Privacy Policy

Last updated: October 2026

This privacy policy applies to the BarberNote app. BarberNote is developed by EloLabs.

1. Who we are

BarberNote is an app for independent barbers, made by EloLabs. In this policy, "we" means EloLabs, "you" means the barber using the app, and "clients" means people who book an appointment through a barber's online booking link.

2. The app on your device (Free and Pro)

Everything you enter in BarberNote — appointments, customers (names, phone numbers, notes), services, products, cash records, expenses and settings — is stored only on your device. BarberNote has no user accounts: you don't sign up or sign in to use the agenda. The agenda, customers, cash and reports work offline.

The app uses the internet only for the following:

• Subscriptions. Purchases are handled by the Apple App Store or Google Play, and managed through RevenueCat, which links your purchase to an anonymous app user ID. We never receive your payment details.
• App settings. From time to time the app asks our server for a few app-wide settings (for example an update notice, a maintenance notice, or the address of a tutorial video). This request contains only the app's language. Like every internet request, it also reveals your device's IP address to our hosting provider. It contains no shop or customer data.
• Online booking, only if you turn it on (see section 3).

Weekly and monthly summaries are local notifications created on your device; no data leaves your phone for them.

WhatsApp and SMS messages. When you tap a reminder or message button, BarberNote opens WhatsApp (or your SMS app) on your phone with the client's number and the text filled in. The message is sent by you, from your phone; we never see it.

Backups. A backup is a file that you create and share yourself using your phone's share sheet. We have no access to it.

3. Online booking (Pro + Online)

Online booking gives you a personal link (for example book.elolabs.app/b/your-shop) where clients can book a free time without installing an app. To make this work, the following information is stored on our server, hosted by Cloudflare (Cloudflare Workers and Cloudflare D1 database). Data is stored on Cloudflare servers in Eastern Europe. Requests may pass through Cloudflare's network in other countries.

Your booking page

• Your link name, and any previous link names (they keep redirecting to your current link).
• Shop name, shop phone number, address (only if you fill it in), language, currency, country calling code, time zone, working days and hours, appointment interval, advance notice, temporary closures, theme color, and whether online booking is on or off.
• Your services: name, price and, if you set one, duration.

These are shown on your public booking page so clients can see your services and book.

Busy times from your agenda

To avoid double bookings, the app sends the start and end times of the appointments in your agenda for today and roughly the next 60 days. Only the times are sent — no client names, services, prices or notes.

Clients who need your approval

If you turn off "Can book instantly" for a client, the app sends a one-way hash of that client's phone number (SHA-256 with a value unique to your shop), not the number itself, so the server can recognise their bookings and hold them for your approval.

Technical identifiers

• Your anonymous RevenueCat app user ID, and a hash of a random key the app creates for your phone (the key itself stays in your phone's secure storage and is not included in backups).
• Your Google or Apple account identifier (see section 5).
• Your push notification token (see section 6).
• Store subscription identifiers (Apple transaction ID or Google Play order number) and the RevenueCat subscription ID, so your link can be restored if you change phones or reinstall the app.
• Whether your subscription is active, when it was last checked, when the app last connected, and how many times you changed your link name.

To check your subscription, our server asks RevenueCat using your anonymous app user ID. We receive the subscription status and store identifiers, never your payment details.

Bookings from your link

Bookings that clients make through your link are stored on our server (see section 4) and delivered to your app. Once in your app, they are kept on your phone like your other appointments.

4. Clients who book through a barber's link

If you book an appointment through a barber's BarberNote link, the barber receives your booking in their BarberNote app. To make and manage the booking, we store:

• The name and phone number you enter.
• The services you chose (with their name, price and duration at the time of booking), the date and time, and the language of the page.
• The booking's status (confirmed, waiting for approval, cancelled, declined or expired), who cancelled it, a booking code for your booking link, and a one-time request ID that prevents duplicate bookings if your connection drops.

We use this to:

• deliver your booking to the barber and notify them;
• let you view and cancel your booking from your booking link, or find it with your phone number ("Find my booking" shows your name only in masked form, for example A*** Y***);
• prevent abuse, for example by limiting the number of upcoming bookings per phone number at the same barber.

Who is responsible. Your booking information (your name and phone number) belongs to the barber you book with. EloLabs stores it on the barber's behalf, only to provide the booking link.

In your browser. The booking page saves your booking codes and the name, phone number and country you entered in your browser's local storage, on your own device, so you can see your bookings and don't have to type your details again. You can remove them by clearing this site's data in your browser.

Links on the booking page. The Call, WhatsApp, address (Google Maps) and "Add to calendar" (Google Calendar on Android, a calendar file on other devices) buttons open those apps or services directly from your device.

The barber may also keep your booking in their agenda on their phone. For questions about how a barber uses your information, please contact the barber.

5. Google and Apple sign-in

Online booking links are tied to the barber's Google account (on Android) or Apple Account (on iPhone), so the link stays with its owner when they change phones. Sign-in is only used for Online booking; the Free and Pro features need no account.

• Google: when you continue with Google, Google sends us a sign-in token that includes your name, email address and profile picture. We use the token only to verify the sign-in and to read your account's permanent identifier. Your name, email address and profile picture are not stored.
• Apple: with Sign in with Apple we do not request your name or email address.

We store only the provider (Google or Apple) and that permanent account identifier. We use it for two purposes only:

• to keep your booking link yours, so that nobody else can take it;
• to bring your link back when you change phones or reinstall the app.

The app requests basic sign-in only, with no access to your contacts, files, calendar or other Google or Apple data.

6. Notifications

If you use Online booking and allow notifications, the app registers a push notification token with our server. When a client books or cancels, our server sends a notification through Expo's push notification service, which delivers it through Firebase Cloud Messaging (Android) or the Apple Push Notification service (iPhone). The notification contains the client's name and the booking time.

The weekly and monthly summaries and the "share your link" reminders are local notifications created on your device.

7. Abuse protection

• Cloudflare Turnstile. The booking form uses Cloudflare Turnstile in invisible mode to tell people from automated bots. Turnstile collects technical signals from the browser, and our server sends the Turnstile token and the visitor's IP address to Cloudflare for verification. See the Cloudflare Turnstile Privacy Addendum.
• Rate limits. To limit bookings and searches per visitor, and the number of new booking links created per day, our server keeps short-lived counters keyed by IP address (and, for new links, by Google or Apple account identifier). Counters for bookings and searches are deleted within about two hours; counters for new links are deleted within about one day. Cloudflare also applies a short-term rate limit to booking requests.

8. How long we keep data

• Online bookings (including the client's name and phone number) are deleted completely 90 days after the appointment ends. We don't keep anonymised copies.
• Booking notifications for the app (the list the app reads new bookings and cancellations from) are deleted 90 days after they were created.
• Busy times from your agenda are deleted one day after they end.
• Rate limit counters (which contain IP addresses) are deleted within about two hours. The IP address of a barber who creates a new booking link is kept for at most about one day.
• Your booking page, account identifier and subscription identifiers are kept for as long as your link exists, including after your subscription ends: your link stays reserved for you, so it works again if you resubscribe. They are deleted when you delete your link (see section 10).
• Link names. When a link is deleted, its name (and any previous names) is kept on a locked list with only the date of deletion, so that nobody else can take it and receive the previous owner's clients. No personal data is kept with it.

Server logs. Our server keeps technical logs of requests (such as time, address requested and errors) for operation and troubleshooting. These logs are stored by Cloudflare and deleted after 3 days.

9. Third-party services

• Cloudflare — hosting of our server and booking pages (Cloudflare Workers), database (Cloudflare D1), bot protection (Turnstile) and rate limiting. Data is stored on Cloudflare servers in Eastern Europe. Requests may pass through Cloudflare's network in other countries.
• RevenueCat — subscription management, using an anonymous app user ID.
• Apple App Store and Google Play — app distribution and payments.
• Google Sign-In and Sign in with Apple — tying an online booking link to its owner (Online booking only).
• Expo push notifications, Firebase Cloud Messaging and Apple Push Notification service — delivering booking notifications to the barber (Online booking only).
• YouTube — the tutorial video in the app opens a page on book.elolabs.app that plays the video with YouTube's privacy-enhanced mode (youtube-nocookie.com). When you play it, Google may collect data under its own privacy policy.
• Web3Forms — if you use the contact form on our support page, the name, email address and message you enter pass through Web3Forms to reach us.
• WhatsApp, your SMS app, Google Maps and Google Calendar — opened by you from the app or the booking page; we don't send them any data.

We do not use advertising networks, analytics SDKs or tracking tools, and we do not sell personal data.

10. Your choices and deleting your data

• Delete your link and account connection in the app: Settings → Online booking → "Delete my link and Google connection" (on iPhone: "Delete my link and Apple connection"). If you no longer have the app, you can ask us to delete it — see how to delete your link and account.
• Agenda data on your phone is deleted when you use Settings → "Reset All Data", clear the app's data or uninstall the app (make a backup first if you want to keep it).
• Clients can cancel their booking at any time before it starts from their booking link. To ask about or delete booking information before it is removed automatically, contact the barber or us at [email protected].
• You can ask us what data we hold about you, or ask us to correct or delete it, at [email protected]. To protect your data, we may ask you to confirm that the request comes from you.

11. Security

All connections to our server use HTTPS. The key that identifies your phone is stored on our server only as a hash, and client phone numbers sent for approval settings are stored only as hashes.

12. Children's privacy

BarberNote is a business tool for barbershop owners and staff and is not directed at children. We do not knowingly collect data from children under 13.

13. Changes to this policy

If we update this privacy policy, the new version will be posted on this page with an updated date. We encourage you to review it periodically.

14. Contact

Questions about this privacy policy? Contact us at [email protected] or through our support page.