This policy describes the personal Android version of BarKey, package net.hernow.barkey. BarKey is a camera-based keyboard that scans barcodes and inserts their decoded text into the active field. It does not describe other applications or any separately maintained enterprise build.
Personal use and commercial permission
The BarKey app is free for private, personal use. Its first-run agreement appears when the launcher is opened or, if setup was skipped, when the keyboard is selected for the first time. It appears again only if the displayed agreement or bundled licence changes. Company or workplace use, commercial activity, and paid redistribution require written approval. Companies should contact Amanda before installing or testing BarKey for work or evaluation; the app has no company trial or scan allowance. Request permission or a commercial version at barkey.support@hernow.net. BarKey source is available under the PolyForm Noncommercial License 1.0.0; it is source-available, not OSI-defined open source.
Camera access and scanning
BarKey requests Android Camera permission to display the rear-camera preview and scan codes. AndroidX CameraX supplies camera capture and preview. Camera frames are analysed locally on the device with ZXing-C++ Android 3.1.1 as the primary barcode decoder and ZXing Core 3.5.4 as the Java fallback. These are bundled software libraries, not hosted services. BarKey does not upload camera frames or decoded barcode contents.
Camera use starts while the scanner keyboard is active and stops when the keyboard is hidden, input ends, or the in-keyboard Help panel is opened. You can deny or revoke Camera permission in Android settings; scanning then remains unavailable until permission is granted.
Third-party libraries and local processing
ZXing-C++ Android and ZXing Core perform barcode decoding on the device. AndroidX CameraX provides camera operations, while AndroidX Core and Lifecycle support Android APIs. Google Guava is a support dependency used by CameraX. These are software libraries bundled with the app, not hosted services, and they do not need an independent service account or a vendor privacy policy to perform local scanning. Source and dependency review found no analytics, advertising, crash-reporting, networking, or remote-processing SDK in the app’s runtime dependency graph. The app does not make these libraries contact a hosted service to scan or decode.
A transitive AndroidX Media3 library contributes an ACCESS_NETWORK_STATE permission in its library manifest. BarKey’s source manifest explicitly removes that permission, as well as INTERNET. The merged release manifest and packaged application still need inspection in an Android SDK build; source review alone is not a certification of the final package or runtime behaviour.
Keyboard and editor context
BarKey is an Android input method. You must explicitly enable it in Android keyboard settings and select it yourself. Android displays its standard input-method warning because a selected keyboard can interact with the focused text field. BarKey uses Android’s InputConnection to insert scans and perform the editing actions you request.
For Backspace and guarded Undo, BarKey may request bounded text around the cursor and selection information to verify that an operation is safe. It initially requests up to 16 characters on either side. Undo can temporarily hold up to 20 recent inserted values and a bounded snapshot of nearby editor context for each in memory. Password/private fields and selected-text replacements are excluded from scan Undo. The receiving application controls its editor implementation and may limit what context is available.
Temporary data, storage, and retention
- Decoded text is temporarily held in memory while it is decoded and inserted into the focused field.
- When Preview is enabled, BarKey temporarily keeps up to eight distinct currently detected values in memory so you can choose one to insert. A suggestion expires shortly after its code is no longer detected and cannot be selected after its editor or scanner context changes; this is not a scan history.
- Duplicate suppression retains the most recently accepted scan value in memory until the active input session ends and compares repeated values during a one-second window.
- Guarded Undo may retain up to 20 recent BarKey insertions and bounded surrounding cursor context in memory while they remain safely undoable.
- The duplicate-suppression value is cleared when the input session ends. Undo history is cleared when the input session ends, the keyboard is hidden or switched away from, relevant editor context changes, another non-scan editing action is used, or BarKey restarts. Undo history is never saved to storage. BarKey has no permanent barcode history and does not write scan values to logs or persistent app storage.
BarKey stores a camera-permission-flow setting and the accepted personal-use terms revision in app-private preferences; it does not store scanned values there. The agreement record stays on the device and is used to enforce the licence gate. If launcher setup was skipped, BarKey opens the agreement the first time the keyboard is selected. It is shown again only if the displayed terms or licence changes. Android backup is disabled in the app configuration, with app storage excluded from cloud backup and device transfer. Text inserted by BarKey becomes part of the destination field controlled by the app you are using. That app may store or transmit the text according to its own behaviour and policy.
Information we collect
BarKey does not require an account or login and contains no analytics, telemetry, advertising, advertising identifiers, or tracking SDKs. It does not collect or upload barcode values, camera frames, or editor text. The app does not include crash-reporting or analytics services.
The app’s source manifest removes Internet and network-state permissions, and source review found no application networking calls. BarKey’s scanning and barcode decoding do not require an internet connection. Camera startup errors may include exception details in Android’s local system log. Editor-operation logs record generic failure messages and exception class names; source review found no barcode contents, camera frames, or editor text passed to log statements. The final merged manifest and runtime logs have not yet been inspected from a release package.
Links opened by your choice
BarKey may offer links to this policy, About information, GitHub, related projects, HernowNet, or PayPal. The app opens an external link only after you tap it, using an Android browser or another app that handles the link. The destination service then handles the visit under its own privacy practices. The locally bundled PayPal QR image itself makes no network request.
Optional PayPal donations are voluntary and are not purchases, subscriptions, or a requirement to use BarKey. Donations provide no features or benefits. BarKey does not contain a billing SDK.
Children
BarKey is a general-purpose scanning keyboard and is not specifically directed to children.
Changes to this policy
If BarKey’s data handling changes, this policy will be updated here with a revised date. The current policy applies to the personal Android BarKey application identified above.
Review scope
These disclosures are based on review of the current application source, Gradle runtime dependency resolution, and library manifests. They describe the implementation as reviewed and do not constitute a formal security audit or runtime privacy certification. The release build’s merged manifest and packaged contents should be checked before publication.
Developer and privacy contact
Developer: Amanda Hernow.
For privacy questions about BarKey, email barkey.support@hernow.net. You can also use the BarKey GitHub issue tracker; please do not include barcode contents or other private data in a public issue.