Lock In 100 Privacy Policy
In plain words
- We do not sell your personal information, and we do not share it for targeted advertising. Who we share it with
- Your journal, moods and wellbeing check answers are yours. We use them only to run your experience, never for advertising. How we use it
- Day and task photos are private by default. You choose if friends or circles see them. People you choose
- You can download your data or delete your account anytime in Settings. Your choices and rights
- A small number of providers help run the app (hosting, database, email, payments). Service providers
- Lock In 100 is not for children under 13. Children and teens
This is a guide to help you find things. The full policy below is what applies.
Looking for a refund? Refunds help
Your journal, your moods and your photos are personal. I built Lock In 100 so you could be honest with yourself, and that only works if you can trust where your information goes. This policy explains what we collect, why, who helps us handle it, and the choices you have.
This policy applies to lockin100.com, the installable Lock In 100 web app, our emails, and related services (the "Service"), offered by Constant Creates LLC, a Florida limited liability company ("Lock In 100", "we", "us"), 7901 4th St N, STE 300, St. Petersburg, FL 33702 (registered agent address). For privacy questions or requests, email hello@lockin100.com.
The short version
- We do not sell your personal information, and we do not share it for targeted advertising.
- Your journal, moods and wellbeing check answers are yours. We use them only to run your experience and never for advertising.
- Day and task photos are private by default. You choose if friends or circles see them.
- You can download your data or delete your account anytime in Settings.
- We use a small number of trusted providers to run the app (hosting, database, email, payments), and they may only use your data to provide their service to us.
1. What we collect
Information you give us
| Category | Examples |
|---|---|
| Account details | Email address, username, display name, avatar or profile choices, age confirmation, time zone. |
| Challenge activity | Challenges and packs you pick, daily check-ins, progress, streaks, rest days, XP, levels, items and chests. |
| Journal entries | Anything you write in your journal. |
| Moods and wellbeing | Mood logs and your answers to the optional wellbeing check. This may reveal information about your mental or physical health. |
| Photos | Day photos and task photos you upload, and any information in them (including image metadata such as location, which we [strip on upload / do not strip; decide]). |
| Social activity | Friends, friend requests, circles (up to 4 people), cheers, gifts and gift notes, blocks and reports. |
| Purchases | What you bought, when, price, subscription status, Stars balance and spending. Card details are collected and stored by Stripe, not by us. |
| Waitlist and referrals | Waitlist email, your position, your referral code, who joined using it. |
| Messages to us | Support emails, feedback, refund requests. |
Information collected automatically
- Device and usage data: IP address, browser and device type, operating system, pages and features used, and timestamps, collected through server logs.
- Anonymous usage stats (optional, off by default): only if you turn on Share anonymous usage stats in Settings, our server sends PostHog (US) a short, fixed list of product events, such as finishing a day, starting a pack or making a purchase, with simple values like a day number or a plan name. Each event is linked only to a random account ID. We never send your name, email address, journal entries, moods, photos or anything you type, PostHog does not receive or keep your IP address, and no analytics cookies or tracking scripts run in your browser. Turn it off anytime in Settings and nothing more is sent.
- Error data: crash and error reports, which may include device info and the screen you were on, collected through [Sentry, once added].
- Local storage and cookies: we use your browser's local storage, a service worker and essential cookies to keep you signed in, let the app work offline, and remember your settings. We do not use analytics or advertising cookies.
- Email interactions: whether our emails were delivered and, [if enabled in Resend], opened or clicked.
Information from others
- Friends may send you cheers, gifts or circle invites, or enter your referral code.
- Stripe tells us whether a payment succeeded, and may share limited billing details such as country and postal code for tax.
2. How we use it
| Why we use it | What we use | Legal basis (UK/EU users) |
|---|---|---|
| Create your account and sign you in by magic link or code | Email, account details, device data | Contract |
| Run the challenge: check-ins, streaks, journal, moods, photos, items, chests | Challenge activity, journal, moods, photos | Contract; explicit consent for mood and wellbeing data |
| Social features: friends, circles, cheers, gifts | Social activity, username, content you choose to share | Contract |
| Process purchases, subscriptions, trials, gifts and refunds | Purchase data | Contract; legal obligation (tax and accounting) |
| Send sign-in, receipt and account emails, including the trial reminder and the yearly renewal reminder | Contract | |
| Send waitlist updates, streak-at-risk reminders and, after about 10 days without using the app, one gentle email that your next day is waiting (you can unsubscribe) | Email, activity | Legitimate interests or consent [confirm per country] |
| Run the waitlist and referral program | Waitlist and referral data | Contract; legitimate interests |
| Keep people safe: moderation, block and report, fraud and abuse prevention | Reports, content, account and device data | Legitimate interests; legal obligation |
| Fix bugs and improve the app | Server logs and error data [Sentry, once added]; anonymous usage stats only if you turn them on | Legitimate interests; consent for anonymous usage stats |
| Comply with law and enforce our Terms | Any relevant data | Legal obligation; legitimate interests |
We do not use your journal, moods, wellbeing answers or photos for advertising, and we do not use them to make automated decisions that have legal or similarly significant effects on you.
3. The wellbeing check
The wellbeing check is optional and gentle. It is not a medical or mental health assessment, and nobody at Lock In 100 monitors your answers in real time. If your answers suggest you might be having a hard time, the app shows you support resources such as the 988 Suicide & Crisis Lifeline and The Trevor Project. We do not share your answers with those organizations, and they only know about you if you contact them yourself. [Confirm: whether any answer triggers anything beyond showing resources.]
4. Who we share it with
We share information only as described here:
People you choose
Friends and circle members can see your username, avatar, streak and check-in activity, cheers and anything you choose to share with them, such as task photos. Gift notes are visible to the recipient. Photos are private unless you share them.
Service providers (subprocessors)
These companies help us run Lock In 100 and may only use your information to provide their service to us. This list covers every outside service that receives personal information from Lock In 100. [Confirm a signed data processing agreement with each]
| Provider | What they do | Data involved |
|---|---|---|
| Supabase | Database, sign in and file storage | All account and app data: your email, profile, journal, moods, logs, photos, feedback, purchases and push settings, and the shipping address for a merch order or printed book |
| Vercel | Website and app hosting, scheduled jobs | IP address, device and browser data, request logs, and error logs with emails and tokens removed |
| Resend | Sending emails, and our waitlist contact list | Your email address, the name you chose and the email content (for example receipts, reminders, and a gift note sent to its recipient), plus delivery and bounce data. For the waitlist: email, first name, waitlist position, referral count and link, and signup date. [Confirm whether sign in emails are sent by Supabase through Resend] |
| Stripe [and Stripe Managed Payments, if used] | Payments, subscriptions, tax, fraud prevention [and merchant of record] | Your email, account ID, and purchase and billing data. For a gift: the recipient's name or email, your note and the delivery day. For merch and printed books: the shipping name, address and phone. Stripe collects card details directly; we never see them |
| Notion | Our internal workspace for the waitlist and feedback | Waitlist: email, chosen tracks, where you heard about us, signup date and status. Feedback: your message, its type, the page and device details, a temporary link to any screenshot, and your email only if you said we may contact you |
| PostHog (US) | Product analytics, only for people who turn on anonymous usage stats (off by default) | A fixed list of product events with simple values and a random account ID; no name, email, IP address or content. Sent from our servers, so PostHog never sees your IP address |
| Sentry | Error monitoring | Error messages and technical details, the page path (never the part after a question mark) and the last few pages visited. Emails, tokens and phone numbers are removed first, and Sentry is told not to store IP addresses. [Confirm Sentry is switched on at launch and its data region] |
| Cloudflare Turnstile | Bot checks on the waitlist and sign in forms | IP address and browser and device signals, used only to tell people from bots |
| Cloudflare R2 [when backups are on] | Storage for our encrypted off site backups | Encrypted copies of the database and uploaded photos, kept for up to [90] days. They are encrypted before they leave our systems, so Cloudflare cannot read them |
| Browser push services (for example Google, Mozilla or Apple, depending on your browser) | Delivering push notifications you turn on | A push address for your device and an encrypted message, such as a reminder or that a friend nudged you. The push service can't read the message |
| Printify | Printing and shipping merch [once merch orders open] | For your order: name, email, phone and shipping address. [Orders are not sent to Printify automatically yet; confirm how they are placed before launch] |
| [PRINT PROVIDER, not chosen yet] | Printing and shipping printed books [once printed books open] | Your shipping name and address and the book file you ordered |
Lookups that don't get your personal information. When you search for a recipe, book, show or film, or paste a link, our servers ask TheMealDB, Open Library, TVmaze, Apple (iTunes), YouTube, Spotify or TikTok for public details using only your search words or the link, or fetch the recipe page you pasted. They see our server, not you, and get no account details. If you play an embedded YouTube, Spotify or Apple Podcasts player in your Media log, or a page shows a picture hosted by one of these services, your browser connects to that service directly, and it can see your IP address.
Other situations
- Legal and safety: if required by law or legal process, or if we believe in good faith it is needed to protect someone's safety, prevent fraud, or enforce our Terms. We report child sexual exploitation material to NCMEC as required by law.
- Business changes: if Lock In 100 is involved in a merger, acquisition or sale of assets, your information may transfer to the new owner, who must honor this policy. We will tell you first.
- With your permission: anywhere else, only if you ask us to or agree.
No selling, no targeted ads
We do not sell your personal information and do not "share" it for cross-context behavioral advertising, as those terms are defined under California law. We also honor Global Privacy Control browser signals as an opt-out request.
5. How long we keep it
| Data | How long |
|---|---|
| Account, progress, journal, moods, photos | While your account is open. Deleted within [30] days after you delete your account, and removed from backups within [90] days after that. |
| Individual journal entries or photos you delete | Removed within [30] days, and from backups within [90] days. |
| Purchase and tax records | [7] years, as required for tax and accounting. |
| Waitlist data (if you never create an account) | Until launch plus [12] months, or until you ask us to remove it. |
| Reports, moderation and safety records | Up to [2] years, longer if needed for legal claims. |
| Server logs, error and analytics data | Up to [90 days / 12 months]. |
| Inactive accounts | [Decide, e.g. we may delete accounts inactive for [3] years after emailing you first.] |
6. Your choices and rights
Everyone
- Download my data: in Settings, get a copy of your information.
- Delete your account: in Settings, anytime.
- Edit or delete journal entries, photos and profile details in the app.
- Emails: unsubscribe from waitlist, streak-at-risk and "your day is waiting" emails with the link in each email or in Settings. The "your day is waiting" email is sent at most once a month, never after 45 days without using the app, and never if you have turned reminders off. We will still send sign-in, receipt and important account emails.
- Photos: keep them private or choose who sees them.
- Mood and wellbeing: turn these features off or withdraw your consent anytime in Settings. [Confirm this toggle exists.]
You can also email hello@lockin100.com to ask to access, correct, delete or get a copy of your data, or to object or opt out. We will verify it is you (usually by confirming from your account email) and respond within [30 days, or 45 days for US state law requests], and let you know if we need more time. You will not be treated differently for using your rights. You can use an authorized agent where your law allows.
California residents
California law gives you the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of sale or sharing (we do not sell or share); to limit the use of sensitive personal information (we only use it to provide the Service); and not to be discriminated against for using these rights. The categories we collect are: identifiers; customer records; commercial information; internet or network activity; audio or visual information (photos); inferences about your preferences; and sensitive personal information (account login and mental or physical health information you choose to enter). Sources, purposes and recipients are described above. We do not have actual knowledge of selling or sharing information of anyone under 16.
Other US states
Depending on where you live, you may have similar rights to access, correct, delete, get a copy of your data, and opt out of targeted advertising, sale and profiling. If we deny your request, you can appeal by replying to our decision email, and if you are still unhappy you can contact your state attorney general.
Washington, Nevada and other consumer health data laws
For residents of states with consumer health data laws, please see our [Consumer Health Data Privacy Policy at LINK], which explains how we handle mood, wellbeing and similar information, and your rights to access, delete and withdraw consent.
UK, EU and EEA residents
Under the UK and EU GDPR you have the right to access, correct, delete, restrict or object to processing of your data, to data portability, and to withdraw consent at any time (without affecting processing before withdrawal). You can complain to your local data protection authority, such as the UK Information Commissioner's Office, though we would love the chance to help first. Constant Creates LLC is the controller of your data. [EU REPRESENTATIVE and UK REPRESENTATIVE details, if required under Article 27.]
7. International transfers
Lock In 100 is based in the United States and our providers may process data in the US and other countries. When we transfer personal data from the UK, EU or EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US Data Privacy Framework (and UK Extension) where a provider is certified.
8. Children and teens
Lock In 100 is not for children under 13, and we do not knowingly collect personal information from them. If we learn that someone under 13 has an account, we will delete it. If you are a parent and think your child under 13 is using Lock In 100, email hello@lockin100.com. Teens aged 13 to 17 need a parent or guardian's permission to use the Service, and must be 18 or have a parent's help to buy Stars. [Describe any extra teen protections, e.g. teen accounts are not discoverable by strangers.]
9. Security
We protect your data with measures such as encryption in transit (HTTPS), encryption at rest through our providers, row-level access rules in our database so users can only see what they are allowed to, private storage for photos, and passwordless sign-in. No system is perfectly secure, so please keep your email account safe. If a breach affects your personal information, we will notify you and the authorities as the law requires.
10. Changes to this policy
We will update this policy as the app grows, for example when we add Sentry. We will change the date at the top, and for meaningful changes we will tell you by email or in the app before they take effect. If a change needs your consent, we will ask.
11. Contact us
Constant Creates LLC | 7901 4th St N, STE 300, St. Petersburg, FL 33702 (registered agent address) | hello@lockin100.com
Thank you for trusting me with your 100 days.