Privacy
Applies to the ajar Android app (ro.codebldr.ajar). Last updated 13 September 2026.
ajar is an app for answering the video intercom at your own gate. It is built by CodeBldr, and this page describes everything it stores about you, where that lives, and how to make it go away.
Who we are
CodeBldr is CODE BLDR S.R.L., a software company in Sibiu, Romania, tax number (CUI) 44030127. It is the controller of what is stored on our server, described below. What is stored in your own house is a different matter, and has a section of its own.
There is no account
You do not sign up. There is no email address, no password, no profile, and no way for us to know who you are. When a phone is added to an intercom it is issued a random token, and that token is the whole of its identity.
What is stored on our server
The relay runs on Cloudflare Workers. For each intercom, and each phone that has been let in, it holds:
| What | Why it exists |
|---|---|
| A random pairing token | Tells one phone from another. Not derived from anything about you or your device. |
| A push token from Firebase Cloud Messaging | The address the doorbell is delivered to. Issued by Google, changes on its own. |
| The phone's make and model, such as "Pixel 8" | So the household can tell whose phone is whose in the list. The app fills it in from the phone itself; nobody is asked to type a name. |
| Whether the phone is an admin, a guest, or waiting to be let in, and when it was added | Who may let others in and take them back out. |
| Whether a guest may read the gate's history | An admin decides this per phone. Admins always may. |
| The intercom's serial number and the name it is shown under | Which gate a phone is allowed to act on. |
| The addresses the agent has on your home network, and a key for reaching it there | So a phone that is at home can talk to the agent directly instead of going the long way round. |
| A scrambled copy (a hash) of the agent's secret | So the relay can tell your agent from an impostor without keeping the secret itself. |
That is the list. No contact details, no address book, no location, no advertising identifier, no device fingerprint.
What is kept only briefly
- A ringing call: which gate and when, until it is answered or ends, and never longer than 30 seconds.
- Invitation and pairing codes: they expire on their own after 2 to 10 minutes.
- Your IP address, when adding a phone or accepting an invitation: counted for one hour so the same address cannot guess codes endlessly, then forgotten.
- Logs: Cloudflare records requests to the relay, including the IP address they came from, and the relay writes short notes of its own, such as which intercom a gate was opened on. They are used for finding faults and abuse, and Cloudflare deletes them within seven days.
What stays in your house
ajar works through a small program, the agent, that runs on a computer in your own house next to the intercom. The agent keeps the gate's history, and none of it is stored on our server:
- Every ring: when it happened, a picture from the intercom's camera taken the moment the button was pressed, which phone answered, and which phone opened the gate.
- Every gate opened from the app: which phone, which gate, and when.
- Recordings: a clip of each visit, 30 seconds unless you choose between 5 and 120, with the picture and the sound from the intercom's own microphone.
Recording is on when the agent is installed. An admin can switch it off in the app. The picture taken at the ring is kept either way, because it is how you see who rang.
The agent deletes history older than 365 days, and deletes the oldest entries first when it reaches its size limit: by default the smaller of 2 GB and a tenth of the free space on the disk. An admin can change the limit in the app.
Admins can read the history, and so can guests an admin allows. When a phone away from home asks for it, the pieces pass through the relay on their way and no copy is kept. Because the history is on a computer in your house, it is you, not us, who decides what happens to it; see the terms about filming the area around a gate.
Video and audio
Video and audio are not kept by us. While a call is live, the picture and the sound pass through the relay to reach your phone, and nothing is written down on the way.
There is no analytics library in the app, no crash reporting service, no advertising SDK, and no third-party tracker of any kind.
Permissions the app asks for
- Notifications, so the gate can ring the phone. Without it the app cannot do its one job.
- Microphone, only while a call is open, so you can talk back to whoever is at the gate. Neither the app nor the agent records what your phone's microphone picks up. A recording of the visit does capture the gate's own microphone, though, and that can pick up your voice as it comes out of the gate's speaker.
- Camera, only to scan the QR code that another phone in the household shows you when it invites you. The scanning happens on the phone and no image leaves it.
Who else sees anything
Google (Firebase Cloud Messaging) delivers the notifications and therefore handles the push token and the contents of each message: which gate rang and when, which phone answered it, and, when a phone asks to join, that phone's make and model. The doorbell message carries a reference to the picture of the visitor, never the picture itself. Cloudflare runs the relay and stores what is described above. Either company may process this outside the European Union, under the safeguards set out in its data processing terms.
Nothing is sold, and nothing is shared with anybody else. We do not build profiles and we have no advertising business to feed.
Why we are allowed to
What the relay stores, it stores because the app cannot deliver a doorbell or open a gate without it: that is the service you asked for (Article 6(1)(b) of the GDPR). The IP counts and the logs exist to keep the relay working and to stop people guessing their way into somebody else's gate, which is our legitimate interest and yours (Article 6(1)(f)).
How long it is kept
For as long as the phone is paired. Remove the intercom from the app and the phone's tokens are deleted with it, including its push address, so it stops being reachable at all. The short-lived items above go on their own schedule. Details and other routes are on the deletion page.
Your rights
Under the GDPR you can ask what we hold about a phone, ask for it to be corrected or deleted, and object to how we use it. One email to the address at the bottom of this page is enough. If you think we have handled something badly you can complain to the Romanian data protection authority, ANSPDCP.
This website
The sentence above, that there is no analytics library and no third-party tracker, is about the app. It still holds and it is the promise that matters. This website is not the app: it counts its visitors, using Google Analytics, so we know whether anybody reads what is written here.
Nothing is written to your device until you accept the bar at the foot of the page. Before that, and if you decline, Google receives the visit with nothing that identifies you or joins one visit to the next. Advertising features are switched off and stay off.
Your answer is remembered in your own browser and nowhere else. Change it whenever you like with the Cookies link at the foot of any page, which brings the bar back; clearing this site's data forgets the answer too.
None of this touches the app, your gate, your intercom, or anything the app holds. An installed copy of ajar sends nothing to Google Analytics, on this page or anywhere else.
Children
ajar is not aimed at children and collects nothing that would identify one. It is a tool for a household's own front gate.
Changes
If this page changes, the date at the top changes with it. Material changes will be announced in the app before they take effect.
Contact
Write to contact at codebldr dot com with anything about this page, or to ask what is held about a particular phone.