Bare Compare
Bare Compare
Last updated 19 August 2026. Effective from the date of publication.
Bare Compare never sends us anything about the files you compare. Not their contents, not their names, not the paths they live at, not the name of your machine or your user account. The application makes exactly two kinds of network request — it checks for updates, and it sends one small licence ping a day — and both are described in full below.
If you buy a licence, we hold your email address and a record of what you bought. Payment itself is handled by Stripe, which is the seller and is responsible for your payment details; we never see your card.
Fruit Salad Tech Pty Ltd is the data controller for the personal data described in this policy, except where this policy says otherwise (see section 6, which explains why payment data is different).
We are a small company and there is no separate privacy department. Mail to the address above reaches a person who can act on it.
This is the part most people are asking about, so it is first and it is specific.
Once a day at most, when you start the application, Bare Compare sends a single request to
api.barecompare.app containing exactly these fields and nothing else:
| Field | What it is |
|---|---|
install_id |
A random identifier generated once when the application first runs. It identifies the installation, not you, and it is not derived from anything about your computer — there is no hardware fingerprint. |
key_id |
The identifier of your licence key, if you have entered one. Absent during the trial. |
major | The major version of the application, e.g. 1. |
version | The full version, e.g. 1.0.0. |
os | One of macos, windows, linux. |
arch | The processor architecture, e.g. aarch64. |
locale | Your system language, e.g. en-AU. |
Why it exists. Bare Compare has no online activation and no device limit. A licence key works offline, on as many of your own machines as you like, forever. The only thing that arrangement cannot survive is a key posted publicly, and the ping is how we notice: a key used by hundreds of separate installations in a month looks nothing like a key used by one person on their laptop and their desktop. When we find one, we revoke that key in a later release. That is the whole purpose, and it is why the payload is as short as it is.
It is not optional, and we would rather say so than pretend. A check that the people it exists to detect can switch off is worth nothing, so there is no setting to disable it. What we owe you in exchange is that it stays minimal and that you can read exactly what it contains, which is the table above. Sending your files, your file names, your folder structure or your usage patterns would be a different thing entirely, and we do not do it.
Legal basis: our legitimate interests (Article 6(1)(f) GDPR) in detecting licence keys that have been shared publicly, and it is a stated condition of the licence in the End User Licence Agreement. We have weighed this against your interests: the payload carries no content, no identifiers you did not receive from us, and no way to observe what you do with the software.
The application asks dl.barecompare.app whether a newer release exists, and
downloads it if so. This is an ordinary web request and carries no identifier we have
issued you — it does not include your install_id or your licence key.
As with any web request, the server necessarily sees the IP address it must reply to. We
do not enable access logging on that service, so those addresses are not recorded or
retained by us.
Stated as a list because the absence is the point:
If we ever want product usage data, it will be a separate, clearly-labelled, opt-in feature. It will not be added to the licence ping, because that is exactly how a narrow, defensible check turns into surveillance nobody agreed to.
The public pages of barecompare.app use no analytics, no advertising, no
tracking pixels, and set no cookies. There is nothing to consent to, which is why you have
not been asked.
When the customer portal exists, signing in will set a single session cookie. It is strictly necessary to keep you signed in, it holds an opaque identifier and nothing else, and it is not used to track you across sites.
If you add a passkey to your account, we store the public half of the key your device creates, a label you choose for it, the dates it was added and last used, and a counter your device may report. The private half never leaves your device or your password manager, and we cannot use what we hold to sign in as you. A passkey is bound to this website, so it cannot be used on a lookalike site. It does not, on its own, protect an account whose email is compromised: your email address remains the way back in if you lose every device, so it remains what the account is.
| Data | Why | Legal basis |
|---|---|---|
| Your email address | To send your licence key and let you retrieve it later. | Performance of a contract — we cannot deliver a licence without it. |
| Purchase record (what was bought, when, the licence key issued) | To honour the licence, handle upgrades, and answer support questions. | Performance of a contract, and legal obligation for the tax-record portion. |
| Sign-in codes and session records | To let you sign in without a password. | Performance of a contract. |
We do not receive, store, or have any access to your card number, bank details, or billing address. See section 6.
| Data | Retention |
|---|---|
| Licence pings | Up to 60 days, then deleted automatically. The deletion is enforced by the database's own expiry mechanism rather than by a cleanup job somebody has to remember to run. We say “up to” because that mechanism sweeps expired records within roughly a day or two of their expiry rather than at an exact instant. |
| Sign-in codes | Minutes — they expire automatically and are single-use. |
| Sessions | Until they expire or you sign out. |
| Passkeys | Until you remove them from your account page, or your account is erased. A sign-in attempt in progress is kept for five minutes. |
| Email address and purchase records | For as long as the licence is valid, which for a perpetual licence means indefinitely — a licence we cannot look up is a licence we cannot honour. The portion that constitutes a financial record is kept for the period Australian tax law requires, currently five years. |
| Support email you send us | Up to one year after the matter is closed. |
Bare Compare is sold through Stripe under its Managed Payments service. This has a consequence worth stating plainly rather than burying: Stripe, not Fruit Salad Tech, is the seller of record for your purchase. Stripe is an independent controller of your payment data, not a company processing it on our instructions.
In practice:
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting, databases, the licence-ping endpoint, and sending transactional email such as your licence key. | Sydney, Australia (ap-southeast-2), and its global content network for downloads. |
| Stripe | Selling the software and processing payment — as a separate controller, see section 6. | Global. |
That is the complete list. We do not sell, rent, or share your personal data with anyone else, and we do not use it for advertising.
Our infrastructure is in Australia. If you are in the European Economic Area or the United Kingdom, your data therefore leaves that area. Australia does not have a European adequacy decision, so these transfers rely on Standard Contractual Clauses, which form part of our agreement with Amazon Web Services. Stripe operates globally under its own transfer mechanisms, described in its privacy policy.
If you are in the EEA or the UK, you have the right to access your personal data, to have it corrected, to have it erased, to object to processing based on legitimate interests, to restrict processing, and to receive your data in a portable form. Australian privacy law gives comparable rights of access and correction. We extend all of these to everyone, wherever you are, because operating two standards would be more work than honouring one.
Email support@barecompare.app. We will respond within one month. There is no self-service delete button; requests are handled by a person, which is permitted so long as they are actioned properly and on time.
One limit, stated honestly. If you ask for erasure we will delete your account, your sessions and your ping records. We cannot delete the parts of your purchase record that Australian tax law requires us to retain, and we will not pretend otherwise; that retention has its own legal basis and it overrides an erasure request for that data alone. Your licence itself also stops being lookup-able if we erase the record of it, which is worth knowing before you ask.
If you believe we have handled your data badly, you may complain to your local supervisory authority, or in Australia to the Office of the Australian Information Commissioner. We would rather you told us first.
If personal data we hold is breached in a way that presents a risk to you, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and notify you directly where the risk to you is high. This is a legal obligation and also the only decent way to behave.
Bare Compare is a developer and systems-administration tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.
If we change this policy we will update the date at the top. If a change materially affects what we collect from the application or why — in particular any change to the licence ping's contents — we will say so prominently rather than quietly revising the text, and it will not take effect for existing installations before the release that implements it.