Policy
Privacy Policy
This policy explains what personal data LockIn collects when you use the LockIn website and app, why we collect it, who we share it with, and the rights you have. We try to collect only what the service needs.
What we collect
- Account data: your name, email address and profile picture, received from Google when you sign in with Google.
- Habit data: the habits, plans and funds you set up, your daily check-ins and any proof photos you choose to upload.
- Payment and wallet data: the amount you commit, your LockIn wallet balance and transaction history, and the UPI ID you give us for withdrawals. We do not see or store your card or bank credentials; payments are handled by Razorpay.
- Usage and device data: pages and screens viewed, key actions (such as starting a plan or clicking a button), app version, device type and approximate location derived from IP address, collected through PostHog analytics.
- Social data: your username, the people you follow and who follows you, and who invited you or whom you invited.
- Messages you send us, for example by email.
Why we use it
- To run your account, plans, check-ins, wallet and withdrawals.
- To run friends, follows and invites, and to apply grace-day referral rewards.
- To process payments and prevent fraud or misuse.
- To send service messages such as reminders you enable and replies to your requests.
- To understand how the product is used and to fix problems and improve it.
- To meet legal obligations.
Who processes your data
- Supabase: our database, authentication and file storage. Account, habit and wallet data, and proof photos (in Supabase Storage), are stored there.
- Razorpay: payment processing. Razorpay handles your payment details under its own privacy policy.
- Google: sign-in with Google.
- PostHog: product analytics. We use it with autocapture off and record named events only.
- Hosting and infrastructure providers (for example Vercel and our API host) that serve the site and app.
Some of these providers may store or process data outside India. We do not sell your personal data.
Phone numbers and contacts
LockIn does not collect your phone number and does not access your phone contacts. You find friends by username only.
Photos
Proof photos you upload are stored in Supabase Storage and linked to your account. Upload them only if you are comfortable doing so. You can ask us to delete them.
How long we keep it
We keep your data while your account is active and for as long as needed to provide the service, keep financial records and resolve disputes. When you ask us to delete your account we erase or anonymise personal data, except what we must keep by law or for unresolved transactions.
You can delete your account yourself in the app (You sheet, then Delete account) or by email. See how deletion works, what is erased and what is kept:
Your rights under the DPDP Act, 2023
As a data principal you have the right to:
- access a summary of the personal data we hold about you and how it is processed;
- correct inaccurate or incomplete data and update it;
- ask us to erase your personal data, subject to legal retention needs;
- get your grievances addressed, and to nominate another person to exercise these rights if you die or become incapacitated;
- withdraw your consent at any time. Withdrawing consent may mean we can no longer provide parts of the service.
To exercise any right, email support@getlockin.co.in. We will verify it is you and respond within a reasonable time. If you are unhappy with our response you may complain to the Data Protection Board of India once it is operational.
Children
LockIn is meant for adults who can enter a contract. Do not use it if you are under 18.
Security
We use reasonable safeguards such as encrypted connections and access controls. No system is perfectly secure, so we cannot promise absolute security.
Changes and contact
We may update this policy and will change the date above when we do. Questions: support@getlockin.co.in. See also our Grievance page.