Privacy policy
The short version. The camera counts reps on your iPhone and never records. Apple keeps your app picks and usage on your device, so we never see which apps you use. We store your account and progress so you don’t lose them, and a username and weekly minutes for the league. The app has no ads and no ad tracking. Our website uses the Meta Pixel to measure our ads, only if you allow it. We never sell your data. You can delete everything from inside the app.
Who we are
Locked Out (“we”, “us”) is an iPhone app and website (lockedoutapp.site) run by an independent developer in India. For anything about your data, email support@lockedoutapp.site. Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), we are the “Data Fiduciary” for the personal data described here.
This policy covers the Locked Out app and our website. It doesn’t cover Apple, Google, Meta or other companies’ own services, which have their own policies.
What we collect in the app
| Data | Why | Where it lives |
|---|---|---|
| Account: name, email, the age you enter (to confirm you’re 18+), and an account ID from Apple or Google if you sign in with them | To create your account and sign you in | Our servers (Supabase) |
| Progress: coin balance and history, minutes earned by workouts, level, bonuses, workout and rep counts | So your progress survives a new phone or a reinstall | Your iPhone and our servers |
| League: your username, level, league and minutes earned this week | To run the weekly leaderboard. Other players can see your username and weekly minutes | Our servers |
| Reports: when you report a username, which account reported which | To remove offensive usernames | Our servers |
| Setup answers: fitness level, commitment, daily limit, workout difficulty | To set workout difficulty and your limit | Your iPhone |
| Purchase status: whether you have a trial, subscription or Lifetime | To unlock the app. Apple tells the app; we don’t receive your payment details | Your iPhone (from Apple) |
| App analytics: which screens and steps you reach (onboarding, sign-up, paywall, setup, workouts, spending, leaderboard), choices like plan, fitness level and daily limit, days since install, plus app version, device model and iOS version | To understand where people get stuck and fix problems | TelemetryDeck, linked to a random ID for this app install (hashed before it’s sent), never your name, email or account |
| Support messages and any diagnostics you choose to send | To help you | Our email inbox |
What we collect on the website
| Data | Why | Where it lives |
|---|---|---|
| Waitlist: your email, how you found us (link, ad or campaign tags such as utm_source), your invite code, the code of whoever invited you, and whether you ticked “send me updates” | To email you about pre-order and launch, to credit friends you invite and give invite rewards, and to send occasional product updates only if you opted in | Our servers (Supabase) |
| Your invite code and the code you arrived with, saved in your browser (local storage) | So your invite link still works when you come back | Your browser only |
| Meta Pixel events: page visits and waitlist signups, with browser and device information, IP address and Meta cookie identifiers | To measure whether our ads work and improve who sees them | Meta, under its own policies |
We don’t send your email address, name or any health or fitness information to Meta. Friends who join with your link see nothing about you; you only see how many people joined with your link.
Ad measurement on our website
Our website (lockedoutapp.site) uses the Meta Pixel, a small piece of code from Meta Platforms. Meta may use cookies, web beacons and similar technologies on our site to collect or receive information and use it to measure our ads and to deliver ads to you, on and off Meta’s apps. Meta may combine this with information it already has about you.
- It only runs if you choose “Allow”. Until then, nothing is sent to Meta.
- Change your choice any time with the Ad tracking link at the bottom of our homepage. Your choice is saved in your browser.
You can also control ads from Meta in your Meta ad preferences (see Meta’s Privacy Policy), and opt out of many companies’ personalised ads at aboutads.info or youronlinechoices.eu.
In the app: Locked Out has no advertising SDKs, no Meta Pixel, and doesn’t track you across other companies’ apps or websites. If that ever changes, we’ll ask for your permission through Apple’s App Tracking Transparency prompt first and update this policy.
What we don’t collect
- Camera images or video. Exercise is checked by Apple’s on-device body-pose detection, frame by frame. Nothing is recorded, stored or uploaded.
- Which apps or websites you use. Apple’s Screen Time keeps your picks as private tokens on your device. We can’t read them, and your usage never leaves your iPhone.
- Your contacts, location, photos or messages.
- Payment details. Purchases are handled entirely by Apple.
How we use it
To run Locked Out: sign you in, keep your progress, run the weekly league, send account emails (confirmation and password reset), run the waitlist and invite rewards, answer support requests, keep the service safe, improve the app, and, on the website with your consent, measure our own ads. We never sell your personal data, and we don’t use app data to show you ads.
Sign in with Google
If you sign in with Google, we receive your name, email address and Google account ID only, and use them only to create and sign in to your Locked Out account. We don’t use Google user data for advertising, don’t sell it, and don’t transfer it to others except the service providers listed below that run the app. Our use of information from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Consent
We process your data with your consent: when you create an account, join the waitlist, tick “send me updates”, or allow ad tracking, and for uses you’d reasonably expect from a service you signed up for. You can withdraw consent at any time: delete your account in the app, click “unsubscribe” in any email or email us, or turn off ad tracking with the Ad tracking link on our homepage. Withdrawing doesn’t affect processing that already happened.
Who we share it with
We share data only with service providers that run Locked Out for us, under their own privacy and security terms:
- Supabase: database and sign-in (servers in Mumbai, India).
- TelemetryDeck: privacy-focused app analytics (Germany); IDs are hashed before they’re sent.
- Apple: Sign in with Apple, Screen Time, in-app purchases, TestFlight.
- Google: Sign in with Google, if you choose it.
- Google Fonts: loads our website’s fonts, so your browser connects to Google when you visit.
- Meta: measures our website ads (Meta Pixel), only on lockedoutapp.site, as described above.
- Resend: sends account and waitlist emails.
- Other players: see your username and weekly minutes on the leaderboard.
We may disclose data if the law requires it. Some of these services process data outside India; we only use providers with appropriate safeguards.
How long we keep it
Account, progress and league data: until you delete your account (weekly league rows older than a year may be removed sooner). Reports: up to 1 year. Waitlist emails: until you unsubscribe or ask us to remove yours, and no more than 12 months after launch unless you have an account. App analytics: up to 2 years, then deleted. Website advertising data: as set by Meta. Support emails: up to 2 years.
Your rights
You can ask to access, correct or erase your personal data, withdraw consent, and nominate someone to act for you. Delete your account any time in Profile → Account → Delete account; this removes your account, progress and league data from our servers. For anything else, email support@lockedoutapp.site. We aim to reply within 7 days and resolve within 30.
Grievances. Our grievance contact is reachable at support@lockedoutapp.site. If you’re not satisfied, you can complain to the Data Protection Board of India.
Children
Locked Out is only for adults aged 18 and over. We don’t knowingly collect personal data from anyone under 18, and we don’t target ads at anyone under 18. If you believe someone under 18 has created an account or joined the waitlist, contact us and we’ll delete it.
Security
Data is encrypted in transit, sign-in sessions are stored in your iPhone’s Keychain, and database access is restricted so each account can only reach its own data. League data is only reachable through server functions that return usernames and minutes, never emails or account IDs.
Changes
If we add other advertising partners (for example Google Ads), we’ll update this policy first. If we change this policy in a meaningful way, we’ll update the date above and tell you in the app, or by email if you’re on the waitlist.