LockIn ("we", "us") is a social accountability app operated from the United Kingdom. This policy explains what we collect, why, and your rights. Questions: admin@getlockin.me.
Account data: email address, handle, display name, password (stored as a salted hash; absent for Google sign-in), timezone. Content you create: proof photos, voice-memo and text excuses, check-in history, streaks, league memberships. Technical data: device push tokens, and short-lived server logs (IP addresses, request metadata) for security and debugging.
To run the service you signed up for (scheduling check-ins, verifying proof, showing your activity to your league), to send the notifications the app is built around, and to keep the service secure. If you report content or a member in the app, we process the report (who reported whom, the reason, and any detail you add) and email it to our support inbox to review it. If our automated screening flags a custom goal you wrote, we email that goal's text to our support inbox to review it. Legal bases under UK GDPR: performance of our contract with you, and legitimate interests in securing and improving the service.
LockIn is social by design: members of a league you join can see your handle, display name, streaks, check-in outcomes, proof photos, and excuses (text and voice). Anyone you give an invite code to can join your league and see that content. In addition, the in-app witness wall shows successful check-ins (your handle, display name, league name, and goal, never your photos or excuses) to other signed-in LockIn users, including people outside your leagues. This is on by default and you can turn it off in the app's Settings. Nothing you post is visible outside the app.
If you join the waitlist on getlockin.me, we collect your email address to tell you when testing opens and when LockIn launches, and for that purpose we also add it to our audience at Resend, who send those announcements on our instructions. Every announcement includes an unsubscribe link, and you can ask us to remove you entirely at any time. The website itself sets no cookies and uses no trackers; the only thing we count is an aggregate number of daily visits.
Anthropic (automated verification of proof photos, and screening of custom goals: your proof photo, and the goal name, description, and proof criteria you write, are sent to Anthropic's API to verify proof, check goal safety, and build the goal's verification rubric; none of it is used to train their models per their commercial terms); Google Firebase (push notifications and crash reporting); Amazon Web Services (photo and voice-memo storage); Railway (application hosting); Resend (transactional email, and waitlist announcement email). Each processes data on our instructions.
Our processors may store data outside the UK (including the US and EU) under appropriate safeguards such as the UK Addendum to Standard Contractual Clauses.
Proof photos and voice-memo excuses are deleted from storage 30 days after they were submitted; the check-in record itself (result, time, streak) is kept while your account exists. A proof photo that our automated safety screen flags is hidden from your league and kept until it is reviewed. A photo or memo that has been reported is kept for review for up to 90 days. When you delete your account (in the app: Settings → Delete account; or on the web: /delete-account), your profile is immediately and permanently de-identified, your sign-in credentials and push tokens are removed, and any remaining photos and memos are deleted from storage within 30 days, except one that was reported, which is kept for review for up to 90 days, or one flagged by our safety screen, which is kept until it is reviewed. Residual copies in encrypted backups and server logs expire within 90 days.
Under UK GDPR you can ask us for access to, correction of, or deletion of your data, object to or restrict processing, and request portability. Write to admin@getlockin.me. You can also complain to the Information Commissioner's Office (ico.org.uk).
LockIn is not for children under 13, and we do not knowingly collect their data.
We'll update this page and the date above when the policy changes; material changes will be flagged in the app.