Privacy Policy

1. Fundamental Architecture: Zero Remote Data Processing

Unlike conventional web-based barcode generators that transmit user input to remote APIs for rendering, CURL.LY Offline bundles open-source rendering engines (qrcode and jsbarcode) directly inside the local application binary.

When you enter a website URL, Wi-Fi password, contact vCard, phone number, or product SKU, that string is processed solely within your device's random-access memory (RAM). At no point does raw or encoded data leave your device over a network socket.

2. Information We Never Collect

We believe in absolute data minimization. CURL.LY Offline does NOT collect:

• Personal Identifiable Information (PII): No names, email addresses, phone numbers, or contact cards.
• Network Credentials: No Wi-Fi SSIDs, WPA/WPA3 keys, or encryption types are ever uploaded.
• Barcode Payloads: No URLs, product SKUs, serial numbers, or text content are logged.
• Device Telemetry: No IP addresses, MAC addresses, device identifiers, or GPS location data.
• Usage Analytics: No tracking SDKs (e.g., Google Analytics, Firebase, Mixpanel, Segment) are bundled or initialized.

3. Local Device Storage (History & Preferences)

CURL.LY Offline provides a local history feature for user convenience. Here is exactly how it operates:

• Sandboxed Storage: History items are written strictly to standard browser/native sandboxed storage (localStorage) on your local device.
• FIFO Cap (30 Items): The history list is strictly capped at a maximum of 30 items. When the 31st item is generated, the oldest entry is permanently deleted automatically.
• Credential Masking: Sensitive Wi-Fi passwords stored in local history are masked with bullets (••••••••) in the user interface to safeguard against shoulder surfing.
• One-Tap Complete Wipe: You can permanently delete all stored history and cached preferences at any time by tapping the “Clear All History” action inside the application.

4. Device Permissions

The application requests only the minimal permissions strictly necessary for user-initiated actions:

• Photo Library / Storage Access (Write-Only): Required only when you explicitly tap “Save to Photos” or “Export PNG/SVG” to save an image to your camera roll or downloads folder.
• Camera: Never requested. CURL.LY Offline is a generator utility and does not scan or access your device camera.
• Network / Internet: The core generator features require no network access and function in complete Airplane Mode.

5. Third-Party Services & Subprocessors

CURL.LY Offline employs zero third-party data subprocessors for code generation. We do not sell user data to advertising networks, data brokers, or marketing consortiums.

When deploying the promotional landing page on Cloudflare Pages, standard edge delivery logs (such as request timestamps and IP addresses) are handled in accordance with Cloudflare's strict data processing agreements solely for DDoS mitigation and infrastructure security.

6. Compliance with Global Privacy Frameworks

• GDPR (General Data Protection Regulation): Because no personal data is collected, stored, or processed on external servers, CURL.LY Offline adheres to GDPR privacy-by-design principles (Article 25).
• CCPA / CPRA (California Consumer Privacy Act): We do not sell, share, or monetize consumer personal information.
• COPPA (Children's Online Privacy Protection Act): Because zero data is collected from any user, CURL.LY Offline is safe and suitable for users of all ages, including children in educational environments.

7. Verification & Code Auditing

You do not need to take our word for it. CURL.LY Offline is open architecture. Security researchers and developers are invited to inspect platform builds to verify that zero network socket requests are dispatched during code generation.

8. Contact & Data Protection Inquiries

If you have questions, feedback, or security disclosures regarding this Privacy Policy, please contact our data stewardship team:

• Support Email: cs@off.curl.ly
• Organization: https://curl.ly