Frequently asked questions

No. Everything you write, including task titles, notes, due dates and times, project, section and label names, and recurring schedules, is encrypted on your device with AES-256 before it is sent anywhere. Our server only stores ciphertext plus a little metadata (random IDs, timestamps, sync status, and which item belongs to which project), and we have no key to decrypt it. The one exception is the people you invite to a shared project: they can read that project, since sharing it with them is the point. Everything else stays yours alone.

Because the app is end-to-end encrypted, account recovery is not the same as data recovery. If you lose your secret and have no key backup, your data cannot be decrypted by anyone, including us. Lockday helps you record a recovery phrase and save a key backup during onboarding so this does not happen.

You can set a decoy PIN that opens an ordinary-looking workspace showing only the projects you choose to expose, while your real tasks stay hidden and encrypted under a separate key. An optional panic PIN opens the decoy workspace and wipes the real data from the device first. It is built for situations where you can be compelled to unlock the phone. The feature is free and available once you set a PIN or biometric unlock.

No ads, no third-party trackers, no analytics on what you write, and no selling of data. We could not sell your content even if we wanted to, since we cannot read it.

Not yet. The full encryption design is documented publicly on our security page, and every direct build ships with a SHA-256 fingerprint, so you can confirm you're running the exact build we published, not a copy that's been tampered with or repackaged. We intend to open the source code as the project becomes sustainable.

Yes. Lockday is offline-first. You can create, edit, and complete tasks with no connection. Changes sync automatically when you are back online.

Yes, on both Android and iOS. It shows today's tasks and lets you check them off without opening the app.

Yes. You can invite specific people to a shared project. They get the decryption key for that project only, and can see tasks within it. They cannot see anything outside the shared project.

No. You can use Lockday entirely offline on a single device with no account; an account only adds encrypted sync across your devices. On Android and desktop you can also export your own database backup and manage it yourself, including syncing it between devices with a tool like SyncThing.

From inside the app: Settings → Delete Account. You can also do it from the web at lockday.net/delete-account, without the app installed. Either way it removes your encrypted data, account record, and notification endpoint from the server.

Your data lives on your device, not only on our servers. Lockday is offline-first, so the app keeps working without us, and you can export a full backup of your data from the app at any time. Even if the service went away, everything stored locally stays yours.

Android, iOS, desktop (macOS and Linux), and a web app at app.lockday.net that runs in your browser with nothing to install. Your encrypted data stays in sync across all of them when you use an account.

Every direct desktop and Android build shows a SHA-256 fingerprint on the download page. Compute the hash of the file you downloaded and confirm it matches before installing.

Only the Google Play build of the Android app uses Google services: Firebase for push notifications and Google Play Billing for purchases. The independent Android build (a direct APK, with Zapstore coming soon) drops both, delivering notifications through Lockday's own push server and taking payments in crypto, and runs without Google Play Services. iOS, desktop, and web don't use Google services either; iOS uses Apple's own push.