Google by this application.
ZXing: Open-source library used for barcode generation. Operates entirely offline.

6. Regulatory Compliance

We confirm compliance with GDPR (no non-consensual tracking), CCPA/CPRA (no sale or sharing of personal information), and COPPA (no data collection from children under 13).