Privacy Policy
Last updated: 11 October 2026
- We keep the minimum needed to make barcodes, run accounts and stop abuse.
- We never store your barcode PDFs. For accounts we keep the inputs (the "recipe") so you can download a barcode again.
- No advertising, no tracking cookies, no third-party analytics. We do not sell or rent your data.
- Ask us to delete your account at any time: [email protected].
1. Who is responsible
barcoderocket.com is operated by Marko Marković PR 5mediadesign, Vitezova Karađorđeve zvezde 50, Belgrade, Serbia. The operator is the controller of the personal data described here.
Contact for anything about your data: [email protected], or the privacy request form.
2. What we collect and why
| Data | Why | How long |
|---|---|---|
| Account: email address and a salted hash of your password (PBKDF2). We never store the password itself. | To run your account and let you sign in. | Until your account is deleted. |
| Barcode recipes (signed in): barcode type, the number you entered, price and similar options, time, and the IP address of the request. | Your history and free re-downloads; counting the daily and weekly limits, also across accounts on one network. | Until your account is deleted. |
| Downloads without an account: IP address, barcode type and time. The barcode number is not recorded. | Counting the free daily allowance. | 40 days. |
| Usage counters and waiting room: IP address in short-lived counters, and a hashed ticket while you wait in the download queue. | Limits on previews, new accounts and reset emails; the queue at times of high demand. | Counters 2 days, queue tickets up to 1 hour. |
| Sign-in attempts: email address, IP address, success or failure, time. | Protecting accounts against password guessing. | 2 days. |
| Password reset: a hash of the one-time link, your email address, IP address. | Sending the link and limiting how often it can be requested. | The link works for 15 minutes; records are deleted after 2 days. |
| Emails we send: the address, the kind of email (for example "confirm your email"), the IP address that caused it, the time. Emails that wait to be sent (when our daily email limit is reached, or when an email needs a check by us first): the address, the kind of email and the IP address. Addresses that used "Not you? Stop these emails" are kept on a do-not-email list. | Limiting how many emails one address and one network can receive, so nobody can flood an inbox through this site, sending waiting emails later, and never emailing an address that asked us to stop. | Email records 8 days. Waiting emails up to 7 days. The do-not-email list until you ask us to email you again. |
Security signals: the IP address when an account is created, the IP address of the latest sign in, and a random device identifier (the br_dev cookie). | Spotting duplicate accounts made to get around limits, and checking Rocket Pass rewards. A person reviews these; nothing is blocked automatically on this basis. | Until the account is deleted; the cookie expires after 1 year. |
| Messages and feedback: name, email address, topic, message and the IP address of the sender. | Answering you and keeping the forms free of spam. | As long as needed to handle your request; delete on request. |
| Rocket Pass (invitations): who invited whom, the invited email address, the status, the IP address used to sign up, and every reward granted or withdrawn. | Running the invitation and its reward, and checking it is not abused. | Until the account is deleted (see section 6). |
| Rocket Pass invitations by email: the address a user asked us to send an invitation to, and the time. | Sending the invitation once and limiting how many invitations one account can send. | 14 days, whether or not the invitation is accepted. |
| Connected AI assistants (when you connect an app such as Claude to your account): which app, when you connected it and when it was last used, and hashes of its access tokens (never the tokens themselves). Barcodes made through it are kept like your other downloads, and each PDF gets a private download link (a hash of the link and the barcode recipe) that works for 24 hours; when the request comes through Claude's servers, the IP address is recorded as "claude" instead of an address. | Letting the app make barcodes on your account within your limits, and letting you see and disconnect it on your account page. | Until you disconnect it, or after 60 days without use; download links 24 hours; deleted with your account. |
| API for publishers (companies with an API key): the company name, contact email and label of the key, a hash of the key (never the key itself), and for every call the barcode type, the number and its options, the time and the IP address. | Making the barcodes, counting the limits agreed for the key, the monthly invoice, and spotting misuse of a key. | IP addresses on calls: 90 days. Call records: 13 months, for the invoice. Key details: as long as we work together. |
| Visit statistics: page, event (for example preview or download), referring website (domain only), campaign tags in the link (utm) and the country reported by our host. | Knowing which pages and sources work. | Kept as statistics. No IP address, cookie, device identifier or browser fingerprint is stored with them, so they do not identify you. |
When you choose a password, we check that it has not appeared in a known data breach, using the Have I Been Pwned service. Only the first 5 characters of a hash of the password leave our server, never the password, the full hash or your email address.
IP addresses are stored as they arrive for IPv4. For IPv6 we keep only the network part (the first 64 bits, a /64), because one home or server usually owns a whole /64.
Legal bases (GDPR Article 6): performing the service you asked for (account, barcodes, history, reset emails, invitations), and our legitimate interest in keeping a free service available and safe (limits, abuse checks, statistics without identifiers).
3. Barcode files
Barcode PDFs and ZIP files are generated when you ask for them and sent straight to your browser. We do not store them. The preview picture is cached by our host for a short time under the number you typed, so the same preview loads faster; it is not linked to you.
4. Cookies and browser storage
__Host-br_session(before October 2026 namedbr_session): keeps you signed in. It ends after 14 days without use, when you sign out, or when you use Sign out of all devices. httpOnly, only set when you sign in.br_dev: a random identifier, set only on the sign-in, sign-up and invitation pages, used only as the security signal above. 1 year, httpOnly. It contains no personal information.- Cloudflare Turnstile: the bot check on the sign-up and password reset pages may set a short-lived Cloudflare cookie. It is not used for analytics or advertising.
- Where you came from: the tab you visit in may keep the referring site or campaign tag in sessionStorage (deleted when you close the tab). It is sent only with a sign-up, so the sign-up can be credited to its source.
There are no advertising or analytics cookies and no third-party trackers.
5. Who processes the data for us
- Cloudflare, Inc.: hosting (Pages and Workers), the database (D1), file storage (R2, used for fonts only, no personal data), the Turnstile bot check, and sending our emails (email confirmation, password reset and change notices, Rocket Pass invitations) through Cloudflare Email. Processing follows Cloudflare's data processing terms. Cloudflare operates worldwide, including in the United States; transfers are covered by the EU Standard Contractual Clauses and Cloudflare's certifications.
We use no other processors. We do not sell, rent or share your data for advertising. We disclose data to authorities only when the law requires it.
If you use Barcode Rocket through an AI assistant, the assistant's provider (for example Anthropic for Claude) sees what you ask it and what our tools return, under that provider's own privacy policy. That provider is not our processor; you choose to use it.
6. Deleting your account
Write to [email protected] from the address on the account, or use the privacy request form, and we delete the account and everything tied to it: recipes, sessions, messages, feedback and sign-in records. Invitations you sent or accepted are deleted too; a reward record that must stay for auditing is kept without anything that points back to you. An invitation that is not accepted expires after 14 days.
Accounts that never made a single barcode are deleted automatically 90 days after sign-up. Accounts whose email address was never confirmed are deleted automatically 7 days after sign-up.
7. Your rights
You can ask to access, correct, delete or receive a copy of your data, and object to or restrict its processing. We answer within 30 days. You can also complain to a data protection authority: in Serbia the Commissioner for Information of Public Importance and Personal Data Protection, or the authority in the EU country where you live.
8. Children
Barcode Rocket is a professional tool and is not meant for children. Do not create an account if you are under 16. If we learn that a child has created one, we delete it.
9. Security
Traffic is encrypted (HTTPS). Passwords, session tokens and reset links are stored only as hashes. Access to the database is limited to the operator.
10. Changes
When this policy changes we update the date at the top. If a change matters for how we use your data, we say so on the site or by email before it takes effect.