Privacy Policy for Locket

Effective date: August 8, 2026 · Chao-Wei Tsang · support@lockethealth.com

1. Your health data stays on your device

When you log periods, symptoms, temperatures, moods, or notes in Locket, all of the following holds. Where this policy says "we cannot," it describes the architecture, not a promise.

• Every entry is encrypted on your device with AES-256-GCM before it is stored.
• The encryption key is 256 random bits generated on your device at first launch and held in the iOS Keychain (or Android Keystore). It is not derived from your biometrics, it never leaves your device in readable form, and it is marked non-migratory — a whole-device backup restored to a different phone cannot carry it along.
• Encryption covers the contents of your entries. The database that holds them also records the date of each entry, unencrypted — so someone with direct access to your phone's files could tell that you made an entry on a given day, but not what it says.
• There is no Locket account — nothing to create, and none to delete (to remove your data, see Section 8) — and no server-side copy of your entries. We cannot read, sell, share, or hand over your health data: no readable copy exists outside your device.
• If the encrypted store on your device cannot start, the app refuses to run rather than fall back to storing anything unencrypted.

2. What leaves your device

In this release, the Locket app sends none of your data to Locket's servers. Your entries, and everything computed from them, stay on your phone. One category of technical data does leave: crash reports, engineered to contain no health data (Section 5). Two further capabilities are part of Locket's design and will be described here in full, with a new effective date and notice in the app, before either is turned on:

• Integrity anchoring (not active in this release): when active, the app will send a cryptographic fingerprint (a SHA-256 hash) of your encrypted ledger, in batches after you have added several entries, together with an identifier that contains no personal information, so you can later prove your records were not altered. A hash cannot be reversed into your data and contains no health information, no name, and no contact details.
• One-shot sharing (not built yet): when available, if you choose to share a snapshot with a clinician, the app will encrypt that snapshot on your device under a single-use key and upload only the encrypted copy. The key will travel inside the QR code you physically show the recipient — never sent to our servers, so we cannot decrypt what you share. Sharing will be one snapshot, one time, at your initiation.

Once either is active, our servers will see standard connection data (such as IP address) when your device talks to them; we will not use it to build profiles or combine it with anything else.

3. Apple Health

If you connect Apple Health, Locket requests read-only access to fifteen cycle-related categories: menstrual flow, spotting (intermenstrual bleeding), persistent intermenstrual bleeding, prolonged menstrual periods, irregular menstrual cycles, infrequent menstrual cycles, cervical mucus quality, ovulation test results, progesterone test results, sexual activity, contraceptive use, pregnancy, pregnancy test results, lactation, and basal body temperature. We list all of them here — including the most sensitive — because you should not have to guess. You approve each type individually in the iOS permission sheet, may decline any of them, and can revoke access at any time in iOS Settings → Privacy & Security → Health.

Imported records are processed entirely on your device and encrypted like everything else. We never write to Apple Health. We do not use data obtained through HealthKit — or any health data — for advertising or marketing, and we never disclose it to third parties. Health data is used solely to provide the app's features to you.

4. Backups are yours

You can export your ledger as a single encrypted backup file protected by a password you choose. Where you keep that file — your own cloud storage, email, a USB stick — is your decision, and the file is unreadable without your password. We never receive it. Because backups are yours, we also cannot recover them: if you lose both the file's password and your device, we cannot restore your data.

5. Crash reports

The Locket app includes one piece of third-party diagnostic software: Sentry, our crash-reporting service. If the app crashes or hits a serious error, Sentry receives a report of technical facts: device model, OS and app version, and where in the code the failure happened. We use these reports for one purpose — finding and fixing bugs. Reports are configured to never include your entries, your encryption key, or any health data. The app strips rather than gathers: no user identifier is attached, and every navigation breadcrumb is discarded before a report is sent — the trail of screens you visited could otherwise imply what you were logging. Sentry is also configured not to store the IP address your device connects from, so a crash does not tell us your location. Sentry processes these reports as our service provider and may not use them for anything else. In App Store terms, this is "Diagnostics" data, not linked to your identity — there is still no account to link it to.

Beyond that, nothing: the app contains no analytics and no advertising software. It does not track you across other apps or websites, does not read your device's advertising identifier, and will never show Apple's App Tracking Transparency prompt — crash reports are not used to track anyone, so there is nothing to ask permission for. The only other way the app reaches the network today is links you deliberately tap (for example, help articles from Clue or Flo, which open in your browser and are governed by those sites' policies); see Section 2 for the two designed exceptions and their status.

Of Apple's system frameworks, Locket uses HealthKit (read-only, Section 3), the Keychain (key storage, Section 1), and Face ID / Touch ID (the optional app lock). It uses no iCloud sync, no push notifications, no location services, no Sign in with Apple, and no in-app purchases. Separately, if you have enabled "Share With App Developers" in iOS Settings → Privacy & Security → Analytics & Improvements, or install a beta through TestFlight, Apple may also collect crash reports under Apple's own privacy policy and show us the anonymized result. That is an iOS feature you control, not something Locket adds.

6. The website and the waitlist

lockethealth.com is a static site. Fonts and every other asset are served from our own domain, and — like any website — the hosting provider that serves these pages sees your IP address in its standard server logs; we do not use those logs to identify or profile visitors. Three things to know:

• Analytics: we use Plausible Analytics, a privacy-focused service, to count visits to our landing page. It works without cookies or any persistent identifier on your device: we see aggregate numbers — how many visits, from which country, to which page — never individual people, and nothing is used to track you across other sites or shared with anyone. The script loads from our own domain and reports through it, so your browser never talks to Plausible directly. Apart from the host that serves the site, Plausible is the only third party involved; because it sets no cookies and builds no profile, there is no consent banner to click through.
• Waitlist: if you join the waitlist, we collect your email address for one purpose: telling you about Locket's availability. Today the waitlist button opens a pre-filled message in your own email app — nothing is sent until you press send, and your address lands in our support inbox and nowhere else. We keep it only until we have told you Locket is available, and delete it sooner on request: email support@lockethealth.com. If we later adopt a form service, we will name it here first.
• No accounts here either: the website has no login, no user profiles, and no way to submit anything except the waitlist email above.

7. How long anything is kept

• Health entries: kept on your device until you delete them or erase the app's data (Section 8). There is no server copy; retention is entirely in your hands.
• Encrypted backups you export: held by you, wherever you put them, for as long as you keep them. We never receive them (Section 4).
• Anchored fingerprints (once anchoring is active, Section 2): permanent by design — an integrity ledger only works if its records cannot be quietly rewritten. They contain no personal or health information.
• Crash reports (Section 5): kept by Sentry for 30 days from the day the report arrives, then deleted automatically.
• Website analytics (Section 6): aggregate page-view statistics only; nothing that identifies you is kept at all.
• Waitlist email addresses: kept until we have notified you of availability or you ask us to delete yours, whichever comes first.
• Website server logs: kept by our hosting provider for its standard rolling window, then discarded.

8. Your choices and rights

• Erase everything: Settings → Erase All My Data destroys your encryption key and erases every entry and all your cycle data on the device, then returns you to the first-run screen. A few display preferences survive — theme, temperature unit, whether the app lock is on — and contain no health information. Deleting the app also deletes every entry, since the database lives inside the app. Three things remain, because they are outside the app's reach: (a) any anchored fingerprints already written to the integrity ledger — which contain no personal or health data and cannot identify you; (b) backup files you exported, which only you hold; (c) anything captured in a whole-device backup you made before erasing (such as an iCloud or computer backup of your phone), which only you control and can delete through Apple's tools. Because the encryption key is non-migratory, such a backup restored to a different phone cannot unlock the entries inside it; only a restore to the same phone can.
• Apple Health: revoke read access any time in iOS Settings.
• App lock: Face ID / Touch ID gating is optional and can be turned on or off in Locket's Settings.
• Waitlist: request deletion of your email at any time (Section 6).
• Because we hold no account data and no health data about you, requests to "access the data Locket has about me" will usually have a short answer: an email address if you joined the waitlist, and nothing else. (Crash reports are not linked to any identity, so we could not locate yours even on request — see Section 5.)

9. Consumer health data notice

This section serves as our consumer health data privacy policy under Washington's My Health My Data Act, Nevada's SB 370, and similar consumer health data laws.

• Categories collected, and why: menstrual-cycle and related health data — the entries you create in the app and the Apple Health categories you approve (the full list is in Section 3). Collected and processed on your device only, for one purpose: providing the app's features to you. Nothing else.
• Sources: you, and Apple Health if you connect it.
• Sharing and sale: we do not sell consumer health data, and we do not share it. Third parties with whom we share consumer health data: none. Affiliates with whom we share consumer health data: none. We do not possess it in readable form. Our crash-reporting and website-analytics providers (Sections 5 and 6) receive no consumer health data — crash reports are configured to exclude it, and the website never handles it. Sharing with a clinician will happen only when you initiate it, and only in encrypted form we cannot open (Section 2).
• Retention: see Section 7 — on-device until you delete it; no server copy.
• Your rights: to confirm whether we collect or share consumer health data about you, to access it, to withdraw consent, and to have it deleted. Exercise them through the mechanisms in Section 8 or by contacting support@lockethealth.com; we will respond within the time applicable law allows and will not discriminate against you for asking. If you are unsatisfied with our response, you may appeal by replying to our decision; if the appeal fails, you may contact your state attorney general.
• We do not use geofencing around health facilities (we collect no location data at all).

10. Children

Locket is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us an email address, contact us and we will delete it.

11. Where Locket is offered

Locket and this website are directed to people in the United States. If you visit from the EU, UK, or elsewhere, the only personal data we could receive is a waitlist email you choose to send — handled as Section 6 describes: used for one purpose, on the basis of your consent, kept no longer than Section 7 says, never transferred to anyone else, and deleted on request. The website's analytics keeps nothing that identifies you (Section 6). If Locket becomes available in your region, this policy will be updated with the disclosures your local law requires before launch there.

12. Security and breach notification

Security measures are described throughout this policy because they are the product: on-device AES-256-GCM encryption, OS-protected key storage, a fail-closed data layer, and servers that hold no readable personal data. In the unlikely event of a breach of data we or our service providers hold (waitlist email addresses, crash diagnostics) or a security failure affecting the app, we will notify affected people and regulators as applicable law requires, including the FTC Health Breach Notification Rule where it applies.

13. Changes to this policy

We will post changes here with a new effective date. For material changes, we will provide notice in the app or by email to the waitlist. We will never change what the architecture makes impossible without telling you first — a new version of the app that transmitted different data would say so plainly before you install it.

14. Contact

support@lockethealth.com · Chao-Wei Tsang