Your data, exactly.

Effective August 20, 2026

LockdIn is a social-accountability focus app made by Shereen and Pulkit ("we"). This page describes exactly what data the app handles and why. Questions: aryantopulkit2@gmail.com.

What we collect

Phone number: your account identity. Used to sign you in via SMS one-time code and to let friends who already have your number find you.
Name and initials: what your circle sees.
Focus activity: your tasks and domains, focus sessions (task, duration, start/end times, whether you finished or quit, an optional note), daily focus totals, and streaks.
Your circle: connection requests and accepted connections, reactions (Respect/Poke) you give and receive, and invites you send (we store the invited phone number and whether it joined).
Device push token: so we can deliver notifications.
Timezone: so streaks and reminders follow your local day.

Contacts (optional)

If you grant Contacts access to find friends, phone numbers from your address book are sent to our server, matched against registered users, and immediately discarded; we do not store your address book. Contact names never leave your device. If you invite someone, the invite message is sent from your own WhatsApp or Messages, not by us; we only record the invited number so we can connect you when they join. If you share an invite link or a session card, it is created on your device and goes only to the app you choose to send it with; we are not involved in the delivery.

What others can see

Your circle (people you mutually accept, up to 20) sees your name, your live and past focus sessions (including quits), your streaks, completion notes, and your place on the shared leaderboard. That visibility is the point of the app.
Anyone who has your phone number in their contacts can discover that you're on LockdIn (your name and initials), like most contact-based social apps. They can't see your activity unless you accept their request.
Your phone number is never shown to other users.

What we don't do

No ads. No analytics or tracking SDKs. No sale or sharing of your data for marketing. No data collection beyond what's listed above.

Service providers

We run on Supabase (database, authentication, and push infrastructure; data stored in Mumbai, India), use Twilio to deliver sign-in SMS codes (they process your phone number for delivery), and Apple to deliver push notifications. This website (including invite-link pages) is served by Cloudflare, which processes standard web request logs. Each processes data only to provide these services.

Security

All traffic is encrypted in transit (TLS). Database access is enforced per-row so users can only read what the visibility rules above allow. Sensitive credentials never ship inside the app.

Retention and deletion

We keep your data while your account exists. You can delete your account any time in the app (Profile → Delete account): this immediately and permanently deletes your account, sessions, streaks, connections, reactions, invites, and push tokens. Residual copies in encrypted infrastructure backups are purged on the provider's normal rotation schedule.

So the app works offline, a copy of your own data (your profile, circle, feed, focus history, and any sessions you finish while offline) is also kept on your device and syncs to our servers when you're back online. It stays on your device only and is removed when you sign out or delete the app.

Children

LockdIn is not directed at children under 13, and we don't knowingly collect their data.

Changes

If this policy changes materially, we'll update this page and note it in the app.

made with ♥ by Shereen and Pulkit