Barcode Info: a scanner that never phones home

September 4, 2026 · UpFlyDev engineering

barcodeinforeleaseengineering

Our third consumer app is out on both stores. Barcode Info scans a barcode and then does the part most scanners skip: it tells you what kind of code it was, whether the product number is even well-formed, where the barcode was registered, and — for a QR code — what it actually contains before you tap anything.

It is a small app with two opinions in it. One is about honesty, and one is about the network.

“Registered in”, not “made in”

Search any store for a barcode scanner and you will find apps that read the first three digits and announce the country a product was made in. That is not what those digits mean. The GS1 prefix identifies the member organization that issued the manufacturer's company prefix — a company registered in Germany can perfectly well have its goods made in Vietnam, and frequently does.

People scan for exactly this reason, so getting it wrong is not a rounding error, it is the whole answer being false. Our copy therefore says “Barcode registered in”, and the caveat sits under the flag rather than in a help screen nobody opens. Ranges that carry no origin at all — in-store codes, restricted circulation, coupons, ISBN and ISSN — say so, instead of showing a flag we cannot justify.

The app removes its own internet permission

Everything is computed on the phone: the prefix tables, the check-digit maths, the QR classification. There is no backend, no account, no analytics — and the App Store listing says “Data Not Collected”.

Making that stick on Android took one more step than we expected. Recognition uses ML Kit's bundled model, so scanning works with no network at all; but ML Kit reports API usage metrics to Google through a transitive dependency, and that dependency is what quietly puts INTERNET into the merged manifest. There is no supported way to switch those metrics off — the scanner plugin's maintainer points at ML Kit, and Google has not answered the standing request.

So the release build removes the permission instead:

• The release manifest drops INTERNET outright. The offline promise becomes something Android enforces, not something a third party is trusted for. Debug builds keep it, because the Dart VM service needs it.
• Backups are off. Scan history and photos must not travel to a cloud backup or a new device — the privacy policy says they stay on this one, so the app declares allowBackup="false" and ships data-extraction rules to match.
• Verified on real hardware, not just in a simulator: no SecurityException, scanning unaffected, and logcat confirming the local model was the one that ran.

The frame a barcode first decodes in is the worst one

Every scan keeps the camera frame it was read from, uncropped — partly so a row of digits in your history is still recognisable as the thing you were holding, partly because label and logo recognition is where this app is going next, and that needs the whole scene rather than a cropped code.

Which surfaced a small, satisfying problem. The obvious implementation closes the scanner on the first successful decode, and the first frame that decodes is almost always the ugliest of the run: autofocus and exposure are still settling, and the phone has not steadied yet. So the scanner deliberately does not stop there. It keeps collecting frames of the same code for about 320 milliseconds and saves the freshest one, while the haptic still fires on the first hit — so the wait is invisible, and the photo is materially sharper. Only the picture is refreshed across that burst; the value and the symbology stay as first decoded, because later frames exist to sharpen the image, not to revise what the code says.

Get Barcode Info — free, works with no network, keeps everything on the device. On both stores.

Learn more about Barcode Info →