Privacy policy

1. Who is responsible

The controller of your data is Glorija Poena, operator of Lock. Contact for anything about your data: [email protected].

2. What we collect

• Account: display name, email address, a hash of your password (never the password itself), whether the email is confirmed, whether the account is approved, registration and last sign-in time.
• Lock data: when each session started, its unlock time, every change to it (time added or removed, opened, released early, emergency release), and the combination photo you upload.
• Deserter mark: whether the account used Emergency Release.
• Technical data: one sign-in cookie (see section 8) and standard web-server logs.

We do not ask for payment details, phone numbers or documents.

3. Sensitive nature of the data

Using a service like Lock can reveal information about your sex life, which the law treats as a special category of personal data. We process it only with your explicit consent, which you give with a separate checkbox when you register. You can withdraw that consent at any time by asking us to delete your account (section 7). Withdrawal does not affect what was done before.

4. Why we use it

• To run the service you asked for (timer, history, revealing the photo): performance of the agreement with you.
• To handle information that may reveal your sex life: your explicit consent.
• To keep the service safe and fair (approving accounts, recording the Deserter mark, preventing abuse, and the connection details above): our legitimate interest.
• To keep a backup of your sealed photo so it can be returned to you if our systems fail: our legitimate interest, which is shared by you.
• To send you a confirmation email: performance of the agreement.

We do not sell your data, use it for advertising, or profile you.

5. Who can see it

• The operator and Keyholder can see your account, sessions and history. The combination photo is stored on our server and is not shown to other users.
• Public lock page: if the Keyholder creates a public link to your lock (see section 4 of the Terms), anyone with the link can see your display name with all letters hidden except the first and last, your lock status, the timer (or that it is frozen or hidden) and the time visitors added to the current lock, including the countries of those visitors. Your email address and photo are never shown there.
• Visitors of a public lock page: when you add time on someone's public page, we store the country of your IP address (from our network provider, Cloudflare) in that lock's history, where it is visible to everyone who opens the page. Your IP address itself is kept only in our security log and is never shown.
• Backup copy: when you start a lock, an email with your account details, the connection details above and your combination photo attached is sent to the operator's Lock inbox. Support messages arrive in the same inbox together with your connection details.
• Email delivery: confirmation emails and the operator's notification emails are sent through Google's mail servers (Gmail SMTP), so Google processes your email address for that purpose. Google may process data outside the EU under standard safeguards.
• The servers and hosting used to run Lock are operated for the operator and process data only on her instructions.
• We disclose data to authorities only where the law requires it.

6. How long we keep it

Account, session, history and photo data are kept while your account exists. When you ask us to delete your account, we delete these within 30 days.

We may keep a minimal record that an account was marked as Deserter where this is necessary to enforce that rule. If you object to that, contact us and we will look at your case.

The backup and support emails stay in the operator's mailbox while your account exists and are deleted along with your account when you ask us to delete it.

Server logs are kept for a short period for security and are then deleted.

7. Your rights

Under the GDPR you may ask us for access to your data, correction, deletion, restriction, a copy of it in a portable format, and you may object to processing based on our legitimate interest. To use any of these, write to [email protected]; we reply within one month.

You also have the right to complain to the data protection authority in your own country.

8. Cookies

The first time you visit, a banner asks whether you accept cookies. Your choice is remembered in your browser (in local storage, not in a cookie) and you can change it at any time with the Cookies link in the footer.

• Essential cookies are always set, because the site cannot work without them: the cookie that keeps you signed in during your visit, and a security cookie that protects our forms. They are not used for tracking, and no consent is needed for them.
• Optional cookies are set only if you accept: analytics cookies (statistics on how the site is used), and a longer-lasting sign-in cookie if you choose "Keep me signed in" on the sign-in page.

If you decline, none of the optional cookies are set and the analytics tools are not loaded. You stay signed in only until you close the browser.

9. Security

Passwords are stored as hashes, access to the service requires signing in, and the photo is only served to the account that owns it. If a data breach affects you, we will inform you and the supervisory authority as the law requires.

10. Age

Lock is for adults only (18+). We do not knowingly process data of anyone younger.

11. Changes

If we change this policy, the date above changes, and significant changes are shown in the app. See also the Terms of use.