This question comes up less than it should. People happily register a barcode without asking what the app now knows, and the honest answer is that it could know quite a lot if it were built carelessly.

What a scan alarm could learn

Taken at face value, the mechanic involves:

None of that is inherently sinister, and all of it is necessary for the feature to work. The question is what happens to it afterwards.

What a well-built app stores

The key insight is that the app never needs the code itself. It only needs to recognise it again. That is exactly what a hash is for.

When you register a code, a well-built app computes a one-way hash and stores that. When you scan in the morning, it hashes what the camera sees and compares. Match or no match, and the original value is never needed. Salting the hash means it cannot be trivially reversed by comparing against a list of known barcodes.

So the app can recognise your kettle without ever storing that it is a kettle.

The app does not need to know what your code is. It only needs to know whether this is the same one.

What Mornio does

Full detail in our Privacy Policy. And a fair caveat: you are trusting our description of on-device behaviour. The privacy label and the policy are what we can show you.

Questions to ask about any scan alarm

  1. Does it store the code or a hash? If the policy does not say, that is itself informative.
  2. Are images saved? They should not be.
  3. Does anything leave the device? An app with an account is syncing something; find out what.
  4. What does the privacy label declare? Particularly Data Used to Track You.
  5. Is there advertising? Ad SDKs are the usual reason an alarm app collects more than it needs.

Practical precautions, whichever app you use