Privacy Policy — Lock In

Lock In Privacy Policy

Data controller: Anas Ouatouit Bentahar, trading as Hantronoks.

Effective date: September 10, 2026

Last updated: September 11, 2026

This version replaces the policy dated August 24, 2026. The changes are material: it now describes in-app purchases, push notifications, group chat, the Fiboccoin wallet, and the referral program — features that did not exist in the previous version.

OVERVIEW

Lock In is an Android application that helps you focus, track study or work sessions, review statistics, organize tasks, grow a virtual effort garden, and study alongside friends and groups.

We do not sell personal information, show advertising, or use advertising identifiers or usage-analytics tools. Some features work only on your device; account, synchronization, and social features require data to be sent to our backend.

1. INFORMATION WE PROCESS

Account and profile

Your email address, authentication credentials or tokens, account identifier, display name, username, biography, and optional profile image. You can register with an email address and password, or sign in with Google; in the latter case Google provides what is needed to authenticate you, and Lock In never receives your Google password.

Focus and productivity

The subjects or activities you create, with their title, color, and optional image; accumulated time; the date, start time, end time, and duration of each session; the study and break intervals recorded by the server while a session is active; daily totals; derived statistics; and the trees planted in your effort garden.

Time zone

The time zone you select for your account and for any group you create. It exists so a "study day" starts and ends at the right moment for you, and so a group's leaderboards line up across members in different zones. It indicates a broad region, not your location: we do not use the location permission and do not infer where you are.

Social information

If you use social features: your friendships and requests, study-group membership, group names, descriptions and languages, invitations, avatar style, presence status, current activity, the daily and weekly study totals shown in the social experience, the nudges you send to or receive from friends, the messages you post in a group's chat and on a group's board, and the likes and votes you give.

Store, wallet, and purchases

Your Fiboccoin wallet balance, the ledger of movements of that currency (each with its reason, reference, and date), and the cosmetic items you own.

If you buy a Fiboccoin pack, Google Play processes the payment and we receive and retain the product identifier, the purchase token Google issues, the corresponding coin amount, and the purchase and verification dates. We verify every purchase on our server before delivering coins. We never receive or process your card details or any payment instrument: that stays entirely with Google Play.

Referral program

If you arrive at Lock In through someone's referral link, or enter a referral code by hand, we process that code, the relationship between the referrer and the referred account, and the status of the referral.

When an install comes from a link, Google Play also tells us when the link was clicked and when the install began. Alongside that we store a value derived irreversibly from the identifier Android assigns to Lock In on your device (a one-way hash). These three data points are used solely to detect abuse of the referral program — that is, to stop one device from generating a chain of accounts to claim rewards. They cannot be reversed to recover the original identifier, nor matched against any other app's records.

Device identifiers and notifications

Lock In generates a random installation identifier to coordinate synchronization across your devices and to know which device a notification should reach.

If you accept notifications, we store the notification token issued by Firebase Cloud Messaging, that installation identifier, and the platform. To issue that token, Google's service also generates a Firebase installation identifier and receives technical data about message delivery. This is inherent to how push notifications work, and we do not use it to analyze your behavior.

Technical and security logs

We keep a record of security-relevant events associated with your account (for example, account creation or deletion, or a rejected operation) and rate-limit counters that stop any one account from overwhelming the service; group chat, for instance, allows thirty messages per minute. Our infrastructure providers additionally process basic technical information such as IP address, request time, authentication events, and error logs, as necessary to deliver and protect the service. None of this is used for advertising.

2. DATA THAT STAYS ON YOUR DEVICE

Journal entries, calendar tasks and events, music playlists, playlist covers, and references to the audio files you select are stored only on your device and are not uploaded to our backend. Original audio files are never copied or transmitted.

Android may back up or transfer an app's local data depending on your device, your Google account, the OS version, and your backup settings. That mechanism belongs to Google and you control it from your device settings.

3. HOW WE USE INFORMATION

To create, authenticate, secure, and maintain your account.
To provide focus timers, statistics, synchronization, and the effort garden.
To show your profile and operate friendships, study groups, chat, and boards.
To preserve your information across devices and restore it.
To process invitations and show study presence to the contacts you permit.
To sell, deliver, and verify Fiboccoin packs, and to maintain your wallet and cosmetics.
To run the referral program and prevent its abuse.
To send the notifications you have accepted.
To handle reports, apply blocks, and protect the people who use the app.
To detect abuse, protect accounts, troubleshoot failures, and keep the service reliable.
To comply with the law and defend our rights and the security of the service.

Performance of a contract: creating and maintaining your account, syncing your data, providing social features, and delivering and verifying purchases.
Legitimate interests: keeping the service secure, preventing referral fraud, enforcing rate limits, handling reports, and diagnosing failures.
Consent: push notifications, and access to the images or audio you choose. You can withdraw it at any time from Android settings.
Legal obligation: retaining what the law requires and responding to valid legal process.

We disclose information only as needed for the purposes described here.

Supabase provides authentication, the database, file storage, synchronization, realtime presence, and server functions. It processes data on our behalf and on our instructions.

Google is involved at several points: it authenticates your account if you choose Google sign-in; Google Play processes payments for Fiboccoin packs and confirms whether a purchase is valid; Firebase Cloud Messaging delivers push notifications; Google Play reports the install link where applicable; and Android provides backup services according to your settings.

We may disclose information if reasonably necessary to comply with the law, respond to valid legal process, protect people or the public, investigate abuse, or defend legal rights.

We do not sell or rent personal information, and we do not share it with advertisers or data brokers. Lock In contains no usage-analytics tooling and no advertising identifier.

6. INTERNATIONAL TRANSFERS

Our providers may process information in countries outside the European Economic Area, including the United States. Where that happens, the transfer relies on the mechanisms provided for by European law — principally the Standard Contractual Clauses approved by the European Commission and, where applicable, recognized adequacy frameworks. You may ask us about these safeguards at the contact address.

Lock In shows other people information that you create. What each person sees depends on the feature and the relationship:

Your friends can see your display name, username, biography, avatar, presence status, the title of the activity you are studying, the study totals you permit, and a preview of your effort garden.

Members of your groups see your display name, username, biography, avatar, presence status, and study totals, plus the messages you post in the group's chat and board, and the group's leaderboards. Your activity titles are not shown to group members — only to your friends.

Any user browsing groups can see the name, description, and language of a public group, along with a preview of its members. If you create a public group, that information is visible to people who do not belong to it.

Do not include sensitive information in your display name, biography, activity titles, group descriptions, chat or board messages, or uploaded images.

Group chat messages remain available to the group's members until their author or the group owner deletes them, or until the group ceases to exist. Deleting a message also removes its likes; a reply that quoted it is kept, but loses the quote.

Invitation links are shared through whichever app you choose; that app processes the shared content under its own privacy policy.

8. COMMUNITY SAFETY: REPORTING AND BLOCKING

You can block any user, which stops you both from seeing or contacting each other, and you can review and change your block list.

You can also report a user, giving a reason (spam, harassment, impersonation, inappropriate content, or other) and a description. When you do, we process who reported, who was reported, the group where it happened if applicable, the reason, the description, and the review status. We review reports and may remove content, remove someone from a group, or close an account. A group owner can additionally delete any message in their group's chat and moderate their group's board. You can delete the messages you have posted at any time.

We retain resolved reports for as long as needed to address repeat behavior and to justify the measures taken.

9. DEVICE PERMISSIONS

Internet and network state: accessing your account, synchronizing, loading images, and operating social features.
Notifications: telling you a focus session is still active, and delivering the social notifications you have accepted, such as a friend's nudge.
Display over other apps: showing the focus guard if you leave Lock In during a session.
Foreground service: keeping that guard running while a session is active.
In-app billing: allowing the purchase of Fiboccoin packs through Google Play.
Selected files: letting you choose specific images or audio through Android's system picker.

Lock In does not request location, contacts, microphone, or camera permission, and does not request unrestricted access to your media library.

10. SECURITY

We apply reasonable technical and organizational safeguards: encrypted network connections, authenticated access, per-user data separation, row-level access controls in the database, restricted storage policies, per-account rate limits, server-side purchase verification, and credential handling through established authentication providers. No system is completely secure and we cannot guarantee absolute security.

11. RETENTION AND ACCOUNT DELETION

We retain synchronized data while your account is active and for as long as necessary to provide the service, maintain security, resolve disputes, and meet legal obligations. Local data remains on your device until you remove it, clear the app's data, delete your account, or uninstall the app, subject to Android backup.

To delete your account: open Lock In and go to Settings → Delete account.

This permanently deletes your profile, activities, study sessions, statistics, garden, uploaded images, social relationships, messages, wallet, and cosmetics, together with the account-scoped local data. This cannot be undone. Deletion of your uploaded files runs immediately and, if it fails, an automatic process retries until it completes.

One exception, which we state expressly: the purchase token Google Play issues for each transaction is retained after deletion, unlinked from your account. It is an anti-fraud record that prevents the same purchase from being claimed twice; once unlinked it can no longer identify you.

If you cannot access the app, write to [email protected] to request deletion. Limited information may remain temporarily in protected backups or security logs, or where retention is required by law; in that case it is isolated from ordinary use and deleted or anonymized when no longer needed.

12. YOUR RIGHTS AND CHOICES

In the app you can edit your profile, decide whether to add images, control who sees your presence and your daily and weekly totals, and whether you accept friend requests and group invitations, block and unblock users, report behavior, delete the messages you have posted in a group's chat, manage permissions through Android settings, turn notifications off, sign out, remove local content, and delete your account.

Depending on where you live, you may also have the right to request access, correction, deletion, restriction, objection, or portability of your personal information, and to lodge a complaint with your data-protection authority. In Spain this is the Agencia Española de Protección de Datos (www.aepd.es).

To exercise a right that is not available directly in the app, write to [email protected] with "Lock In Privacy" in the subject line. We may need to verify that the account is yours. Never send us your password. We will respond within one month.

13. CHILDREN'S PRIVACY

Lock In is a general productivity application and is not directed to children below the age at which they may independently consent to online services in their country. We do not knowingly collect personal information from children in violation of applicable law. If you believe a child has provided information without valid authorization, contact us so we can review and delete it where required.

14. CHANGES TO THIS POLICY

We will update this policy when Lock In's features, our providers, or our legal obligations change. The date at the top identifies the current version. Material changes will also be communicated in the app or through another appropriate channel.

15. CONTACT

Anas Ouatouit Bentahar (Hantronoks)

[email protected]

For any privacy question or request, including help deleting your account, write to that address with "Lock In Privacy" in the subject line.