Features
Everything in one place
A scanner, a location log and a shared inventory. Three things it does that most barcode apps do not, and then the rest of it.
Scan now, sync later
With no signal, scans are held on the phone and replayed in the order you took them, carrying the moment of capture rather than the moment they synced. Scanning a barcode you already have raises the count on that record instead of adding a second one, and the database performs that increment under its own row lock, so two people working the same aisle cannot overwrite each other. If the server refuses something, you are told how many and why.
A back office in the browser, a scanner in your pocket
The web app is where the managing happens: history, groups, members and roles, analytics, exports, webhooks, API keys, digests and billing. Scanning stays on iOS and Android, where the camera is. That split is deliberate, and it is why the browser never asks for camera access.
Export the columns you actually need
CSV, or tab-delimited TXT for software that predates the cloud. Thirteen fields, twelve of them on by default, and the order you tap them in is the order the columns come out in. Your choice is remembered for next time, and the phone and the browser produce the same file.
Where it runs
Built for the aisle, not the desk
Signal is optional. Scans are held on the phone and replayed in the order you took them, carrying the moment of capture.
Tap the fields. Watch the file.
This is the real rule, not a picture of it: the order you tap the fields in is the order the columns come out in, and the preview follows every tap.
Format
Fields & order
The number is the column position. Tap to add a field to the end, tap again to drop it — the file follows.
Commas between values, one row per scan.
| Barcode | Name | Category | Status | Location | Added by | Scans |
|---|---|---|---|---|---|---|
| 5901234123457 | Blue nitrile gloves, L | Consumables | Reviewed | Aisle 4, Bay 2 | R. Okafor | 3 |
| 4006381333931 | Thermal roll 80mm | Packaging | In Progress | Aisle 1, Bay 7 | M. Reiter | 12 |
| 8712345678906 | Safety goggles, clear | PPE | New | Cage B | R. Okafor | 1 |
| 0012345600012 | Cable tie 200mm (bag) | Hardware | Reviewed | Aisle 9, Bay 3 | J. Vance | 27 |
| 3057640100178 | Degreaser 5L | Chemicals | Archived | Store room | M. Reiter | 2 |
Everything else it ships with
Groups, and a place name per scan
A group is the organizing unit. Each scan also carries GPS coordinates and a free-text place, so "Aisle 4, Bay 2" is written where you can search it.
Added by, and it stays put
The column names whoever first added a barcode. Re-scanning raises the count without reassigning it, so attribution means what it says.
Nine symbologies
EAN-13, EAN-8, UPC-A, UPC-E, Code 128, Code 39, Code 93, Codabar and ITF-14, with a beep and a haptic on every accepted scan.
Search, and filters worth keeping
Free-text search across barcode, name, category, notes and place name, plus status and date filters you can save and reuse.
A status on every item
New, In Progress, Reviewed or Archived, editable one at a time or across a whole selection.
Quantity and scan count are different numbers
Quantity is how many you have. Scan count is how many times that barcode has been read. Both export, and neither is derived from the other.
Product lookup
Numeric UPC and EAN barcodes come back with a name and category filled in, and a name you set yourself is never overwritten.
REST API and signed webhooks
Read and write scans over an API key, and receive scan.created and scan.updated as HMAC-signed webhooks. Available on Team.
Security that is enforced in the database
A multi-tenant product lives or dies on isolation, so the rules live where they cannot be skipped. The short version is below; the long version, in plain language, is the privacy policy.
Row-level security throughout
Every table carries row-level security and every query is tenant-scoped, so one workspace cannot read another’s rows. Paid features and roles are enforced server-side too — hiding a button is not a permission model.
Secrets live in a vault
Webhook signing secrets are held in Supabase Vault: encrypted at rest, excluded from database dumps, readable by nothing a browser session can reach. Every delivery is signed with HMAC-SHA256 so your receiver can prove it came from us.
Exports that leak nothing
An export fetches exactly your tenant’s rows with an explicit column list, never the whole record, and any cell that could be read as a spreadsheet formula is neutralized on the way out.
Deletion that actually deletes
Delete your account yourself: a 30-day grace window you can cancel by signing back in, then a real, permanent delete. Automated cleanup touches only long-inactive free accounts, warns by email first, and keeps a run log with no identifiers in it. Not paying never deletes anything.
There is no third-party analytics and no tracking SDK, here or in the app, and your data is never sold. Everything travels over TLS, and this site ships strict security headers — HSTS with preload, a content-security policy, and a permissions policy that switches the browser camera off, because a site has no business asking. The rights the GDPR names — access, correction, export, deletion — are how the product already works: export and deletion are self-service, and the rest is an email away. The detail is in the privacy policy.
Nine symbologies, one beep
Point the camera at a 1D barcode and the record is created or its count goes up. The reading happens on the phone, where the camera is — which is why the browser never asks for one.
Wiring it into something else? See Integrations for what is built in and what you can assemble in an afternoon, or Guides for the walkthroughs.