Last updated: October 1, 2026

Privacy Policy

This policy explains what data UPCGen collects, why, and how it is handled.

Information we collect

• Account data: email, password hash, optional name — collected when you register.
• Generated barcodes: the format and code value of each barcode you generate, plus a timestamp. Used to enforce quotas and show your history on the account page.
• IP addresses: our session store records the IP address a sign-in session was created from. We no longer record an IP against a generated barcode — generating requires an account, so quotas count against the account. Barcodes generated before 21 August 2026 still carry the IP recorded at the time.
• Payment data: processed by Stripe. We never see your full card number. Stripe returns us a customer ID and subscription status, which we store.
• Cookies: a session cookie (set by Better Auth), a locale preference cookie (NEXT_LOCALE), a consent cookie (upcgen-consent), and Google Analytics cookies (_ga, _ga_*) when analytics consent is granted. While you connect an AI assistant app (see below), two short-lived cookies (oidc_login_prompt, oidc_consent_prompt) hold the connection request for up to 10 minutes.

Analytics & consent

We use Google Analytics 4 to measure aggregate site usage (pageviews, traffic sources, device categories). This helps us prioritize features and fix UX issues.

By using UPCgen.com, you consent to the placement of analytics cookies on your device, except where applicable law requires explicit consent. For visitors located in the European Union, European Economic Area, United Kingdom, or other regions with similar consent requirements, we display a consent banner on your first visit, and we will not place analytics cookies on your device unless you click "Accept." If you click "Reject," Google Analytics operates in "cookieless ping" mode and only counts aggregate visits without identifying you.

You can withdraw consent at any time by deleting the upcgen-consent cookie from your browser. The banner will reappear on your next visit.

How we use it

• To operate the Service: render barcodes, enforce quotas, gate Pro/Business features.
• To process payments and manage subscriptions via Stripe.
• To respond to support requests when you email us.
• To detect abuse and prevent fraud.

ChatGPT and other AI assistant apps

You can use UPCGen inside ChatGPT and other AI assistants that support apps. This section explains what happens to your data when you do.

Without connecting an account

The barcode checker, check-digit calculator, code converter, and barcode advice work without an account. UPCGen receives only what the assistant sends for the task: a barcode number, a format, or your answers to the advice questions (where you sell, what the product is, and roughly how many codes you need). UPCGen does not ask for your conversation and does not store these requests.

When you connect your UPCGen account

Making barcode images needs your UPCGen account. The first time, the assistant sends you to upcgen.com to sign in, and a consent page shows which app is asking and what it will be able to do. Nothing is shared until you choose "Connect".

• What the app can do: make barcode images on your account. Each new code counts toward your plan, exactly as on the website. The app cannot see your payment details, change your plan, or see or delete codes you made before.
• What we store: each barcode the app makes is saved to your account like one made on the website (format, code value, and time). We also store the connection itself: the app's registration (its name and return address), a record of your consent (which app, which permissions, and when), and the access tokens that let the app act for you.
• What the app receives from us: the results of the tools it calls. If the app asks for these permissions and you approve them, we also send your email address (the "email" permission) and your name and profile picture (the "profile" permission). The consent page lists each one before you connect.
• Download links: each barcode comes with a download link that works for 1 hour. The link contains an encoded reference to your account, so treat it as private.
• Tokens: an access token works for 1 hour. A refresh token works for up to 7 days and is replaced each time it is used.

Disconnecting

Go to Account settings and choose "Disconnect" under Connected apps. This deletes the app's tokens and your consent record at once, so the app stops working with your account immediately. Signing out of upcgen.com does not disconnect an app. Barcodes the app already made stay in your account history, like any other barcode. Deleting your account deletes all its connections.

The assistant's own handling of your data

Your conversation, and anything the assistant keeps from it, is handled by the assistant's provider under its own policy, for example the OpenAI Privacy Policy for ChatGPT. The assistant may attach details such as your language or approximate location to its requests; UPCGen does not use or store them.

Third parties

• Stripe — payment processing. Stripe Privacy Policy.
• Cloudflare — DNS and edge proxy. Cloudflare Privacy Policy.
• Google Analytics 4 — aggregate site analytics (subject to consent, see "Analytics & consent" below). Google Privacy Policy.
• AI assistant providers (such as OpenAI for ChatGPT) — only when you use UPCGen inside their assistant; see "ChatGPT and other AI assistant apps" above.
• Google Fonts — Poppins font, self-hosted via next/font/google, so no requests leave to Google at runtime.

Data retention

We retain account and barcode history for as long as your account is active. You can request deletion at any time by emailing [email protected]. Stripe retains payment records per its own retention policy and applicable financial regulations.

Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or export your personal data. To exercise these rights, email [email protected]. We will respond within 30 days.

Security

Passwords are hashed (not stored in plaintext). API keys are hashed before storage. The application runs on a self-managed VPS behind Cloudflare with TLS in transit. No system is perfectly secure; we monitor and patch promptly.

Children

UPCGen is not directed at children under 13 and we do not knowingly collect personal data from them. If you believe a child has provided us data, email [email protected] and we will delete it.

Changes

Material changes to this policy will be announced via email or in-app notice at least 7 days before they take effect.

Contact

Privacy questions or data requests: [email protected]