PRIVACY POLICY

1. Who is responsible

Hydro Apps is responsible for the personal information we process to provide Locked In. Contact us at support@lockedinai.space with privacy questions or requests. Apple, your sign-in provider, and other service providers also process information under their own policies.

2. Sign-in and setup

Locked In signs you in with Apple or Google through Supabase Auth. Supabase stores your account identifier and, if your provider shares them, your name and email, so the app can tell your routine apart from anyone else’s.

While you are setting up, your onboarding answers—name, goals, obstacles, availability, body weight if you enter it, and your routine draft—are stored with your account so you can continue on another phone. They are removed from the account when setup finishes. Supabase also keeps your subscription status, including plan, expiry, and Apple transaction identifier. Your ongoing routine itself is not sent to Supabase for routine storage.

3. Your routine and device features

The app stores your profile, goals, routine, sessions, progress, and explanations on your device. If you enable iCloud sync, Apple also processes synced data in your private iCloud storage. AI permission is not synced through the profile mirror. Your profile photo and exported stat card stay on the phone unless you choose to share them.

With your permission, the app can schedule notifications and use Apple’s Screen Time features to shield selected apps during focus sessions. You control these permissions through the app and iOS settings. Live Activities can show task and timer information on your lock screen, where someone with access to your screen may see it.

4. Optional AI

AI is off until you agree on this device. Supabase processes AI requests and forwards them to OpenRouter and selected model providers. Requests can include questions, recent allowed questions, goal and task names, schedules, progress counts, streaks, XP, level, grace passes, unplanned days, reason categories, category usage, minimum duration, and tone.

Written plea explanations require a separate sharing choice. Custom content can contain sensitive information, and automated checks cannot detect everything. Avoid including information you do not want these providers to process. The built-in routine, focus, and proof features work without optional AI.

5. Why we process information

We use this information to provide sign-in, restore setup, recognize subscription access, deliver requested app features, answer routine questions, produce verdicts, enforce usage limits, respond to support requests, and protect the service. AI requests are tied to your Locked In account so usage limits apply per account. We do not use routine or AI information for advertising or cross-app tracking, and we do not sell it.

Where a legal basis is required, we rely on providing the service you request, your consent for optional processing such as AI, legitimate interests in security and support, and compliance with legal obligations. You may withdraw optional consent in the app without affecting earlier processing.

6. Retention

Routine records remain on your device and, if enabled, in iCloud until you delete them. The AI proxy code does not store question or answer content in its quota tables. Those tables contain your account identifier, counts, and request timestamps and are deleted after seven days. To prevent abuse, the server also keeps request counts per account and per one-way hash of your IP address for at most one day; it does not store the raw address in those rate-limit records.

Provider and infrastructure logs, backups, and retention depend on their policies and the deployed account settings. We do not promise that providers retain nothing or never use data for training. Support emails are kept as needed to respond, maintain a record of the issue, and meet applicable obligations.

7. Your choices and deletion

Turn AI off in Profile to stop future AI requests. Explanation sharing can be turned off separately. Use Delete Account in Profile to delete your Locked In account, the onboarding and subscription records stored with it, and this phone’s data. For accounts created with Apple, the app’s Sign in with Apple access is revoked too.

Use Delete All Data to request removal of local routine data. iCloud deletion depends on sync completing and may not finish immediately. These actions do not erase provider records already created; provider-held records are subject to that provider’s deletion and retention process. Deleting your account or the app does not automatically cancel an Apple subscription. Manage any subscription in your Apple account settings.

Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to processing of your information, withdraw consent, or complain to a data-protection authority. Email support@lockedinai.space to make a request. We may need to verify ownership before acting and will respond as required by applicable law.

8. This website

This website is hosted on Vercel. When you visit, hosting infrastructure may process your IP address, browser and device information, requested URLs, timestamps, and technical logs to deliver and secure the site. This site does not add advertising trackers, analytics SDKs, a mailing-list form, or nonessential tracking cookies. Fonts, screenshots, and recordings are served with the site.

If you email us, your email service and ours process your message, address, and any attachments. Do not send passwords, verification codes, payment-card details, or sensitive routine information when asking for help.

9. Providers, transfers, and security

Our providers may process information in countries other than where you live. Their applicable transfer arrangements and safeguards are described in their policies. We use the platform’s authentication, access controls, and encrypted connections, but no storage or transmission method can be guaranteed completely secure.

• Supabase privacy policy — authentication, setup, subscriptions, and the AI proxy.
• OpenRouter privacy policy — optional AI routing and model processing.
• Apple privacy policy — Apple sign-in, iCloud, and purchases.
• Google privacy policy — Google sign-in.
• Vercel privacy notice — website hosting.

10. Children and policy changes

Locked In is not directed to children under 13. If you believe a child has provided personal information to us without appropriate permission, contact us so we can investigate and take appropriate action. Applicable age requirements and the App Store rating must also be respected.

We may update this policy when features, providers, or requirements change. We will update the date above and provide additional notice or request consent when required.