How your data is protected

Where is what you scan kept?

In a file in the app's private folder, on your own device. Other apps cannot get at it. Nothing goes to a server, because there is no server.

That file is encrypted. If someone did get hold of it, with a cable or through a backup of the phone, what they would find in it is unreadable rubbish.

How is that encryption done?

With AES-256-GCM. That is the standard that also protects your banking traffic, and it does not just seal things up: it also notices if the file has been tampered with.

Two things matter in that, and both are done properly:

• The key is kept apart. Not in the file itself, not in the app's ordinary settings, not in a log line and not in an export file. It sits in the operating system's secure storage, the place meant for it.
• Every encryption gets a nonce of its own. A nonce is a number that may be used only once. Reuse breaks AES-GCM completely, so there is a separate test on it that turns red the moment someone changes that line by accident.

What happens if I delete everything?

Then the key is replaced as well. That is not an extra but the heart of the matter: a deleted file can sometimes still be recovered from flash memory. Without the old key, whatever may still be there is unreadable.

So nothing can be brought back after that, and the person who made the app cannot help with it either. The app warns you beforehand.

How does the lock on the ticket vault work?

Tickets are in a second encrypted file. Its key is wrapped by a key in the Android Keystore, and that one can only be used straight after authentication with your fingerprint, face, PIN or pattern.

The bolt reaches the key, not the screen. That is the difference with an app that only puts a window in front of your data: there the data lies readable on the disk and the lock is no more than a curtain. Here there is nothing to read without authentication, not even for someone who manages to take the file off the device.

The key does not linger in memory afterwards. That is why the vault asks for your fingerprint again every time, and closes by itself as soon as the app goes to the background.

Why are my tickets gone after a new fingerprint?

Because Android throws the vault key away as soon as a fingerprint or face scan is added. It is deliberately built that way: otherwise someone who knows your PIN could add a finger of their own and reach your tickets.

What was in there is unreadable from then on. Only a backup brings it back. The app warns about this before you start using the vault, and reports it afterwards with a pointer to the backup.

How safe is the backup?

The backup is one file with the history and the tickets in it, encrypted with a password you choose yourself. That password is turned into a key with PBKDF2, so that guessing is slow and expensive.

Outside the app that file is protected by your password and no longer by your fingerprint. So choose one that means something to you. If you lose it, the file can no longer be opened, by anyone. That is exactly why the backup is worth something.

Which permissions does the app ask for?

So why is there an internet permission in the app after all?

Because Google's scanning library, ML Kit, puts that permission in its own part of the file. Barcodehammer does not ask for it and does not use it. That library can send usage data about itself to Google with it; what you scan or create is not in there.

This could easily have been kept quiet. It is stated here on purpose, because anyone who reads the permissions through after being promised "completely offline" feels short-changed. The full story is in the privacy policy.

What the app cannot guarantee

A code appearing neatly on screen says nothing about what is in it. The encryption protects what you keep; it says nothing about whether a scanned web address can be trusted or whether a ticket is still good. The app reads what is there and does not judge. See chapter 4 of the terms of use.