Privacy

Last updated: July 2026 · Barcode Rocket is in private beta

Barcode Rocket generates print-ready barcode PDFs. We collect the minimum needed to run the service and keep it safe. We do not sell data, run ads, or share your data with third parties beyond the hosting infrastructure below.

What we store

• Account data — your email address and a salted hash of your password (we never store the password itself).
• Early-access requests and feedback — the name, email and message you submit through our forms.
• Download log — which barcode types and codes your account generated and when. This powers your usage limits and lets us support you.
• Security signals — the IP address and a random device identifier (the br_dev cookie) seen when an account is created and at login. These exist solely to protect the service against abuse, such as duplicate accounts created to bypass usage limits (legitimate interest, GDPR Recital 47). They are reviewed by a human and never used for automated blocking, profiling or anything else.
• Rocket Pass records — if you arrived through someone's invitation, or sent one: who invited whom, the invited email address, the status of the invitation, and a record of any Rocket Lane granted or withdrawn. See the section below.

Rocket Pass (invitations)

Rocket Pass lets an existing user invite a colleague. Both sides can earn Rocket Lane, a temporary boost to the monthly allowance. Here is exactly what that means for your data.

• If you accept an invitation — we store the email address you enter on the invitation page, the IP address that requested the setup link, and a permanent link between your account and the person who invited you. That link is set once, when your account is created, and is never added to an existing account afterwards.
• What your inviter can see — a masked form of your email address (for example ma****@example.com), the status of the invitation, and how many barcodes you have created toward the number needed for their reward. They cannot see which barcodes, your activity beyond that count, or anything else about your account.
• What you can see about people you invite — the same masked, limited view. Nothing more.
• Abuse checks — before a reward is granted we compare the security signals described above (IP, device identifier) between the two accounts and score the result. No account is ever blocked by this. A high score only means a person reviews the reward by hand; a shared IP address, which is normal in an office or on a VPN, barely counts on its own. The invited person keeps their own Rocket Lane either way.
• Reward record — every Rocket Lane granted or withdrawn is recorded, including who granted it and when. This record is kept rather than deleted so that rewards can be audited and corrected.
• Bot check — the invitation page runs Cloudflare Turnstile to keep automated signups out. Turnstile is provided by Cloudflare, our hosting provider, and processes your IP address and browser signals for that purpose; it may set a short-lived Cloudflare cookie. It does not track you across sites.

Legal basis: performing the invitation you asked for, and our legitimate interest in growing the service without it being abused for free capacity. If you would rather not take part, simply do not use an invitation link — the service works the same without one.

Cookies

• br_session — keeps you signed in (30 days, httpOnly).
• br_dev — a random identifier used only as the abuse-prevention signal described above (1 year, httpOnly). It contains no personal information.
• Cloudflare Turnstile — the bot check on the invitation page may set a short-lived Cloudflare cookie. It is not used for analytics or advertising.

There are no analytics or advertising cookies, and no third-party trackers.

Generated files

Your barcode PDFs are generated on demand and sent straight to your browser — we never store the files. Only the log entry described above remains.

Where the data lives

The service runs on Cloudflare's infrastructure (Pages, Workers, D1); data is processed under Cloudflare's data protection terms. Cloudflare operates globally (including the United States); international transfers are covered by Cloudflare's Standard Contractual Clauses and equivalent safeguards.

Retention and your rights

Account data and logs are kept while your account exists. You can ask us at any time to correct or delete your account and everything tied to it — email [email protected] or use the privacy request form and we will handle it promptly. Login attempt records are deleted automatically after 2 days.

Deleting your account also removes the Rocket Pass records that identify you: invitations you sent or accepted are deleted, and any reward record that has to stay for auditing is stripped of anything pointing back to you. An unaccepted invitation expires by itself after 14 days.

Who we are

Barcode Rocket is operated as an independent professional service based in Serbia. For privacy requests, questions or formal notices: [email protected] or the contact form.