Your data, exactly.

Effective October 21, 2026

LockdIn is a social-accountability focus app for iPhone and Android made by Shereen and Pulkit ("we"). This page describes exactly what data the app handles and why. Questions: aryantopulkit2@gmail.com.

What we collect

Phone number: your account identity. Used to sign you in via SMS one-time code and to let friends who already have your number find you.
Name and initials: what your circle sees.
Focus activity: your tasks and the focus domain you tag them with (Fitness, Chores, Work, Study, Hobby or Misc), focus sessions (task, domain, duration, start/end times, whether you finished, quit, or chose not to count it, an optional note), daily focus totals, streaks, and your weekly finishes: when each week ends we save where you placed on your circle's leaderboard (for example 2nd of 9), your focus that week, and that week's final standings.
Your circle: connection requests and accepted connections, reactions (Respect/Poke) you give and receive, when you last opened your Activity list (so we can mark new reactions), and invites you send (we store the invited phone number and whether it joined).
Session photos (optional): if you add a photo to a session, we store it (a full-size copy and a small preview, resized on your phone; the resize removes location and camera details) and link it to that session. Photos are taken with the camera only; LockdIn never reads your photo library. If you report someone else's photo, we record that you reported it.
Device push token: so we can deliver notifications (an Apple push token on iPhone, a Firebase Cloud Messaging token on Android).
Timezone: so streaks and reminders follow your local day.

Contacts (optional)

Contacts, camera and notifications work the same way on iPhone and Android: you are asked first, and nothing happens unless you say yes. On Android, the camera is the phone's own camera app, so LockdIn never gets camera permission.

If you grant Contacts access to find friends, phone numbers from your address book are sent to our server, matched against registered users, and immediately discarded; we do not store your address book. Contact names never leave your device. If you invite someone, the invite message is sent from your own WhatsApp or Messages, not by us; we only record the invited number so we can connect you when they join. If you share an invite link or a session card, it is created on your device and goes only to the app you choose to send it with; we are not involved in the delivery.

What others can see

Your circle (people you mutually accept, up to 20) sees your name, your live and past focus sessions (including quits, and sessions you chose not to count, which show in their feed as a note that you didn't count a session), your streaks, completion notes, and your place on the shared leaderboard, your weekly finishes (where you placed each week, out of how many, and your focus total that week), plus how many Respects and Pokes you've given and received in total (counts only, not who reacted to what). The final standings saved for a week (who placed where, with their focus totals) are shown only to the person whose board it was. That visibility is the point of the app.
When you Respect or Poke someone, they see that it was you and which of their sessions or streaks it was for, in their Activity list and (if they allow notifications) as a push.
Anyone who has your phone number in their contacts can discover that you're on LockdIn (your name and initials), like most contact-based social apps. They can't see your activity unless you accept their request.
A session photo is visible to the same people as the session: you and your circle. If you report someone's photo, it is hidden from you and we review it; they are not told who reported it.
Your phone number is never shown to other users.

What we don't do

No ads. No analytics or tracking SDKs. No sale or sharing of your data for marketing. No data collection beyond what's listed above.

Service providers

We run on Supabase (database, authentication, file storage for session photos, and push infrastructure; data stored in Mumbai, India), use Twilio to deliver sign-in SMS codes (they process your phone number for delivery), Apple to deliver push notifications to iPhones, and Google (Firebase Cloud Messaging) to deliver push notifications to Android phones. For Android pushes, the notification text (for example "Maya respects your 2h session.") and your device token pass through Google's servers for delivery. The Android app is distributed through Google Play, which handles downloads and updates under Google's own policies. This website (including invite-link pages) is served by Cloudflare, which processes standard web request logs. Each processes data only to provide these services.

Security

All traffic is encrypted in transit (TLS). Database access is enforced per-row so users can only read what the visibility rules above allow. Sensitive credentials never ship inside the app.

Retention and deletion

We keep your data while your account exists, with one exception: we keep only your 7 most recently used tasks, and older tasks are deleted automatically (your past sessions keep their task name), and session photos, which stop being visible 7 days after the session and are deleted from storage within a day after that (you can delete one sooner yourself, and a photo is deleted when you replace it or choose not to count its session). You can delete your account any time in the app (Profile → Delete account): this immediately and permanently deletes your account, sessions, session photos, streaks, weekly finishes, connections, reactions, invites, and push tokens, and removes you from the saved weekly standings of everyone in your circle. (They keep their own recorded finish, such as "2nd of 5".) Residual copies in encrypted infrastructure backups are purged on the provider's normal rotation schedule.

So the app works offline, a copy of your own data (your profile, circle, feed, focus history, and any sessions you finish while offline) is also kept on your device and syncs to our servers when you're back online. It stays on your device only and is removed when you sign out or delete the app.

Delete your account

In the app: open LockdIn, go to Profile, tap Delete account and confirm. Your account is deleted immediately.

Without the app (for example if you've already uninstalled it): email aryantopulkit2@gmail.com with the subject "Delete my LockdIn account" and the phone number you signed up with. Before deleting anything, we'll confirm the request with you to make sure it's really your account. We delete it within 30 days of confirming.

Either way, deletion removes your account, sessions, session photos, streaks, weekly finishes, connections, reactions, invites and push tokens, and removes you from your circle's saved weekly standings (they keep their own finish, such as "2nd of 5"). Nothing is kept except residual copies in encrypted infrastructure backups, which are purged on the provider's normal rotation schedule.

Children

LockdIn is not directed at children under 13, and we don't knowingly collect their data.

Changes

If this policy changes materially, we'll update this page and note it in the app.

made with ♥ by Shereen and Pulkit