Frequently asked questions

No. Everything you write, including task titles, notes, due dates and times, project, section and label names, and recurring schedules, is encrypted on your device with AES-256 before it is sent anywhere. Our server only stores ciphertext plus a little metadata (random IDs, timestamps, sync status, and which item belongs to which project), and we have no key to decrypt it. The one exception is the people you invite to a shared project: they can read that project, since sharing it with them is the point. Everything else stays yours alone.

Because the app is end-to-end encrypted, account recovery is not the same as data recovery. Your data opens only with your secret: your recovery phrase or password without an account, your login password or decryption secret with one, or your passkey. Your backup files open with that same secret, so a backup does not replace it. If you lose it, nobody can decrypt your data, including us, which makes it the one thing to keep safe. Lockday helps you record it during onboarding, and lets you check it any time from Settings.

You can set a decoy PIN that opens an ordinary-looking workspace showing only the projects you choose to expose, while your real tasks stay hidden and encrypted under a separate key. An optional panic PIN opens the decoy workspace and wipes the real data from the device first. It is built for situations where you can be compelled to unlock the phone. The feature is free and available once you set a PIN or biometric unlock.

No ads, no third-party trackers, no analytics on what you write, and no selling of data. We could not sell your content even if we wanted to, since we cannot read it. The only counting we do is anonymous daily totals of visits to this website, with nothing that identifies you, and none at all if your browser sends Do Not Track or Global Privacy Control. The privacy policy has the details.

Not yet. The full encryption design is documented publicly on our security page, and every direct build ships with a SHA-256 fingerprint, so you can confirm you're running the exact build we published, not a copy that's been tampered with or repackaged. We intend to open the source code as the project becomes sustainable.

Yes. Lockday is offline-first. You can create, edit, and complete tasks with no connection. Changes sync automatically when you are back online.

Yes, on both Android and iOS. It shows today's tasks and lets you check them off without opening the app.

Yes. You can invite specific people to a shared project. They get the decryption key for that project only, and can see tasks within it. They cannot see anything outside the shared project.

No. You can use Lockday entirely offline on a single device with no account; an account only adds encrypted sync across your devices. An account is a username plus a password or a passkey, with no password at all if you prefer: we never ask for an email address or a phone number. Without one you can still save a backup whenever you like: one encrypted file with your tasks, projects and labels, which you keep wherever you want and can restore on a new device.

From inside the app: Settings → Delete Account. You can also do it from the web at lockday.net/delete-account, without the app installed. Either way it removes your encrypted data, account record, and notification endpoint from the server.

Your data lives on your device, not only on our servers. Lockday is offline-first, so the app keeps working without us, and you can save a full backup of your data from the app at any time: one file with your tasks, projects, labels and attachments, still encrypted, plus your key protected by your secret. Even if the service went away, everything stored locally stays yours.

Yes. Restore a backup from Settings to bring back items you deleted since it was made, and optionally to revert changes you made since then. Before a revert, Lockday saves the current state on your device so you can undo the revert, for up to 30 days (reverting is not available while plausible deniability is on). Items in a project you share with others are only touched if you choose that project.

Android, iOS, desktop (macOS and Linux), and a web app at app.lockday.net that runs in your browser with nothing to install. Your encrypted data stays in sync across all of them when you use an account.

Every direct desktop and Android build shows a SHA-256 fingerprint on the download page. Compute the hash of the file you downloaded and confirm it matches before installing.

Only the Google Play build of the Android app uses Google services: Firebase for push notifications and Google Play Billing for purchases. The independent Android build (a direct APK, or from Zapstore) drops both, delivering notifications through Lockday's own push server and taking payments in crypto, and runs without Google Play Services. iOS, desktop, and web don't use Google services either; iOS uses Apple's own push.