Privacy Policy

Last Updated: October 17, 2026

Clevique ("we," "our," or "us") respects the privacy of users of the BarNoR application (the "App") and is committed to protecting personal information. This Privacy Policy explains what information the App collects, how it is used, and how it is protected.

1. Information We Collect

The App stores scan history and package settings on your device and sends book/product information and covers you save to Notion. It queries external APIs for bibliographic and product information. Builds with OAuth enabled also exchange authentication data with the configured Clevique OAuth broker. See the following items and §3 for the data sent.

1.1 Information You Provide

Notion connection tokens (legacy integration token or OAuth access / refresh tokens)
- Purpose: Tokens for Notion API access through manual or OAuth connections
- Storage: On-device Keychain (OAuth uses ThisDeviceOnly accessibility)
- Third-party sharing: Notion (to access the user's own workspace). With OAuth, Clevique's OAuth Broker relays tokens only while exchanging, refreshing, or revoking them and does not persist them.
Notion Database Configuration
- Purpose: Identification information for the Notion database where scanned data is saved
- Storage: On-device SQLite database (GRDB)
- Third-party sharing: Destination database and property identifiers are used in Notion API queries and saves
Notion OAuth Connection
- Purpose: Connect, refresh, and disconnect Notion in builds with OAuth enabled
- Storage: Access/refresh tokens in Keychain; connection metadata including subject ID, workspace ID/name in SQLite
- Third-party sharing: Access token sent to Notion API; authorization ticket and tokens needed for refresh/revocation sent to the configured Clevique OAuth broker
Custom API Configuration
- Purpose: Retrieve product information by barcode from an API configured by the user
- Storage: URL, headers and other configuration are stored in on-device SQLite
- Third-party sharing: Barcode, configured headers and HTTPClient request identifiers are sent to the configured HTTPS destination

1.2 Information Automatically Collected

Notion OAuth connection metadata (connection ID, workspace ID and display name, reconnection state)
- Purpose: Identify the OAuth connection destination and manage reconnection state
- Storage: On-device local database
- Third-party sharing: During Notion OAuth, Clevique's Broker temporarily processes the workspace ID and display name and authorizing-user ID, then returns them to the device. The Broker does not persist them.
Transient Notion OAuth authorization state (state hash, ticket, authorization code)
- Purpose: Return the Notion authorization result to the authorizing device
- Storage: Clevique OAuth Broker D1. State, ticket, and authorization code are valid for ten minutes. They are deleted on use, with expired entries cleaned up by a scheduled task every five minutes. Verify actual deletion and retention operationally.
- Third-party sharing: Clevique OAuth Broker (to return the Notion authorization result to the signed device)
OAuth App Attest registration challenges and request-limit data
- Purpose: Prove registration requests and limit abusive request volume
- Storage: The production Broker D1 stores challenge hashes and expiry, and HMAC values derived from connecting IPs with a time window, issue count, and expiry. The rate-limit table does not store the IP itself. Validity is ten minutes after issue/update; expired entries are removed on requests or every five minutes. D1 recovery history is separate.
- Third-party sharing: Clevique production OAuth Broker
App Attest proof sent to the OAuth Broker (key ID, assertion, signed action)
- Purpose: Verify app requests at the OAuth broker
- Storage: Key ID in the on-device Keychain. The production Broker stores the key ID, public key, counter, registration time, and last successful authentication in D1. Keys become eligible for deletion after 90 days without successful authentication, with protection while referenced by valid authorization state/tickets. Supported subsequent operations re-register automatically.
- Third-party sharing: Clevique OAuth Broker (for App Attest verification)
ISBN / barcode scan history
- Purpose: Display history of scanned barcodes and book information
- Storage: On-device (local DB)
- Third-party sharing: None (only the ISBN/barcode is sent to external APIs for lookup)
- Deletion: Can be deleted using the "Clear History" feature in the app
Camera Access
- Purpose: Barcode scanning and user-initiated cover capture or photo selection
- Storage: Scanning reads barcode information. When the user saves a cover, the captured or selected image is sent to Notion as JPEG
- Permission: Camera access is checked/requested when needed; photo selection uses the system photo picker
App Attest Verification Data
- Purpose: Verify app requests to the cover API and, when enabled, the OAuth broker
- Storage: Key IDs are stored in device Keychain. OAuth Broker keys have a 90-day inactivity retention rule with in-flight authorization protection. Separate cover API registered keys currently have no automatic deletion deadline. Both D1 databases had a seven-day recovery window when checked on October 17, 2026.
- Third-party sharing: Key ID, assertion and timestamp to the cover API, plus challenge and attestationObject during registration; key ID, assertion and clientData to the OAuth broker, plus challenge and attestation during registration
Request Identifiers
- Purpose: Identify requests sent through HTTPClient
- Third-party sharing: UUID, timestamp and user agent sent to destinations accessed through HTTPClient

1.3 Information We Do Not Collect

The App does not collect the following information:

Access to device location
Access to device contacts
Retrieval of the advertising identifier (IDFA)

2. How We Use Information

Collected information is used only for the following purposes:

Notion API Integration
- Connect to Notion API using an access token from OAuth or an existing manual connection
- Save scanned book/product information to your Notion database
App Functionality
- Execute barcode scanning
- Display scan history
- Provide package management features
- Secure connection management, abuse prevention, service monitoring, and troubleshooting
User Experience Enhancement
- Save app settings (theme settings, etc.)
- Error handling and retry functionality

3. Third-Party Service Integration

The App integrates with the following third-party services to provide functionality:

3.1 Notion Labs, Inc.

Provider: Notion Labs, Inc. (api.notion.com)
Purpose: Save data to your Notion workspace
Data Sent: Access token, destination database/property information, book/product data, image URLs, and cover JPEGs saved by the user
Privacy Policy: https://www.notion.so/Privacy-Policy-3468d120cf614d4c9014c09f6adc9091

Uses an access token from an existing manual connection or OAuth connection. Builds with OAuth enabled also communicate with the configured Clevique OAuth broker for authorization, refresh, and revocation.

3.2 Calil Inc. (OpenBD)

Provider: Calil Inc. (OpenBD) (api.openbd.jp)
Purpose: Retrieve book information from ISBN codes
Data Sent: ISBN code and HTTPClient request identifiers
Privacy Policy: https://openbd.jp/

ISBN codes identify books.

3.3 Internet Archive (Open Library)

Provider: Internet Archive (Open Library) (openlibrary.org)
Purpose: Look up bibliographic data by ISBN and author details by author key
Data Sent: ISBN code, author lookup keys, and HTTPClient request identifiers

3.4 Open Food Facts

Provider: Open Food Facts (world.openfoodfacts.org)
Purpose: Look up food/product information by barcode
Data Sent: Barcode (product code) and HTTPClient request identifiers

3.5 Clevique (barnor-cover-api)

Provider: Clevique (barnor-cover-api) (barnor-cover-api.badfatcat-git.workers.dev)
Purpose: Retrieve bibliographic information and cover image URLs by ISBN
Data Sent: ISBN code, App Attest key ID, assertion and timestamp, plus challenge and attestation during initial registration
Retention: Registered keys have no automatic deletion deadline. Challenges older than 24 hours are removed daily. The 30-day bibliographic/image URL cache freshness period is not a deletion deadline. The D1 recovery window checked on October 17, 2026, was seven days. Workers Logs storage is disabled.

3.6 Clevique (OAuth Broker)

Provider: Clevique (OAuth Broker) (barnor-oauth-broker.badfatcat-git.workers.dev)
Purpose: Start/redeem Notion authorization, refresh/revoke tokens, verify the app, and limit abusive requests
Data Sent: App Attest key ID, proof and signatures, authorization tickets/codes, tokens processed for exchange/refresh/revocation, temporarily processed Notion user/workspace identifiers and names, and the connecting IP used for rate limiting
Retention: Tokens and Notion user/workspace information are processed without D1 persistence. State hashes/tickets/codes, challenge hashes, and IP-derived HMAC rate-limit buckets have ten-minute validity. Registered keys become eligible for deletion after 90 days without successful authentication, with in-flight authorization protection. Expired data is cleaned up on requests or every five minutes. The D1 recovery window checked October 17 was seven days. Workers Logs storage is disabled.

4. Data Storage and Protection

4.1 Local Storage

Notion authentication tokens are stored in the device Keychain; scan history, package settings and connection metadata are stored in SQLite. On-device data and data saved to destinations such as Notion are managed separately.

Storage: Notion authentication tokens use Keychain; settings and history use SQLite. Custom API URLs and header settings are also stored in SQLite
Access Control: Only accessible by the App
Backup: Settings and history may be included in iCloud backups. OAuth access/refresh tokens use ThisDeviceOnly accessibility and are not configured for restoration or transfer to another device

4.2 Security Measures

Protect Notion authentication tokens with the device Keychain
HTTPS communication with external APIs
App Attest verification for the cover API and, when enabled, the OAuth broker

4.3 Data Deletion

App Uninstall: Data in Notion or other external services is not deleted. Authentication data may remain in Keychain, so disconnect within the App first when needed
Clear History: Can be deleted using the "Clear History" feature in the app
Token Deletion: Authentication information can be cleared from settings

4.4 Server-side retention, deletion, and recovery history

The OAuth Broker processes tokens and Notion user/workspace information without persisting them in D1. Authorization state hashes/tickets/codes, App Attest registration challenge hashes, and IP-derived HMAC request-limit data have ten-minute validity. The rate-limit table does not store the IP itself. Used authorization state is removed; expired entries are cleaned up on requests or every five minutes.

OAuth registered keys become eligible for deletion 90 days after their last successful authentication, with protection while valid authorization state/tickets reference them. Supported subsequent operations re-register automatically. Separate cover API registered keys currently have no automatic deletion deadline. Cover challenges older than 24 hours are removed daily; the 30-day bibliographic-cache freshness period is not a deletion deadline.

Deleted operational records may remain in D1 recovery history. The production OAuth and cover databases checked on October 17, 2026, had seven-day recovery windows. This differs from operational retention; we do not reuse old authentication counters unchanged after recovery. Workers Logs storage is disabled for the Broker and cover Worker.

The cover API's Rakuten relay runs on Oracle Cloud and stores operational logs with processing time, request method/path, status, duration, and connecting IP information. Routine paths exclude the query string. Error names/messages and stack information for server failures are also logged. Connecting IP information is not assumed to be the device IP. There is no configured time-based automatic deletion deadline. The October 14 check found no automatic backup policy on the target boot volume and no listed target/compartment backups, clones, or replicas. This does not establish that copies in other regions, external locations, or provider-internal records are absent.

The current Broker emits no dedicated anonymized failure events. If introduced, these must exclude tokens and Notion content and be deleted within 24 hours. That limit does not apply to registered keys or relay logs. Infrastructure providers and external services may retain their own records under their contracts and policies.

5. Third-Party Data Sharing

We never sell, exchange, or transfer your information to third parties.

Except in the following cases:

With Your Explicit Consent
- Saving data to Notion API (using a connection authorized by the user)
Legal Requirements
- Court orders, legal proceedings, government agency requests

6. Children's Privacy

The App is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe your child has provided personal information, please contact us at info@clevique.app.

7. California Residents' Rights (CCPA)

Under the California Consumer Privacy Act (CCPA), California residents have the following rights:

Right to Access: Request disclosure of collected personal information
Right to Delete: Request deletion of personal information
Right to Opt-Out of Sale: Refuse sale of personal information (we do not sell)

Note: See §1 and §3 for the information handled and its destinations. Contact the address in §10 for data-related requests.

8. European Residents' Rights (GDPR)

Under the EU General Data Protection Regulation (GDPR), European Economic Area (EEA) residents have the following rights:

Right to Access: Request a copy of personal data
Right to Rectification: Request correction of inaccurate personal data
Right to Erasure (Right to be Forgotten): Request deletion of personal data
Right to Restrict Processing: Request restriction of personal data processing
Right to Data Portability: Request transfer of personal data
Right to Object: Object to personal data processing