Barcode Man for WooCommerce

Description

Barcode Man connects your WooCommerce store to a hosted workspace where you design and print custom product labels, address labels, and barcodes.

• Design label templates with a visual editor (sizes, barcodes, product fields).
• Print product labels populated from your WooCommerce products and variations.
• Print address labels from your WooCommerce orders.
• Generate and sync SKUs / barcodes back to your products.

The plugin connects your store to the Barcode Man service using WooCommerce’s
official authorization flow (/wc-auth/v1/authorize). WooCommerce creates and
manages the authorization credentials; the plugin does not keep its own copy.

This version is a connector: designing and printing happen in the Barcode Man
workspace at https://woocommerce.barcodeman.app, which opens in its own browser
tab. Nothing is embedded in your WordPress admin, and this package ships no
compiled application code. Connecting needs a Barcode Man account (email and
password), because the workspace belongs to the person signed in, not to the
site alone.

External services

This plugin connects your store to Barcode Man, a third-party label and barcode
service operated by Gookit (company website: https://gookit.co/barcodeman/), so
that your product and order data can be turned into printable labels and
barcodes. The service runs on its own domain, not on the company website:

• API: https://prod-bcm-api.barcodeman.app
• Workspace (WordPress.org build): https://woocommerce.barcodeman.app

What is sent, and when. This describes the WordPress.org connector; the Woo
Marketplace build of this plugin authenticates with a store session instead of
a Barcode Man account and has no sign-in step:

• On connect: your store URL is sent to the Barcode Man API to open the
  connection, and your browser is sent to the workspace
  (https://woocommerce.barcodeman.app) to sign in. You create or sign in to a
  Barcode Man account there with an email address and password and accept the
  Terms of Service and Privacy Policy. That sign-in form talks directly to
  Barcode Man’s identity service, which is hosted on Supabase (an endpoint on
  supabase.co), so the email address and password you type are submitted to
  that service, which holds your email address for sign-in and support.
  After you approve the WooCommerce authorization, WooCommerce sends an API
  credential for your store directly to the Barcode Man API (server-to-server);
  the plugin itself never receives or stores that secret. Once you confirm the
  account and site, the Barcode Man API returns a Site Account ID plus a
  revocable plugin token, which the plugin stores to keep the connection.
  Supabase Terms of Service: https://supabase.com/terms
  Supabase Privacy Policy: https://supabase.com/privacy
• While connected: opening the connector page sends the Site Account ID and
  plugin token to the Barcode Man API to check the connection status. The
  workspace runs in your browser and authenticates as the signed-in person;
  the site’s own token cannot open it.
• While in use: the Barcode Man service reads your products, variations, and
  orders (and writes back generated SKUs / barcodes when you choose to) through
  the WooCommerce REST API in order to render and print labels.
• While a connection is being made: this plugin publishes one value at
  /wp-json/barcode-man-wporg/v1/connect-proof — the SHA-256 of a random
  challenge the Barcode Man API just issued for this connection. The API reads
  it back from your site to confirm that a site administrator started the
  connection before it grants anything. It contains no personal or store data,
  and it is removed as soon as the connection finishes or is cancelled.
• On disconnect: the stored Site Account ID and plugin token are sent to the
  Barcode Man API so it revokes workspace access to this site immediately. Both
  values stay on your site afterwards so you can reconnect the same account
  later; neither can open anything on its own.

This service is required for the plugin to function. By connecting you agree to
the Barcode Man Terms of Service (https://gookit.co/terms/) and Privacy
Policy (https://gookit.co/privacy/).

Paid billing depends on where this plugin build is distributed. The WooCommerce
Marketplace build uses the WooCommerce.com Billing API and does not send
Marketplace customers to Stripe. The WordPress.org build uses Stripe Checkout.

This plugin may also use these third-party services from within the app:

• Stripe — if you choose to subscribe to a paid plan, the app requests a
  checkout link from the Barcode Man API and redirects your browser to Stripe
  Checkout (checkout.stripe.com) to complete payment. Only the data needed for
  checkout is sent by the Barcode Man API: a store-level Site Account ID in
  Stripe customer metadata, the Stripe customer ID, selected plan price, and
  success/cancel return URLs. Payment details you enter in Stripe Checkout are
  handled by Stripe. Product and order records are not sent for billing.
  Stripe Terms of Service: https://stripe.com/legal/consumer
  Stripe Privacy Policy: https://stripe.com/privacy

• Google Fonts — the label editor loads font families from Google Fonts
  (fonts.googleapis.com and fonts.gstatic.com) when the connected app opens,
  so fonts are available for label designs. Your browser sends its IP address
  and request headers to Google when requesting the stylesheet and font files.
  Google Fonts Terms of Service: https://developers.google.com/fonts/faq
  Google Privacy Policy: https://policies.google.com/privacy

• Formspree — when you submit the optional support form, your browser sends
  your name, email, message, any attachments you select, platform, app version,
  Site Account ID and any prefilled support topic to formspree.io so we can
  respond. Formspree also receives ordinary request information such as your
  IP address. Sending a support request is not required to use the plugin.
  Formspree Terms of Service: https://formspree.io/legal/terms-of-service/
  Formspree Privacy Policy: https://formspree.io/legal/privacy-policy/

• Bytescale — when you upload an image for a label template, the Barcode Man
  API sends the image and a storage path containing the platform, Site Account
  ID and template ID to api.bytescale.com. Your browser requests the stored
  image from Bytescale’s CDN (upcdn.io) to display it; those requests include
  your IP address and browser request headers.
  Bytescale Terms of Service: https://www.bytescale.com/terms
  Bytescale Privacy Policy: https://www.bytescale.com/privacy

• DigitalOcean Spaces — when you generate labels, the Barcode Man service
  stores the generated PDF in DigitalOcean Spaces. It contains whatever your
  template renders, including any product or customer/order information. Your
  browser requests the PDF from a digitaloceanspaces.com delivery URL when
  opening or downloading it, sending ordinary request information such as your
  IP address. No WordPress login or WooCommerce API credential is sent with
  that download request.
  DigitalOcean Terms of Service: https://www.digitalocean.com/legal/terms-of-service-agreement
  DigitalOcean Privacy Policy: https://www.digitalocean.com/legal/privacy-policy
• Sentry — the Barcode Man application reports errors and performance data to
  Sentry (sentry.io) so failures can be diagnosed, and loads its session-replay
  module from browser.sentry-cdn.com. Replay records a playback of the screens
  you use: in production a sample of sessions, plus any session where an error
  occurs. That recording can include product names, the customer names and
  addresses shown on address labels, and images such as label previews and any
  logo you upload, along with your IP address and browser details.
  This happens in the hosted workspace, which is not part of this package: it
  ships no compiled application, so nothing is sent to Sentry from your
  WordPress admin.
  Sentry Terms of Service: https://sentry.io/terms/
  Sentry Privacy Policy: https://sentry.io/privacy/

Development

This package contains no compiled, minified or obfuscated code. Everything it
ships is the human-readable source that runs: the PHP
(barcode-man-for-woocommerce.php, includes/, uninstall.php) and one small
admin script (assets/js/bcm-connect-poll.js), which waits for the connection
to finish.

The Barcode Man workspace itself is a hosted service at
https://woocommerce.barcodeman.app. In this version it is not part of the
plugin, is not downloaded by it, and is not executed inside WordPress.

License

The plugin is distributed under GPLv2 or later; see LICENSE.txt. Builds that
also ship the compiled Barcode Man application keep their dependencies’ own
compatible licenses and copyright notices in THIRD-PARTY-NOTICES.txt and
licenses/.
These software licenses are separate from the terms for the hosted service.