Privacy Policy

Effective date: 8 June 2026 Last updated: 8 August 2026

This Privacy Policy describes how Lockday (“we”, “the app”, “the service”) handles information when you use the Lockday mobile, desktop, or web application.

1. Summary

Lockday is end-to-end encrypted. The content of your tasks (titles, notes, due dates, project names, labels) is encrypted on your device with AES-256 before it leaves your device. We operate the server that synchronizes your encrypted data between your devices, but we cannot read your task content. We do not sell your data. We do not show ads. We do not run analytics on what you write.

2. Information we collect

We collect the minimum information needed to operate the service.

2.1 Account information

  • Username. Used as your account identifier. No email address is collected.
  • Password. Never stored in plain text. Your password is hashed on your device and again on our server with bcrypt before storage. We cannot recover your password.
  • Share code. A random code that lets another Lockday user send you a project invitation. It is not derived from your username, and you control whether your account accepts invitations at all.
  • Passkeys, if you add them. For each passkey we store the credential’s public key and ID, a model identifier for the authenticator it lives on, how it can be reached (USB, internal, and so on), and when it was created and last used. The name you give a passkey is encrypted on your device first, so those names are visible only to you. None of this can be used to sign in as you or to decrypt anything.
  • Last activity month. The calendar month and year in which your account last signed in or synced, and nothing more precise. We record it only so that abandoned accounts can be found and deleted, as described in §6. Storing the month rather than the moment means our records cannot show what days or hours you use the app.

2.2 Encrypted task data

Your task content is encrypted on your device before being sent to our server. The server stores and synchronizes this encrypted data but cannot decrypt it. The server can see:

  • Entity IDs (random identifiers, not derived from content)
  • Timestamps (createdAt, updatedAt)
  • Sync metadata (whether an item is deleted, sync status)
  • Foreign-key relationships (which task belongs to which project)
  • Which preferences you have changed from their defaults. A setting’s name (weekStartDay, for example) is stored in the clear so the server can match an update to the right row. Its value is encrypted on your device like everything else.

The server cannot see:

  • Task titles, notes, or descriptions
  • Due dates or times
  • Project, section, or label names
  • Recurring schedules
  • The values of your settings
  • Any other user-supplied content

Reminders are scheduled by your own device, from data only it can read. The server is never told when anything is due.

Shared projects. For a project you share, the server also stores which accounts are members, what access level each one has, and the invitations between them with their status. This is what it checks before letting a device sync anything in that project. Member names are encrypted, as is everything inside the project. Projects you do not share have no such records.

2.3 File attachments

If you attach a file to a task (a Lockday Pro feature), that file is encrypted on your device before it is uploaded, in the same way as your task content. The file’s name and type are encrypted too, not only its contents. Our storage holds the encrypted data and its size, nothing else. We cannot read the file, its name, or what kind of file it is.

When you delete an attachment, or delete your account, the stored bytes are permanently purged rather than left behind as a soft-deleted copy.

2.4 Subscription and payment information

If you buy Lockday Pro, we store what is needed to grant and maintain your entitlement: which plan you bought, its status and expiry date, and the receipt identifier issued by the app store. For cryptocurrency payments we store the payment record for that transaction, including the deposit address and the observed transaction.

We never see your card details. Payments made through Google Play or the App Store are processed entirely by those stores, and we receive only a receipt that we validate with them. Cryptocurrency payments settle on a public blockchain.

2.5 Push notification token

If you enable notifications, your device registers a push notification endpoint with our server so we can deliver notifications. Depending on your platform, that endpoint lives with Firebase Cloud Messaging (Google Play Android build), with your browser’s push service (web app), or on our own push server (independent Android build). The endpoint itself is opaque; the contents of notifications we send through it are intentionally minimal and contain no task content.

2.6 Feedback submissions

If you choose to send feedback from inside the app (Settings → Send feedback), the information you submit is sent to our server in plaintext (not end-to-end encrypted), because the purpose of the submission is for us to read it. Each submission includes:

  • The text description you wrote.
  • The submission type you chose (bug report or feedback).
  • Optionally, a screenshot you attach. Screenshots may show decrypted task content; you control whether to attach one and which image to attach.
  • Optionally, the most recent hour of in-app log entries. These logs contain operational events (sync status, errors, network failures) and do not contain the content of your tasks.
  • Your account identifier, so we can tie the report to the account that sent it.

Your account carries no email address, so we cannot reply to a submission unless you include a way to reach you.

Feedback submissions are kept on our server, used only to triage bugs and improve the app, and not shared with third parties. A submission is deleted when the account that sent it is deleted.

2.7 Server logs

Our server keeps standard operational logs that may include IP addresses, request timestamps, and HTTP status codes. They are used for debugging and abuse prevention, and are kept for no more than 30 days.

We also use your IP address to limit how many requests it can make in a short time. This is what protects sign-in and sync against password-guessing attacks. Those counters are kept in memory only and are never saved.

2.8 Plausible deniability

If you turn on plausible deniability, your device uploads a backup copy of the decoy keypair. It is encrypted with your real account key, so only a real-mode unlock on one of your own devices can open it. We store it and return it when one of your devices asks for it.

We cannot read it. Its presence does tell us that the feature is enabled on your account, but it reveals nothing about either vault or what is in them.

2.9 Email you send us

Your account has no email address. If you write to support@lockday.net, we hold your message and the address it came from for as long as it takes to deal with your request. If you prefer not to share an address, use the in-app feedback form instead (§2.6).

3. What we do not collect

We do not collect:

  • Your name, email address, phone number, address, or other personal identifiers
  • Your location. No GPS, no location permission, no location API on any platform. Two things imply an approximate location: server logs contain IP addresses (§2.7), and a completed purchase records its tax jurisdiction (§6)
  • Your card or bank details (see §2.4)
  • Your contacts, calendar, or photo library. We never scan your device storage. We receive a file only when you deliberately attach one to a task (§2.3) or to a feedback submission (§2.6)
  • Analytics on which features you use or how you interact with the app
  • Automatic crash reports (we do not integrate any third-party crash-reporting SDK; we only see issues you actively submit via the in-app feedback form described in §2.6)
  • Advertising identifiers

4. How we use information

We use the information we collect to:

  • Authenticate you (username and password, or a passkey)
  • Synchronize your encrypted task data and attachments between your devices
  • Deliver notifications you have enabled
  • Grant and maintain your Lockday Pro entitlement if you buy one
  • Operate, maintain, and secure the service (server logs)

We do not use your information for advertising, profiling, or any purpose unrelated to operating Lockday.

5. How information is shared

We do not sell your data.

We share data only as follows:

  • Push notification provider: When you enable notifications, your push endpoint is used by the underlying push provider (e.g., Firebase Cloud Messaging on Android, Apple Push Notification Service on iOS) to deliver notifications. The provider sees the endpoint and the timing of notifications but not the encrypted content of your tasks.
  • Project collaborators: If you invite another Lockday user to a shared project, they will be able to see the content of tasks within that project (their device will have the decryption key for that project). They cannot see tasks outside the shared project.
  • App stores: If you buy Lockday Pro through Google Play or the App Store, that store processes the payment and we validate the resulting receipt with it. The store sees the purchase; it does not see your task content. Cryptocurrency payments settle on a public blockchain, which is by nature public.
  • Infrastructure providers: The companies that host, route, and store the service necessarily handle the data passing through them. They are named in §11.
  • Legal: We may disclose information if required by valid legal process. Because your task content is end-to-end encrypted, we cannot produce its contents in response to such requests. What we could be compelled to produce is the ciphertext, the metadata listed in §2.2, server logs still inside their retention window, and anything you sent us in plaintext through the feedback form.

6. Data retention and deletion

  • Your account and encrypted task data are retained for as long as your account is active.
  • You can delete your account at any time from within the app (Settings → Account & Data → Delete account), or from the web form at lockday.net/delete-account if you no longer have the app installed. Account deletion removes your encrypted task data, attachments, account record, passkeys, push endpoint, settings, project memberships, any feedback you sent us, and your plausible-deniability key backup if you had one.
  • Attachment bytes are purged outright on deletion rather than retained as a recoverable copy.
  • We keep an anonymous record of completed payments because tax law requires it: the amount, the currency, the date, and the tax jurisdiction. It carries no account reference and no task content, and it is not deleted with your account.
  • Soft-deleted items (tasks you delete from within the app) are retained as encrypted tombstones for 30 days, so that a device that was offline learns about the deletion when it returns, and are then permanently removed.
  • A cryptocurrency payment request that is never completed is deleted 7 days after it was created.
  • Server logs are retained for no more than 30 days.
  • A free account that has not signed in or synced for 12 months is deleted, after we flag it, attempt to notify its devices, and wait at least a further 30 days. Signing in resets the clock, and accounts with a current Pro membership, including lifetime Pro, are exempt. See section 9 of the Terms of Service. Because your data is end-to-end encrypted, this removes the copy held on our servers; anything on your own devices stays there.
  • Sign-in session records are deleted within about a day of expiring, which for a signed-in session means roughly a week after it was created. Once they are gone, all that remains of your sign-in history is the month of your last activity, not the days or times.
  • Our hosting provider takes regular backups of the database, and those backups contain your encrypted content. A deleted account is removed from the live database immediately. It then disappears from the backups as old backups are replaced by newer ones.
  • A cryptocurrency payment is a transaction on a public blockchain. That record is permanent and outside our control, and deleting your account does not affect it.

7. Your rights

Depending on your jurisdiction, you may have rights including:

  • The right to access the data we hold about you
  • The right to correct inaccurate data
  • The right to delete your account and associated data
  • The right to export your data in a machine-readable format

Encryption changes how two of these work in practice. What we hold about you is almost entirely ciphertext we cannot open, so an access request produces that ciphertext and the metadata listed in §2.2, rather than a readable copy of your tasks. And we cannot correct your data on your behalf, because we cannot read it: you correct it in the app, which is where it exists in readable form. An export is likewise produced by your own device.

Account deletion and data export are available from within the app, and account deletion is also available at lockday.net/delete-account. For other requests, email support@lockday.net or reach us through the app (Settings → Send feedback).

8. Security

We use industry-standard practices including TLS for all network traffic, AES-256-GCM for client-side encryption of task content and attachments, Argon2id for deriving your key from your password on your device, hybrid X25519 with ML-KEM-768 for key wrapping (so keys stay protected against future quantum attacks), bcrypt for server-side password hashing, and access-controlled infrastructure. No system is perfectly secure. If we discover a security incident affecting your data, we will publish a notice in the app and on lockday.net.

9. Children

Lockday is not intended for children under 13. Our Terms of Service require you to be at least 13 years old, or older if your country sets a higher minimum age for using online services.

We do not ask for an age, a name, an email address, or any other identifying information (§3), so we cannot tell how old an account holder is and we cannot identify any account as belonging to a child. For the same reason, we cannot act on a report that a particular account belongs to a child, because we can verify neither the report nor the identity of the account holder.

If you are the parent or guardian of a child who uses Lockday, you can delete the account from within the app (Settings → Account & Data → Delete account), or at lockday.net/delete-account with the account’s username and password. Deletion removes the account and its data as described in §6.

10. International users

Our application server and database are in Frankfurt, Germany. Encrypted file attachments are stored with Cloudflare R2, and the push server used by the independent Android build runs on our own rented hardware in the Czech Republic.

Requests to our API do not reach Frankfurt directly. Our hosting provider serves its custom domains through Cloudflare’s network, so your device connects to the Cloudflare location nearest to you, and that is where the secure connection ends. Cloudflare then passes the request on to our server.

This means Cloudflare sees your IP address, the timing and size of your requests, and their contents. Those contents are the same encrypted payloads our own server receives, together with the few things that are not end-to-end encrypted: your username and the password hash your device computes at sign-in, and anything you send through the feedback form (§2.6).

None of this changes the confidentiality of what you write. Your task content is encrypted before it leaves your device and stays that way through every hop, so neither the route nor the destination can read it.

11. Third-party services

These companies handle data on our behalf:

  • Render hosts our application server and database, in their Frankfurt region.
  • Cloudflare provides DNS for lockday.net, hosts this website and the web app, carries the traffic to our API (§10), and stores encrypted file attachments in R2.
  • Firebase Cloud Messaging delivers push notifications on the Google Play Android build. The independent Android build uses our own push server instead, and the web app uses whichever push service your browser provides.
  • Google Play Billing processes in-app purchases on the Google Play Android build.
  • Apple App Store / StoreKit processes in-app purchases on iOS.

The app does not integrate with any analytics, advertising, or tracking services, and there is no third-party crash reporter in any build.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified within the app. The “Last updated” date at the top reflects the most recent revision.

13. Who we are, and how to reach us

Lockday is an independent project rather than a company. “We” throughout this policy means the operator of the service, who can be reached at support@lockday.net, or from inside the app (Settings → Send feedback). If you need our identity in writing for a legal or regulatory request, ask at that address and we will provide it.