Privacy Policy

Effective date: 8 June 2026 Last updated: 21 October 2026

This Privacy Policy describes how Lockday (“we”, “the app”, “the service”) handles information when you use the Lockday mobile, desktop, or web application.

1. Summary

Lockday is end-to-end encrypted. The content of your tasks (titles, notes, due dates, project names, labels) is encrypted on your device with AES-256 before it leaves your device. We operate the server that synchronizes your encrypted data between your devices, but we cannot read your task content. We do not sell your data. We do not show ads. We do not run analytics on what you write.

2. Information we collect

We collect the minimum information needed to operate the service.

2.1 Account information

  • Username. Used as your account identifier. No email address is collected.
  • Password. Never stored in plain text. Your password is hashed on your device and again on our server with bcrypt before storage. We cannot recover your password.
  • Share code. A random code that lets another Lockday user send you a project invitation. It is not derived from your username, and you control whether your account accepts invitations at all.
  • Passkeys, if you add them. For each passkey we store the credential’s public key and ID, a model identifier for the authenticator it lives on, how it can be reached (USB, internal, and so on), and when it was created and last used. The name you give a passkey is encrypted on your device first, so those names are visible only to you. None of this can be used to sign in as you or to decrypt anything.
  • Two-factor authentication, if you turn it on. If you add an authenticator app, we store the secret your app shares with us to make its codes. It is encrypted on our server with a key kept apart from the database, but it is not end-to-end encrypted: our server has to read it to check a code. We also keep which 30-second window the last accepted code belonged to, because that is what stops the same code from being used twice. We store your recovery codes only as one-way hashes, so they cannot be read back from our records, and for each one only whether it has been used, not when. We record the day you turned two-factor authentication on and the day you added the authenticator app, never the time. When someone enters your password correctly but fails the second step, we record the day it happened (never the time) and the day we last told you about it, so the app can show you a notice. We keep a count of wrong codes in a row, and after 5 of them, the time a 5-minute pause ends. While you are setting it up, a new authenticator secret or a new set of recovery codes is kept for up to 15 minutes before it is saved or discarded. None of this can decrypt your data.
  • Last activity month. The calendar month and year in which your account last signed in or synced, and nothing more precise. We record it only so that abandoned accounts can be found and deleted, as described in §6. This record holds the month, not the days or hours you use the app. A few other records hold a time, each for its own reason: when each passkey was last used (above), your current sign-in sessions (§6), and, if you use an authenticator app, the 30-second window of the last code it accepted.

2.2 Encrypted task data

Your task content is encrypted on your device before being sent to our server. The server stores and synchronizes this encrypted data but cannot decrypt it. The server can see:

  • Entity IDs (random identifiers, not derived from content)
  • Timestamps (createdAt, updatedAt)
  • Sync metadata (whether an item is deleted, sync status)
  • Foreign-key relationships (which task belongs to which project)
  • Which preferences you have changed from their defaults. A setting’s name (weekStartDay, for example) is stored in the clear so the server can match an update to the right row. Its value is encrypted on your device like everything else.

The server cannot see:

  • Task titles, notes, or descriptions
  • Due dates or times
  • Project, section, or label names
  • Recurring schedules
  • The values of your settings
  • Any other user-supplied content

Reminders are scheduled by your own device, from data only it can read. The server is never told when anything is due.

Shared projects. For a project you share, the server also stores which accounts are members, what access level each one has, and the invitations between them with their status. This is what it checks before letting a device sync anything in that project. Member names are encrypted, as is everything inside the project. Projects you do not share have no such records.

2.3 File attachments

If you attach a file to a task (a Lockday Pro feature), that file is encrypted on your device before it is uploaded, in the same way as your task content. The file’s name and type are encrypted too, not only its contents. Our storage holds the encrypted data and its size, nothing else. We cannot read the file, its name, or what kind of file it is.

When you delete an attachment, or delete your account, the stored bytes are permanently purged rather than left behind as a soft-deleted copy.

2.4 Subscription and payment information

If you buy Lockday Pro, we store what is needed to grant and maintain your entitlement: which plan you bought, its status and expiry date, and the identifier of the purchase: the receipt identifier issued by the app store, or, for a card payment, the identifier Polar gives the subscription or order. For cryptocurrency payments we store the payment record for that transaction, including the deposit address and the observed transaction.

We never see your card details. Payments made through Google Play or the App Store are processed entirely by those stores, and we receive only a receipt that we validate with them. Card payments, on the versions of Lockday distributed outside the app stores, are taken by Polar (polar.sh), the merchant of record, on Polar’s own page in your browser. You type your card details and your email address there, and we never receive your card details. When Polar tells us about a payment, its message can include your email address and other details Polar holds about the purchase; we do not store or log them. While a card payment is open we also keep Polar’s identifier of the checkout, the plan, the link to its page and when it expires, so that another launch or device can continue the same payment instead of opening a second one; that record is deleted a week after the checkout is closed or has expired (§6). Cryptocurrency payments settle on a public blockchain.

Every purchase names your account by a randomly generated identifier. To tell us whose purchase it is, the app gives the App Store or Google Play, and we give Polar, a randomly generated identifier for your Lockday account. It is not your username, and nothing about you can be read from it. We never send your username or an email address.

2.5 Push notification token

If you enable notifications, your device registers a push notification endpoint with our server so we can deliver notifications. Depending on your platform, that endpoint lives with Firebase Cloud Messaging (Google Play Android build), with your browser’s push service (web app), or on our own push server (independent Android build). The endpoint itself is opaque; the contents of notifications we send through it are intentionally minimal and contain no task content.

2.6 Feedback submissions

If you choose to send feedback from inside the app (More → Send feedback), the information you submit is sent to our server in plaintext (not end-to-end encrypted), because the purpose of the submission is for us to read it. Each submission includes:

  • The text description you wrote.
  • The submission type you chose (bug report or feedback).
  • Optionally, a screenshot you attach. Screenshots may show decrypted task content; you control whether to attach one and which image to attach.
  • Optionally, the most recent hour of in-app log entries. These logs contain operational events (sync status, errors, network failures) and do not contain the content of your tasks.
  • Your account identifier, so we can tie the report to the account that sent it.

Your account carries no email address, so we cannot reply to a submission unless you include a way to reach you.

Feedback submissions are kept on our server, used only to triage bugs and improve the app, and not shared with third parties. A submission is deleted when the account that sent it is deleted.

2.7 Server logs

Our server keeps standard operational logs that may include IP addresses, request timestamps, and HTTP status codes. They are used for debugging and abuse prevention, and are kept for no more than 30 days.

We also use your IP address to limit how many requests it can make in a short time. This is what protects sign-in and sync against password-guessing attacks. Those counters are kept in memory only and are never saved.

2.8 Plausible deniability

If you turn on plausible deniability, your device uploads a backup copy of the decoy keypair. It is encrypted with your real account key, so only a real-mode unlock on one of your own devices can open it. We store it and return it when one of your devices asks for it.

We cannot read it. Its presence does tell us that the feature is enabled on your account, but it reveals nothing about either vault or what is in them.

2.9 Email you send us

Your account has no email address. If you write to [email protected], we hold your message and the address it came from for as long as it takes to deal with your request. If you prefer not to share an address, use the in-app feedback form instead (§2.6).

2.10 Website statistics

When you visit lockday.net, we count visits in a way that cannot be traced back to you. Our own server keeps daily totals of the pages viewed, the visits (the first page you see after loading the site), the clicks on the buttons of the download page and of the Free and Pro pricing cards, the questions opened on the FAQ page, and the downloads of Lockday builds from the download page. Each total is a number against a date and a page. If you open an address on lockday.net that does not exist, that address is counted in place of a page: only its path, such as /pricingg, never anything after a ? or #. For a visit it is also kept against a source: either a short tag from a link that carried one (such as ?src=newsletter), or only the name of the website you came from, for example news.ycombinator.com, never the page you were on or any other part of its address. If you arrived directly, there is no source.

We do not store your IP address, details of your browser or device, a cookie, or any identifier with these totals, and nothing is stored on your device to produce them. We cannot tell one visitor from another, and we cannot see what any one person did. We respect the Global Privacy Control and Do Not Track settings of your browser: if it sends either, nothing is counted for you at all.

The totals are kept indefinitely, because they hold no personal information. The request that carries a count is an ordinary request to our server, so it appears in the server logs like any other (§2.7).

2.11 App version counts

Each request from the app names its version and system, such as Android or macOS. Our server keeps a daily total of requests for each version and system, with no account, IP address or other identifier. We delete these totals after 90 days.

3. What we do not collect

We do not collect:

  • Your name, email address, phone number, address, or other personal identifiers. If you pay by card, you give your email address to Polar on its page, not to us (§2.4)
  • Your location. No GPS, no location permission, no location API on any platform. Two things imply an approximate location: server logs contain IP addresses (§2.7), and a completed purchase records its tax jurisdiction (§6)
  • Your card or bank details (see §2.4)
  • Your contacts, calendar, or photo library. We never scan your device storage. We receive a file only when you deliberately attach one to a task (§2.3) or to a feedback submission (§2.6)
  • Analytics on which features you use or how you interact with the app. The only counting we do is the anonymous totals in §2.10 and §2.11
  • Automatic crash reports (we do not integrate any third-party crash-reporting SDK; we only see issues you actively submit via the in-app feedback form described in §2.6)
  • Advertising identifiers

4. How we use information

We use the information we collect to:

  • Authenticate you (username and password, or a passkey, and with two-factor authentication a code from your authenticator app or a recovery code)
  • Synchronize your encrypted task data and attachments between your devices
  • Deliver notifications you have enabled
  • Grant and maintain your Lockday Pro entitlement if you buy one
  • Operate, maintain, and secure the service (server logs)

We do not use your information for advertising, profiling, or any purpose unrelated to operating Lockday.

5. How information is shared

We do not sell your data.

We share data only as follows:

  • Push notification provider: When you enable notifications, your push endpoint is used by the underlying push provider (e.g., Firebase Cloud Messaging on Android, Apple Push Notification Service on iOS) to deliver notifications. The provider sees the endpoint and the timing of notifications but not the encrypted content of your tasks.
  • Project collaborators: If you invite another Lockday user to a shared project, they will be able to see the content of tasks within that project (their device will have the decryption key for that project). They cannot see tasks outside the shared project.
  • App stores: If you buy Lockday Pro through Google Play or the App Store, that store processes the payment and we validate the resulting receipt with it. The store sees the purchase and the randomly generated identifier for your account described in §2.4; it does not see your username or your task content. Cryptocurrency payments settle on a public blockchain, which is by nature public.
  • Polar (card payments): If you pay by card on a version of Lockday distributed outside the app stores, Polar is the merchant of record: it takes the payment, handles tax, sends your receipt, and processes refunds. Polar receives the randomly generated identifier of your Lockday account, the plan you chose, and what you type on its page, including your email address and card details. Polar also sees your IP address and browser, as any site you pay on does. It uses all of this under its own privacy policy and keeps its own records of the purchase, as the law requires of a seller. It does not receive your username, your task content, or anything else from the app.
  • Infrastructure providers: The companies that host, route, and store the service necessarily handle the data passing through them. They are named in §11.
  • Legal: We may disclose information if required by valid legal process. Because your task content is end-to-end encrypted, we cannot produce its contents in response to such requests. What we could be compelled to produce is the ciphertext, the metadata listed in §2.2, server logs still inside their retention window, and anything you sent us in plaintext through the feedback form.

6. Data retention and deletion

  • Your account and encrypted task data are retained for as long as your account is active.
  • You can delete your account at any time from within the app (Settings → Account → Delete account), or from the web form at lockday.net/delete-account if you no longer have the app installed. Account deletion removes your encrypted task data, attachments, account record, passkeys, two-factor authentication secret and recovery codes, push endpoint, settings, project memberships, any feedback you sent us, and your plausible-deniability key backup if you had one.
  • Attachment bytes are purged outright on deletion rather than retained as a recoverable copy.
  • We keep an anonymous record of completed payments because tax law requires it: the amount, the currency, the date, and the tax jurisdiction. It carries no account reference and no task content, and it is not deleted with your account. Card payments are not in it: Polar, as merchant of record, keeps the tax records of those.
  • If you have a card subscription when you delete your account, we ask Polar to cancel it so you are not charged again. Polar keeps its own record of your purchases, including the email address you gave it, for as long as the law requires it to, and that record is outside our control. If Polar cannot be reached at that moment, your account is still deleted and we keep retrying the cancellation until Polar confirms it, keeping only Polar’s identifier of the subscription and no reference to you.
  • Soft-deleted items (tasks you delete from within the app) are retained as encrypted tombstones for 30 days, so that a device that was offline learns about the deletion when it returns, and are then permanently removed.
  • A cryptocurrency payment request that is never completed is deleted 7 days after it was created.
  • The record of an open card checkout (§2.4) is deleted 7 days after the checkout is closed, whether because the payment went through, you started over, or it expired.
  • Server logs are retained for no more than 30 days.
  • The website’s anonymous daily totals (§2.10) are kept indefinitely. They hold no personal information, so there is nothing in them to delete with an account.
  • App version totals (§2.11) are deleted after 90 days.
  • A free account that has not signed in or synced for 12 months is deleted, after we flag it, attempt to notify its devices, and wait at least a further 30 days. Signing in resets the clock, and accounts with a current Pro membership, including lifetime Pro, are exempt. See section 9 of the Terms of Service. Because your data is end-to-end encrypted, this removes the copy held on our servers; anything on your own devices stays there.
  • Sign-in session records are deleted within about a day of expiring, which for a signed-in session means roughly a week after it was created. Once they are gone, what remains of your sign-in history is the month of your last activity, when each of your passkeys was last used, and, if you use an authenticator app, the 30-second window of the last code it accepted.
  • Our hosting provider takes regular backups of the database, and those backups contain your encrypted content. A deleted account is removed from the live database immediately. It then disappears from the backups as old backups are replaced by newer ones.
  • A cryptocurrency payment is a transaction on a public blockchain. That record is permanent and outside our control, and deleting your account does not affect it.

7. Your rights

Depending on your jurisdiction, you may have rights including:

  • The right to access the data we hold about you
  • The right to correct inaccurate data
  • The right to delete your account and associated data
  • The right to export your data in a machine-readable format

Encryption changes how two of these work in practice. What we hold about you is almost entirely ciphertext we cannot open, so an access request produces that ciphertext and the metadata listed in §2.2, rather than a readable copy of your tasks. And we cannot correct your data on your behalf, because we cannot read it: you correct it in the app, which is where it exists in readable form. An export is likewise produced by your own device.

Account deletion and data export are available from within the app, and account deletion is also available at lockday.net/delete-account. For other requests, email [email protected] or reach us through the app (More → Send feedback).

8. Security

We use industry-standard practices including TLS for all network traffic, AES-256-GCM for client-side encryption of task content and attachments, Argon2id for deriving your key from your password on your device, hybrid X25519 with ML-KEM-768 for key wrapping (so keys stay protected against future quantum attacks), bcrypt for server-side password hashing, and access-controlled infrastructure. No system is perfectly secure. If we discover a security incident affecting your data, we will publish a notice in the app and on lockday.net.

9. Children

Lockday is not intended for children under 13. Our Terms of Service require you to be at least 13 years old, or older if your country sets a higher minimum age for using online services.

We do not ask for an age, a name, an email address, or any other identifying information (§3), so we cannot tell how old an account holder is and we cannot identify any account as belonging to a child. For the same reason, we cannot act on a report that a particular account belongs to a child, because we can verify neither the report nor the identity of the account holder.

If you are the parent or guardian of a child who uses Lockday, you can delete the account from within the app (Settings → Account → Delete account), or at lockday.net/delete-account with the account’s username and password, and a code if the account uses two-factor authentication. Deletion removes the account and its data as described in §6.

10. International users

Our application server and database are in Frankfurt, Germany. Encrypted file attachments are stored with Cloudflare R2, and the push server used by the independent Android build runs on our own rented hardware in the Czech Republic.

Requests to our API do not reach Frankfurt directly. Our hosting provider serves its custom domains through Cloudflare’s network, so your device connects to the Cloudflare location nearest to you, and that is where the secure connection ends. Cloudflare then passes the request on to our server.

This means Cloudflare sees your IP address, the timing and size of your requests, and their contents. Those contents are the same encrypted payloads our own server receives, together with the few things that are not end-to-end encrypted: your username, the password hash your device computes at sign-in, and anything you send through the feedback form (§2.6). With two-factor authentication it also sees every code you enter at sign-in or to confirm a change, the authenticator secret while you set up the app, and your recovery codes when they are shown to you.

The notifications Polar sends us about a card payment reach our API the same way, so Cloudflare sees those too, with whatever they carry (§2.4).

None of this changes the confidentiality of what you write. Your task content is encrypted before it leaves your device and stays that way through every hop, so neither the route nor the destination can read it.

11. Third-party services

These companies handle data on our behalf:

  • Render hosts our application server and database, in their Frankfurt region.
  • Cloudflare provides DNS for lockday.net, hosts this website and the web app, carries the traffic to our API (§10), and stores encrypted file attachments in R2.
  • Firebase Cloud Messaging delivers push notifications on the Google Play Android build. The independent Android build uses our own push server instead, and the web app uses whichever push service your browser provides.
  • Google Play Billing processes in-app purchases on the Google Play Android build.
  • Apple App Store / StoreKit processes in-app purchases on iOS.

Polar is not on that list because it does not act on our behalf. For card payments on the versions of Lockday distributed outside the app stores it is the merchant of record: the seller, which takes the payment and answers for it under its own privacy policy (§2.4, §5).

The app does not integrate with any analytics, advertising, or tracking services, and there is no third-party crash reporter in any build.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified within the app. The “Last updated” date at the top reflects the most recent revision.

13. Who we are, and how to reach us

Lockday is an independent project rather than a company. “We” throughout this policy means the operator of the service, who can be reached at [email protected], or from inside the app (More → Send feedback). If you need our identity in writing for a legal or regulatory request, ask at that address and we will provide it.