Privacy Policy

Last updated: 2026-10-21

This Privacy Policy explains how LOCK Secure Wallet ("LOCK", "we", "us") collects, uses, stores, shares and protects information when you use our Android app and website (together, the "Service"). By creating an account or using the Service you agree to this policy. If you do not agree, please do not use the Service.

1. Information we collect

• Account information: your email address, an optional display name, and your password. Passwords are never stored in readable form; we keep only a salted bcrypt hash.
• Files you upload: photos, videos, audio, documents and any other files you choose to store, together with metadata such as file name, size, type, folder and upload date. We do not view, scan or analyse your file contents, except where strictly needed to operate the Service or where required by law.
• Gallery and document backup: if you turn on backup in the app, the app reads the photos, videos or folders you grant access to and uploads copies to your wallet. You can turn this off at any time in Settings.
• Intruder capture (optional, off by default): only if you turn on this feature and accept the in-app disclosure, a failed attempt to unlock the app on your device may record a front-camera photo, a 5-second audio clip and the device's approximate location. This evidence is uploaded only to your own private wallet, is visible only to you, and is never used for any other purpose. You can turn the feature off and delete captured events at any time.
• Usage analytics: coarse, first-party product events (for example "file uploaded" or "login") with the platform and app version. These never include file contents. You can opt out in Settings at any time.
• Device and log information: device platform, model and OS version (sent with intruder events), and standard server logs (IP address, request time and path) used for security and abuse prevention.
• Upgrade requests: if you request a paid plan, the contact details you enter (name, email, phone/WhatsApp number and any note).

2. How we use information

• To create and secure your account, verify your email and reset your password.
• To store your files and serve them back only to you.
• To enforce plan storage limits and process manual plan upgrades.
• To back up your wallet structure (a snapshot of folder and file metadata).
• To detect, prevent and investigate fraud, abuse and security incidents.
• To understand aggregate product usage and improve the Service (unless you opt out).
• To send transactional emails such as verification codes and upgrade confirmations. We do not send marketing emails.

We do not sell your personal data, do not show ads, and do not use your files to train any model.

3. Storage and security

• Files are stored in a private Amazon Web Services (AWS) S3 bucket with all public access blocked and encryption at rest.
• All traffic between the app or website and our servers is encrypted in transit with TLS (HTTPS).
• Files can only be opened through short-lived, per-user signed links that expire within minutes. Every file request re-checks that you own the file.
• Passwords and one-time codes are stored only as hashes. Sign-in sessions use short-lived tokens; on the app they are stored in the device's secure keystore, and on the web the long-lived token is kept in an httpOnly cookie that scripts cannot read.
• Repeated failed logins temporarily lock the account, and you can sign out of every device at once.
• Administrators can see account and storage metadata (for example, how much space you use) but cannot open your file contents through our tools.

No method of storage or transmission is 100% secure, but we work hard to protect your data and will notify you of a breach where required by law.

4. Service providers we share data with

We share data only with providers that help us run the Service, under contracts that limit their use of it:

• Amazon Web Services (AWS): file storage.
• MongoDB Atlas: database hosting for account and file metadata.
• Our email (SMTP) provider: delivery of verification and notification emails.
• Our hosting provider: running the website and API.
• Payments: paid plans are currently arranged manually (for example via Payoneer) after you submit an upgrade request. We do not collect or store card numbers. Online card payment (Stripe) is disabled.

We may also disclose information if required by law, to protect the rights and safety of users or the public, or as part of a merger or acquisition (in which case this policy will continue to apply).

5. Data retention

• Your files and account data are kept for as long as your account exists.
• Deleted files are removed from storage immediately when you delete them.
• When you delete your account, your files, folders, intruder events, backups, upgrade requests and analytics events are permanently deleted. Residual copies in encrypted infrastructure backups and logs expire within 30 days.
• We may keep limited records longer where the law requires it (for example, payment records).

6. Deleting your account

You can delete your account and all associated data at any time from Settings → Delete account in the app or on the web, or by visiting our account deletion page. You can also email tayyabmalik8299@gmail.com from your account email address.

7. Your rights

Depending on where you live (for example under the GDPR or similar laws), you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent at any time (for example by turning off analytics, backup or intruder capture). To exercise these rights contact us at tayyabmalik8299@gmail.com. You may also complain to your local data protection authority.

8. Device permissions

• Camera: to take photos you choose to upload and, only if enabled, for intruder capture.
• Microphone: only for the optional intruder-capture audio clip.
• Location: only to attach a location to optional intruder-capture events.
• Photos, videos and files: to upload items you pick and for backup you turn on.
• Notifications: to tell you when a backup finishes.
• Biometrics: to unlock the app with your fingerprint or face; biometric data never leaves your device.

Each permission is requested only when you use the related feature and can be revoked in your device settings.

9. Children

The Service is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

10. International transfers

Your data may be processed in countries other than your own. Where required, we use appropriate safeguards for such transfers.

11. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date and, for material changes, notify you in the app or by email.

12. Contact

Questions or requests: tayyabmalik8299@gmail.com.