Privacy Policy

Barcodes for iPhone and Apple Watch · Grey Sky Media · last updated 11 August 2026

Barcodes keeps your cards on your devices. There is no Grey Sky Media server, no account to make, and no analytics. Nothing you scan is sent to us, because there is nowhere for it to be sent.

The short version

Your cards live on your phone and in your own iCloud account, which only you can read. We never see them. The app talks to exactly two kinds of outside address: the website of a brand whose logo you asked it to fetch, and a gym schedule you typed in yourself.

What the app stores

What	Where it lives	Why
Card name, barcode value and format, colour, logo, notes	On device, and in your private iCloud database if iCloud is on	It is the card. Without it there is nothing to show a reader.
Driver's licence and ID data… name, date of birth, address, licence number, height, eye colour	Same as above. Encrypted at rest, and the app requires Face ID, Touch ID or your passcode before it will display any of it.	It is encoded in the barcode you scanned. The app reads it so it can show you the card and label it sensibly.
A rendered image of each barcode	On device, shared with the Apple Watch app and the widget	The Watch cannot draw every barcode format itself.
A cached gym schedule, if you attach one	On device	So the card works without a signal.

What leaves your device

A website you name, when you ask the app to fetch a brand's colour and logo. It requests that site's home page and icon, nothing more. This only happens when you type a website in or scan a licence, and you can leave the field empty.
A gym schedule site you name, to read the published class times and workout. Fitness MD, CrossFit.com, HEW Fitness and Barry's are understood today.
A public exercise-picture library (the open-source free-exercise-db, served from cdn.jsdelivr.net), only when you tap the ⓘ on a workout to see reference images. The request carries the picture's name and nothing else — never who you are, never which gym. Don't tap it and this request never happens.
A suggestion you choose to send: when an exercise has no reference picture, you can type what it is and tap Send. That text — the exercise line, your note, and the app version — goes to Grey Sky Media's suggestion inbox (barcodes-suggest.gsm.workers.dev) so a person can add the exercise. Sending runs a Cloudflare bot-check first. It is not linked to you: no identifier, no account, no device fingerprint travels with it, and our copy of your network address is stored only as a salted hash for rate limiting. Don't tap Send and nothing is ever sent.
Apple's iCloud, if you have it switched on, to sync your own cards between your own devices. This is your private database. Grey Sky Media has no access.

That is the complete list. Suggestions are the one thing you can actively send us, and they are anonymous by construction. No third-party analytics, no advertising identifiers, no crash-reporting service, and no icon-lookup service. When the app needs a logo it asks the brand's own site and nobody else.

Diagnostics

The app subscribes to Apple's MetricKit so crashes and hangs are written to the device's own system log. Those reports stay on the device. Nothing is uploaded to us. Separately, if you have opted in to sharing analytics with Apple and with developers in iOS Settings, Apple may show us anonymised crash data. That choice is yours and lives in Settings, not in this app.

Permissions

Camera… only while the scanner is open, only to read a barcode. No photo or video is recorded or saved.
Photos… the app uses Apple's photo picker, which hands over just the one image you pick. It has no access to your library.
Notifications… only if you turn on a daily reminder for a gym card. These are scheduled on the device.

Deleting your data

Delete a card and it is gone from the device and from your iCloud database. Delete the app and everything local goes with it; to clear the synced copy, turn Barcodes off in Settings → your name → iCloud → Manage Storage. We hold nothing, so there is nothing to ask us to delete.

Children

Barcodes is not directed at children and collects nothing from anyone.

Changes

If this policy changes, the date at the top changes with it, and material changes will be called out in the app's release notes.

Contact

Questions: [email protected]