Privacy and encryption
No. Everything you write is encrypted on your device before it is sent. Our server stores it but has no key to read it. Only the people you share a project with can read that project. See what the server can see.
There is no password reset. A passkey still signs you in without your password. A backup opens with your password or decryption secret so it does not replace them. If you lose them all, nobody can unlock your data.
A second PIN that opens the app with only the projects you pick. Your real tasks stay hidden. A panic PIN does the same and also wipes your real data from the device. It is for when someone can force you to unlock your phone.
No ads or trackers. This website only counts visits per day with nothing that identifies you, and not at all if your browser sends Do Not Track or Global Privacy Control. Read the privacy policy.
Not yet. How the encryption works is described on our security page, and every direct build ships with a SHA-256 fingerprint, so you can confirm you're running the exact build we published, not a copy that's been tampered with or repackaged. We intend to open the source code as the project becomes sustainable.
Using the app
Yes. Lockday is offline-first. You can create, edit, and complete tasks with no connection. Changes sync automatically when you are back online.
Yes, on both Android and iOS. It shows today's tasks and lets you check them off without opening the app.
Yes. You can invite specific people to a shared project. They get the decryption key for that project only, and can see tasks within it. They cannot see anything outside the shared project.
Accounts and data
No, Lockday works without one. An account adds encrypted sync between your devices and lets you get Pro features. It needs no email or phone number.
Yes. Signing in then needs two of these: your password, a passkey or a code from an authenticator app. Keep the recovery codes you get: we cannot turn it off for you.
From inside the app: Settings → Delete Account. You can also do it from the web at lockday.net/delete-account, without the app installed. Either way it removes your encrypted data, account record, and notification endpoint from the server.
The app keeps working without our server because your data is on your devices. You can also save a full backup at any time.
Downloads and platforms
Android, iOS, desktop (macOS and Linux), and a web app at app.lockday.net that runs in your browser. Your encrypted data stays in sync across all of them when you use an account.
Every direct desktop and Android build shows a SHA-256 fingerprint on the download page. Compute the hash of the file you downloaded and confirm it matches before installing.
Only the Google Play build, for notifications and payments. The APK and Zapstore builds run without Google Play Services.