Locken Privacy Policy

Effective date: October 16, 2026
Last updated: October 27, 2026
Earlier versions: email daanu.focus@gmail.com and we will send you any earlier version.

This Privacy Policy explains how Locken ("we", "us", "our") collects, uses, shares and protects personal information when you use the Locken applications for macOS and Windows (including test and preview builds), the website at https://locken-app.vercel.app, and related services (together, the "Service"). It also explains your rights and how to exercise them.

Who is responsible. Locken is the controller of the personal information described in Section 2. Contact us at daanu.focus@gmail.com.

Locken at a glance

• Your computer first. Your focus history, screen usage, notes, habits, Canvas assignments and AI keys stay on your Mac or PC. We never receive them.
• A small account. Our servers hold only what an account needs: your email, a securely hashed password, your name and profile image, your birth month and year and when you agreed to our Terms (so every computer uses the same age check), and sign-in security settings, plus any feedback you choose to send and a short security record of account changes.
• No selling, no ads, no tracking. We do not sell or "share" personal information, show ads, build advertising profiles, use analytics or tracking tools, or use your data to train AI models.
• You choose the extras. Canvas, AI providers and Google sign-in connect only if you turn them on, and data goes from your computer straight to them.
• Delete anytime. Delete Account (in Settings, on Mac and Windows) removes your account from our servers and erases that account's data from that computer.

1. Information that stays on your computer

The following information is created and stored only on your Mac or PC. It is not sent to us, and we cannot access, read, recover or disclose it. It is protected by your computer's user account and, if you turn it on, disk encryption (FileVault on Mac, BitLocker or Device Encryption on Windows). Where several people use one computer, Locken keeps each account's data separate.

2. Information we collect and process

2.1 Information you give us

• Feedback you choose to send: a star rating and your message, with the app version, linked to your account. Locken asks after a week of use, and again a few days later if you choose "Not now"; "Don't ask again" stops it. You can send more any time from Settings. Only we can read it.
• Account information: email address, password (we never see or store your password in readable form; our authentication provider stores only a secure hash), full name, profile image link, birth month and year, and when you agreed to the Terms of Service and Privacy Policy.
• Sign-in security information: whether you use an authenticator app (two-step verification) and the data needed to verify its codes; one-time codes we email to you.
• Communications: messages you send us, such as support requests, privacy requests and security reports, and our replies. Please don't put sensitive information (such as health details or government ID numbers) in feedback or support messages; we don't need it.

2.2 Information from third parties

• Google sign-in (optional): if you choose "Continue with Google", Google shares your name, email address and profile picture with us, as shown on Google's consent screen.

2.3 Information collected automatically

• Security and service logs: when your app talks to our servers, our infrastructure providers record technical information such as IP address, device and app details, timestamps and request outcomes. We use it to operate the Service, enforce rate limits, detect abuse and investigate security incidents.
• Usage overview for the owner: from the sign-in records our authentication provider keeps (such as the days you signed in, how you signed in, and which app version you use), Locken's owner sees overall usage numbers, such as how many people were active and how many came back, in a private admin view covering up to the last 180 days. It is never shared with anyone, sold or used for advertising.
• Website requests: when you visit our website, our hosting provider processes standard request data (IP address, browser type, pages requested, referring page) to deliver and protect the site. Our website sets no cookies and uses no analytics or advertising tools.

2.4 Information we do not collect

We do not collect your focus history, screen usage, notes, Canvas data, Reminders, Calendar events, AI prompts or AI output, precise location, contacts, photos, files, payment information, biometric information, or government identifiers.

3. Information sent from your computer directly to third parties

Some features send information directly from your computer to another company, at your direction. We do not receive this information. Each company handles it under its own privacy policy.

Our website loads its fonts, scripts and 3D models from our own host and contacts no other company.

AI providers. Your relationship with an AI provider is governed by your own agreement with them, not by ours: they are not our service providers or processors. They may have minimum-age requirements (some require users to be 18 or older), may process data outside your country, and may keep or use what you send them, for example to improve their models, depending on the plan your key is on (free plans often do). Review a provider's terms and privacy policy before adding its key.

4. How we use information, and our legal bases

We use your information only for the purposes in this table. If we ever want to use it for a different, incompatible purpose, we will tell you first and ask for your consent where the law requires. We may also keep and share overall numbers that identify no one (for example, how many people were active in a week); we will not try to re-identify them.

Where we rely on legitimate interests, we have balanced them against your rights and you can object (Section 9). Where we ever rely on consent, you can withdraw it at any time. You need to provide your email and a password (or use Google sign-in) to create an account; without them we cannot provide the Service. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

5. What we do not do

These are binding commitments:

• We do not sell personal information and do not "share" it for cross-context behavioral advertising, as those terms are defined under California law.
• We do not show advertising in the Service and do not use personal information for targeted advertising.
• We do not build profiles about you for any purpose other than providing the Service.
• We do not use analytics, tracking pixels, advertising identifiers or crash-reporting services in the apps or on the website.
• We do not use your information to train artificial-intelligence models, and we do not allow our service providers to do so. This does not cover an AI provider you connect yourself with your own key (Section 3): it is not our service provider, and what it does with the text you send it is set by your agreement with it.
• We do not disclose students' information to anyone for marketing.

6. When we disclose information

We disclose personal information only as follows:

• Service providers (processors) that run the Service for us under written agreements that limit their use of your information to providing services to us:

• Professional advisers such as lawyers, accountants and insurers, where needed to run Locken, under duties of confidentiality.
• Legal requirements: when we believe in good faith that disclosure is required by law, subpoena, court order or other legal process, or is necessary to protect the rights, property or safety of our users, the public or us. Where lawful, we will notify you first.
• Business transfers: in a merger, acquisition, financing or sale of assets, information may transfer to the successor, which must honor this Privacy Policy. We will notify you before your information becomes subject to a different privacy policy.
• With your direction: for example, when you connect a third-party service as described in Section 3.

7. Google user data

If you sign in with Google, Locken's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google sign-in data (name, email, profile picture) only to create and run your Locken account.
• We do not use Google user data for advertising, do not sell it, do not use it to train AI models, and do not allow humans to read it unless you ask us to for support, it is needed for security or legal reasons, or the data has been aggregated and anonymized.

8. How long we keep information

We may keep information longer only where the law requires it or to establish, exercise or defend legal claims, and only for as long as needed.

9. Your rights and choices

9.1 Everyone

• Access and copy: on Mac, use Settings → Download My Data to save a copy of everything Locken keeps about your account (as a JSON file); on any device, ask us what account information we hold.
• Correct: change your name in the app, or ask us to correct anything else.
• Delete: use Delete Account in the app (in Settings, on Mac and Windows), or email daanu.focus@gmail.com. Deleting your account removes it from our servers (your profile and any session records go with it), signs you out of every device, and erases your Locken data on the computer you delete it from. No other company holds Locken data about you that needs deleting: features that send data to a third party (Section 3) do so directly with your own account or key there.
• Turn off features: remove an AI key, unlink Canvas, or withdraw macOS permissions at any time; on Windows, simply don't start a session to stop app closing.
• Opt out of marketing: we send no marketing unless you opt in.

9.2 People in the EEA, the UK and Switzerland

You also have the right to restrict processing, to object to processing based on legitimate interests, to data portability, and to withdraw consent at any time without affecting earlier processing. You may complain to your local data-protection authority (in the UK, the Information Commissioner's Office), although we would appreciate the chance to address your concern first.

9.3 Residents of California and other US states

Depending on where you live, you may have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to obtain a portable copy; and to opt out of the sale or sharing of personal information, targeted advertising and profiling. We do none of those things, so there is nothing to opt out of. We use sensitive personal information (your account log-in and password) only to provide and secure the Service, as permitted by law. We will not discriminate against you for exercising any right. California residents may also request information under California Civil Code §1798.83 ("Shine the Light"); we do not disclose personal information to third parties for their direct-marketing purposes. Nevada residents may email us to ask us not to sell covered information; we do not sell it.

9.4 How to exercise your rights

• Ask: email daanu.focus@gmail.com from the address on your account, or use the in-app controls above.
• Verification: we will confirm your identity before acting, usually by email to your account address or by asking you to sign in. We will not ask for more information than we need.
• Authorized agents: an authorized agent may make a request for you with your signed permission; we may still verify your identity with you directly. Parents and guardians may act for a child.
• Timing: we respond within one month (EEA/UK) or 45 days (US states), and will tell you if we need more time as the law allows.
• Appeals: if we decline your request, reply to our decision with the word "Appeal". We will respond within the period required by your state's law. If you are not satisfied, you may contact your state attorney general.

10. Children and students

Children under 13. The Service is not directed to children under 13, and we do not knowingly collect personal information from them. Locken asks for your birth month and year when you sign up (and the first time you sign in on a new computer) and does not allow anyone under 13 to create an account or use the app. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete it promptly. Parents or guardians who believe their child has given us information can contact daanu.focus@gmail.com to have it reviewed and deleted.

Teen users (13–17). Users under the age of majority need a parent or guardian's permission to use the Service. For everyone, and especially for teens, Locken works privately by default: optional data-sharing features are off until you turn them on, and we never profile users, show ads or share personal information for marketing. AI features are available only to users 18 and older, because the AI providers' terms require it.

Student data commitments. Locken is offered directly to students, not through schools. When students use Locken for school, we commit that we will:

• use student information only to provide the Service;
• never sell student information or use it for targeted advertising;
• never build a profile of a student for any non-educational purpose;
• keep Canvas assignment data on the student's computer, not on our servers;
• protect student information with reasonable security (Section 11); and
• delete a student's information at the request of the student, a parent or guardian, or the student's school.

We do not receive education records from schools. If a school or district wishes to use Locken, we will enter a written agreement that meets applicable student-privacy laws (for example FERPA and state student-privacy laws) before receiving any records.

11. Security

We protect your information with measures that include: encryption of all network traffic; storage of tokens and keys in the macOS Keychain or Windows Credential Manager; server-side access rules that let each account reach only its own data; optional two-step verification with an authenticator app and an emailed code for each new sign-in; breached-password checks; rate limiting; and cryptographically signed app updates. Our Security & Data Protection Policy describes these measures, our known limitations and how we respond to incidents. No system is perfectly secure, and we cannot guarantee absolute security.

If a security breach affects your personal information, we will notify you and the relevant authorities as required by law and as described in that policy.

12. International transfers

We are based in the United States, and our account servers are located in the United States. If you use the Service from another country, your account information will be transferred to and processed in the United States, where data-protection law may differ from yours. When we transfer personal information from the EEA, the UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (with the UK Addendum), or a provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, where available. You may request a copy of the relevant safeguards at daanu.focus@gmail.com. Transfers you direct to third-party services (Section 3) are governed by those services' terms.

13. Do Not Track and Global Privacy Control

We do not track you across other websites or apps, and we do not allow third parties to do so through the Service. Because there is no such tracking, our website and apps do not change their behavior in response to browser "Do Not Track" signals. We treat a Global Privacy Control (GPC) signal as a valid request to opt out of sale and sharing; since we do neither, no further action is required.

14. Changes to this Privacy Policy

We will post any changes here with a new "Last updated" date. If a change is material, for example a new category of information or a new type of recipient, we will notify you by email or in the app before it takes effect and, where the law requires, ask for your consent.

15. Contact us

Locken Privacy questions and requests: daanu.focus@gmail.com Security reports: daanu.focus@gmail.com

Appendix: California notice at collection and categories

In the past 12 months we have collected the following categories of personal information, as defined by the California Consumer Privacy Act:

We do not collect precise geolocation, biometric information, financial information, education records or inferences about you. Retention periods are listed in Section 8.