Privacy Policy
CodeCluster (“the App”) is published by CaffeineByte. This policy describes how the App handles information when you use it on your device.
Summary
CodeCluster is a private QR and barcode scanner with on-device PDF and image tools. The App:
- Does not require a user account or registration
- Does not display advertisements
- Does not collect analytics, usage statistics, or advertising identifiers
- Does not sell your data
- Processes scanning, barcode interpretation, boarding-pass recognition, ZATCA e-invoice QR decoding, PDF tools, and image tools locally on your device
- Stores scan history and generated codes locally on your device
- Does not upload scanned content, documents, or images to CodeCluster or CaffeineByte servers
- Does not use a cloud conversion service
PDF and image processing is local. The App may still use the network for existing user-initiated actions such as opening a URL you confirm. The App does not claim that it never uses the internet.
This website (codecluster.caffeinebyte.com) is a static information site. It uses no cookies, no analytics, and no tracking scripts.
Information We Do Not Collect
We do not collect personal information, usage analytics, advertising identifiers, crash reports, or scanned content on any server operated by CaffeineByte. The App contains no analytics SDKs, no advertising SDKs, and no remote crash reporting. Android releases may include INTERNET and ACCESS_NETWORK_STATE for existing user-initiated functionality. Those permissions are not used to upload documents, images, or scan content.
Information Stored on Your Device
The App stores the following data locally on your device using on-device storage (SQLite database and local preferences):
- Scanned and generated code content
- Locally parsed scan details, such as supported boarding-pass information and ZATCA e-invoice QR fields
- Titles, notes, favourites, and tags you add
- Scan timestamps, counts, and content-type classifications
- App settings and preferences (including biometric lock and privacy options)
- Temporary files created while PDF or image tools run (automatically removed when stale, typically after 24 hours)
This data remains on your device unless you export it, share it, create a backup file, or uninstall the App.
Barcode Interpretation
CodeCluster may interpret supported barcode content locally to present structured information. This includes supported IATA boarding-pass barcode data and ZATCA e-invoice QR fields. This processing happens on your device. CodeCluster does not send this data to CaffeineByte servers.
ZATCA QR decoding is structural/data decoding only. CodeCluster does not verify, certify, or determine the legal or tax validity of an invoice.
Document and image tools
On-device tools process files you select:
- Merge PDF
- Split PDF
- Compress PDF
- Images to PDF
- Compress Images
- Convert Images
You choose files with the system file picker or photo picker. CodeCluster does not request broad photo-library or storage access for these tools. Results stay in temporary storage until you Save them to a location you choose or Share them through the native OS share sheet.
Photo metadata
Tool outputs do not keep GPS/location metadata. Location is always removed from processed images and from images placed into a PDF.
If you enable Keep photo details, CodeCluster may preserve other supported metadata when the output format allows it. GPS remains removed. This is not a promise of complete EXIF fidelity. Some formats, devices, and processing paths cannot keep all original details.
HEIC and other device-specific formats may work when the operating system can decode them. CodeCluster does not claim universal HEIC support.
When Data May Leave Your Device
Data may be transmitted to other apps or services only when you deliberately choose to:
- Share content via the system share sheet
- Export or save backup files (plain or encrypted) to storage you select
- Save QR code images, PDFs, or processed images to your photo library or files
- Open URLs, make phone calls, send email or SMS, or perform similar actions after you confirm
- Add contacts or calendar events after you confirm
CodeCluster does not automatically send your scan data anywhere.
Permissions
The App requests permissions only when needed for a feature you use:
| Permission | Purpose |
|---|---|
| Camera | Real-time scanning of QR codes and barcodes. Camera frames are processed on-device and are not uploaded. |
| Photos / files | Scanning codes from images you select, picking PDFs or photos for on-device Tools, saving exports, and importing or exporting backup files. These flows use the system picker. |
| Contacts | Only when you choose to add a contact from a scan result. Not requested at startup. |
| Calendar | Only when you choose to add a calendar event from a scan result. Not requested at startup. |
| Biometrics (Face ID, fingerprint) | Only when you enable biometric app lock in settings. |
The App does not request location permission to decode geographic QR codes. Location coordinates embedded in a QR code are read from the code content itself, not from your device’s GPS. Tools always remove GPS metadata from processed image outputs.
Microphone, phone state, and broad storage permissions are not requested at app startup. Photo and file access for Tools uses the system picker.
Android Backup
Android automatic cloud backup and device-to-device transfer are disabled for CodeCluster app data. The App sets android:allowBackup="false" and uses backup exclusion rules so your scan history and settings are not included in Google’s automatic backup or transfer flows.
If you want to move data to another device, use the in-app encrypted backup feature (see below).
Encrypted Backup
CodeCluster offers optional encrypted backup files so you can migrate or archive your data. When you create an encrypted backup:
- You provide a password at export time
- Data is encrypted using AES-256-GCM (authenticated encryption)
- A key is derived from your password using PBKDF2-HMAC-SHA256 with 100,000 iterations
- A random salt and initialization vector (IV) are generated for each backup
- Your password and encryption keys are not stored by the App or transmitted to CaffeineByte
If you lose your backup password, encrypted data cannot be recovered. Plain (unencrypted) JSON and CSV exports are also available; you are responsible for securing those files.
Maximum backup import file size is 50 MB.
URL Warnings Disclaimer
CodeCluster does not guarantee that links in scanned codes are safe. The App performs local, structural analysis only — such as detecting URL shorteners, unusually long URLs, many subdomains, or file extensions commonly associated with executables. These warnings are informational and are not a substitute for antivirus software, a web filter, or your own judgment.
The App does not use VirusTotal, external URL reputation services, or any network-based safety check. You must confirm before opening a URL. CaffeineByte is not responsible for content at destinations you choose to visit.
Security Features
CodeCluster includes optional privacy and security features you control:
- Biometric app lock
- Private scanning mode
- Hide recent app preview in the system task switcher
- Automatic clipboard clearing (configurable)
- Option to hide Wi-Fi passwords in the UI
Children’s Privacy
The App is not directed at children under 13. We do not knowingly collect data from children. Because we do not collect data on our servers, no child data is held by CaffeineByte through the App.
Changes to This Policy
We may update this privacy policy from time to time. The “Last updated” date at the top will reflect the latest revision. Continued use of the App after changes constitutes acceptance of the updated policy.
Contact
For privacy questions, contact CaffeineByte:
- Email: codecluster@caffeinebyte.com
- Support page: codecluster.caffeinebyte.com/support
Disclaimer
This policy describes the App’s technical behavior as implemented in version 1.4. It is provided for transparency and is not legal advice. Uninstalling the App may delete local data unless you created a backup first. Third-party apps and websites you interact with through scan results have their own privacy practices.