Privacy Policy for Locket
1. Your health data stays on your device
When you log periods, symptoms, temperatures, moods, or notes in Locket, all of the following holds. Where this policy says "we cannot," it describes the architecture, not a promise.
- Every entry is encrypted on your device with AES-256-GCM before it is stored.
- The encryption key is 256 random bits generated on your device at first launch and held in the iOS Keychain (or Android Keystore). It is not derived from your biometrics, it never leaves your device in readable form, and it is marked non-migratory — a whole-device backup restored to a different phone cannot carry it along. On Android, Locket goes further: all of its app data is excluded from Google backup and from device-to-device transfer, so none of it is copied off the phone at all.
- Encryption covers the contents of your entries. The database that holds them also records the date of each entry, unencrypted — so someone with direct access to your phone's files could tell that you made an entry on a given day, but not what it says.
- There is no Locket account — nothing to create, and none to delete (to remove your data, see Section 8) — and no server-side copy of your entries. We cannot read, sell, share, or hand over your health data: no readable copy exists outside your device.
- If the encrypted store on your device cannot start, the app refuses to run rather than fall back to storing anything unencrypted.
2. What leaves your device
In this release, the Locket app sends none of your data to Locket's servers. Your entries, and everything computed from them, stay on your phone. One category of technical data does leave: crash reports, engineered to contain no health data (Section 5). Two further capabilities are part of Locket's design and will be described here in full, with a new effective date and notice in the app, before either is turned on:
- Integrity anchoring (not active in this release): when active, the app will send a cryptographic fingerprint (a SHA-256 hash) of your encrypted ledger, in batches after you have added several entries, together with an identifier that contains no personal information, so you can later prove your records were not altered. A hash cannot be reversed into your data and contains no health information, no name, and no contact details.
- One-shot sharing (not built yet): when available, if you choose to share a snapshot with a clinician, the app will encrypt that snapshot on your device under a single-use key and upload only the encrypted copy. The key will travel inside the QR code you physically show the recipient — never sent to our servers, so we cannot decrypt what you share. Sharing will be one snapshot, one time, at your initiation.
Once either is active, our servers will see standard connection data (such as IP address) when your device talks to them; we will not use it to build profiles or combine it with anything else.
3. Apple Health
If you connect Apple Health, Locket requests read-only access to fifteen cycle-related categories: menstrual flow, spotting (intermenstrual bleeding), persistent intermenstrual bleeding, prolonged menstrual periods, irregular menstrual cycles, infrequent menstrual cycles, cervical mucus quality, ovulation test results, progesterone test results, sexual activity, contraceptive use, pregnancy, pregnancy test results, lactation, and basal body temperature. We list all of them here — including the most sensitive — because you should not have to guess. You approve each type individually in the iOS permission sheet, may decline any of them, and can revoke access at any time in iOS Settings → Privacy & Security → Health.
Imported records are processed entirely on your device and encrypted like everything else. We never write to Apple Health. We do not use data obtained through HealthKit — or any health data — for advertising or marketing, and we never disclose it to third parties. Health data is used solely to provide the app's features to you.
This section applies to iPhone only. On Android, Locket does not connect to Health Connect or any other health service.
4. Backups are yours
You can export your ledger as a single encrypted backup file protected by a password you choose. Where you keep that file — your own cloud storage, email, a USB stick — is your decision, and the file is unreadable without your password. We never receive it. Because backups are yours, we also cannot recover them: if you lose both the file's password and your device, we cannot restore your data. On Android this file is the only way to move your data to a new phone: Locket data is not in your Google backup, so export before you change phones.
5. Crash reports
The Locket app includes one piece of third-party diagnostic software: Sentry, our crash-reporting service. If the app crashes or hits a serious error, Sentry receives a report of technical facts: device model, OS and app version, and where in the code the failure happened. We use these reports for one purpose — finding and fixing bugs. Reports are configured to never include your entries, your encryption key, or any health data, and every navigation breadcrumb is discarded before a report is sent — the trail of screens you visited could otherwise imply what you were logging. The same configuration applies on iPhone and Android: crash and error reports only, with no session tracking, performance tracing, or screenshots.
Reports of crashes and freezes in the app's native code also carry a random installation ID that Sentry's software generates on your phone. It is not derived from your device's hardware, your name, or anything you log; it is tied to no account; and it is replaced with a new one if you delete and reinstall the app. Its one use is telling apart one phone that crashes many times from many phones that crash once. Sentry is also configured not to store the IP address your device connects from, so a crash does not tell us your location. Sentry processes these reports as our service provider and may not use them for anything else. In app-store terms, this is crash and diagnostics data plus a device-level ID — and none of it is linked to your identity, because there is no account to link it to.
Beyond that, nothing: the app contains no analytics and no advertising software. It does not track you across other apps or websites, does not read your device's advertising identifier, and will never show Apple's App Tracking Transparency prompt — crash reports are not used to track anyone, so there is nothing to ask permission for. The only other way the app reaches the network today is links you deliberately tap (for example, help articles from Clue or Flo, which open in your browser and are governed by those sites' policies); see Section 2 for the two designed exceptions and their status.
Of Apple's system frameworks, Locket uses HealthKit (read-only, Section 3), the Keychain (key storage, Section 1), and Face ID / Touch ID (the optional app lock). It uses no iCloud sync, no push notifications, no location services, no Sign in with Apple, and no in-app purchases. Separately, if you have enabled "Share With App Developers" in iOS Settings → Privacy & Security → Analytics & Improvements, or install a beta through TestFlight, Apple may also collect crash reports under Apple's own privacy policy and show us the anonymized result. That is an iOS feature you control, not something Locket adds.
On Android, Locket is distributed through Google Play. It uses the Android Keystore (key storage, Section 1) and Android's biometric prompt (the optional fingerprint or face unlock), and it shows reminders as local notifications scheduled on your phone. It uses no Google backup or device transfer (Section 1), no Firebase or other push messaging, no Google analytics or advertising services, no location services, no account sign-in, and no in-app purchases. During the Android beta, Settings → Android beta → Send beta feedback opens your own email app with a message to support@lockethealth.com, pre-filled with your Android version, device model, and app version; nothing is sent until you press send, and nothing from your journal is included. Separately, if you have allowed your phone to share usage and diagnostics data with Google, Google may collect crash data under its own privacy policy and show us aggregate results in Google Play's Android vitals. That is an Android setting you control, not something Locket adds.
6. The website
lockethealth.com is a static site hosted by Vercel. Fonts and every other asset are served from our own domain, and — like any website — Vercel sees your IP address in its standard server logs; we do not use those logs to identify or profile visitors. Three things to know:
- Analytics: we use Plausible Analytics, a privacy-focused service, to count visits to our landing page. It works without cookies or any persistent identifier on your device: we see aggregate numbers — how many visits, from which country, to which page — never individual people, and nothing is used to track you across other sites or shared with anyone. The script loads from our own domain and reports through it, so your browser never talks to Plausible directly. Apart from the host that serves the site, Plausible is the only third party involved in analytics; because it sets no cookies and builds no profile, there is no consent banner to click through.
- Android beta invites: the Android beta is a closed test on Google Play, open only to people on its tester list. If you request an invite, we collect your Google account email for one purpose: adding it to that list. The form stores it, with the time of your request, in private storage Vercel runs for us. We enter it in Google Play Console, so Google receives it under its own privacy policy; no one else gets it, and we never use it for marketing. We may email you to confirm you've been added. You can also request an invite by emailing support@lockethealth.com, which is also where to ask us to remove you from the list and delete your email.
- No accounts here either: the website has no login and no user profiles.
7. How long anything is kept
- Health entries: kept on your device until you delete them or erase the app's data (Section 8). There is no server copy; retention is entirely in your hands.
- Encrypted backups you export: held by you, wherever you put them, for as long as you keep them. We never receive them (Section 4).
- Anchored fingerprints (once anchoring is active, Section 2): permanent by design — an integrity ledger only works if its records cannot be quietly rewritten. They contain no personal or health information.
- Crash reports (Section 5): kept by Sentry for 30 days from the day the report arrives, then deleted automatically.
- Website analytics (Section 6): aggregate page-view statistics only; nothing that identifies you is kept at all.
- Android beta invite emails: kept in our private request storage at Vercel (or our support inbox, if you emailed us) and on the Google Play tester list while the closed beta runs, then deleted from all of them when it ends or when you ask us to remove you, whichever comes first.
- Website server logs: kept by our hosting provider for its standard rolling window, then discarded.
8. Your choices and rights
- Erase everything: Settings → Erase All My Data destroys your encryption key and erases every entry and all your cycle data on the device, then returns you to the first-run screen. A few display preferences survive — theme, temperature unit, whether the app lock is on — and contain no health information. Deleting the app also deletes every entry, since the database lives inside the app. Three things remain, because they are outside the app's reach: (a) any anchored fingerprints already written to the integrity ledger — which contain no personal or health data and cannot identify you; (b) backup files you exported, which only you hold; (c) anything captured in a whole-device backup you made before erasing (such as an iCloud or computer backup of your iPhone), which only you control and can delete through Apple's tools. On Android, Locket's data is excluded from Google backup, so no such copy exists there. Because the encryption key is non-migratory, such a backup restored to a different phone cannot unlock the entries inside it; only a restore to the same phone can.
- Apple Health (iPhone): revoke read access any time in iOS Settings.
- App lock: Face ID / Touch ID on iPhone, or fingerprint or face unlock on Android, is optional and can be turned on or off in Locket's Settings.
- Because we hold no account data and no health data about you, requests to "access the data Locket has about me" will usually have a short answer: at most, what you chose to give us through the website (Section 6), and nothing else. (Crash reports carry no name, email, or account — only the random installation ID described in Section 5, which you have no way to see — so we could not locate yours even on request.)
9. Consumer health data notice
This section serves as our consumer health data privacy policy under Washington's My Health My Data Act, Nevada's SB 370, and similar consumer health data laws.
- Categories collected, and why: menstrual-cycle and related health data — the entries you create in the app and the Apple Health categories you approve (the full list is in Section 3). Collected and processed on your device only, for one purpose: providing the app's features to you. Nothing else.
- Sources: you, and Apple Health if you connect it (iPhone only).
- Sharing and sale: we do not sell consumer health data, and we do not share it. Third parties with whom we share consumer health data: none. Affiliates with whom we share consumer health data: none. We do not possess it in readable form. Our crash-reporting and website-analytics providers (Sections 5 and 6) receive no consumer health data — crash reports are configured to exclude it, and the website never handles it. Sharing with a clinician will happen only when you initiate it, and only in encrypted form we cannot open (Section 2).
- Retention: see Section 7 — on-device until you delete it; no server copy.
- Your rights: to confirm whether we collect or share consumer health data about you, to access it, to withdraw consent, and to have it deleted. Exercise them through the mechanisms in Section 8 or by contacting support@lockethealth.com; we will respond within the time applicable law allows and will not discriminate against you for asking. If you are unsatisfied with our response, you may appeal by replying to our decision; if the appeal fails, you may contact your state attorney general.
- We do not use geofencing around health facilities (we collect no location data at all).
10. Children
Locket is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us an email address, contact us and we will delete it.
11. Where Locket is offered
Locket and this website are directed to people in the United States. If you visit from the EU, UK, or elsewhere, the only personal data we could receive is what you choose to give us through the website, handled as Section 6 describes: used only for the purpose stated there, on the basis of your consent, kept no longer than Section 7 says, and deleted on request. The website's analytics keeps nothing that identifies you (Section 6). If Locket becomes available in your region, this policy will be updated with the disclosures your local law requires before launch there.
12. Security and breach notification
Security measures are described throughout this policy because they are the product: on-device AES-256-GCM encryption, OS-protected key storage, a fail-closed data layer, and servers that hold no readable personal data. In the unlikely event of a breach of data we or our service providers hold (such as crash diagnostics, or anything you gave us through the website) or a security failure affecting the app, we will notify affected people and regulators as applicable law requires, including the FTC Health Breach Notification Rule where it applies.
13. Changes to this policy
We will post changes here with a new effective date. For material changes, we will provide notice in the app, and by email to anyone whose address we hold for a purpose described in Section 6. We will never change what the architecture makes impossible without telling you first — a new version of the app that transmitted different data would say so plainly before you install it.
14. Contact
support@lockethealth.com · Chao-Wei Tsang