Privacy policy

Who we are

Lockmeter is built and run by an independent developer based in New Delhi, India ("we", "us"). We are the data fiduciary for the personal data described here under India's Digital Personal Data Protection Act, 2023. To reach us about privacy, use support@lockmeter.com.

What we collect

Your account

• Your email address and a password hash, or a sign-in link sent to your email.
• Your plan and trial dates, so we know when your trial started and ends.

Tracking data you choose to send

Only once you install the browser extension or the desktop sync and connect them with your token:

• Browser extension: the active tab's domain and timing. URL paths and page titles are optional; domain-only is the default for new connections.
• Desktop sync (via ActivityWatch): the name of the active app, its window title, and start and end times. Away time is removed when a healthy ActivityWatch AFK watcher supplies it. The current sync pauses and reports degraded health when AFK data is missing or stale. An explicit recovery command can skip whole historical windows with missing or stale watcher coverage, recording gap receipts on your device so later healthy activity can sync. Those skipped windows can leave gaps in your history. Older records and manual timers can still include away time.
• A label for the device or browser that sent each event.

Things you create

• Zones, rules, manual timer sessions, time blocks, and edits you make to sessions.
• API tokens. We store only a one-way hash of each token, never the token itself.
• Feedback you send us, and your email if you join the waitlist.

What we never collect

• Screenshots or screen recordings.
• Keystrokes, typed text, form contents or clipboard contents.
• Mouse movement, camera, microphone or location.
• The content of the pages you visit. We see the address and title, not what is on the page.

Window titles and URLs can contain personal details, such as a document name or a search query. Current collectors default to domain-only capture with titles off. Path opt-in strips URL query strings, credentials and fragments, but paths or separately enabled titles can still contain personal details. Older retained records can contain full addresses and search queries. Pause capture before sensitive work. Deleting a derived session does not erase its raw activity record; account deletion removes both.

Why we use it

• To show you your own time: timelines, zone totals and history.
• To run your account, your trial, and sign-in.
• To keep the service secure and working, for example to detect broken syncs or abuse of the API.
• To read your feedback and, if you joined the waitlist, to email you about the paid launch.

We process your data because you asked us to provide the service, and you can withdraw that at any time by deleting your data or your account. We do not sell your data, share it with advertisers, or use it to build advertising profiles.

Where it is stored

Your data is stored in a managed Postgres database run by Supabase, our hosting provider for data and sign-in, and the web app is served by our hosting provider. These providers process data on our behalf under their own security and privacy terms, and their servers may be located outside India. Data is encrypted in transit. Each row of tracking data is tied to your account and protected by database rules so that no other user can read it.

Cookies and local storage

We use your browser's local storage to keep you signed in, remember your theme and keep focus-tool preferences and rounds under your account. We don't use advertising or cross-site tracking cookies.

How long we keep it

• Tracking data and account data: for as long as your account exists, or until you delete it.
• After a trial ends, your account is locked for new tracking but your existing data stays readable so you can export it. We may delete inactive, locked accounts after giving you notice by email.
• Waitlist emails: until paid plans launch and you have had the chance to sign up, or until you ask us to remove yours.

Your rights and controls

• Delete: Settings starts cloud account erasure by revoking device tokens and blocking new writes. It removes tracking data, settings, session corrections, exports, submitted feedback including answers and free text, and the linked waitlist entry, then removes sign-in. If a step fails, retry from Settings. A minimal restricted receipt retains the account ID and deletion status for restore protection. Backups need erasure replay before restoration to service. Downloads, extension queues and ActivityWatch's local database remain on your devices; uninstall or clear those separately.
• Export: Settings streams a snapshot as JSON or CSV with a category manifest and record counts: profile/access, zones, sessions, time blocks, raw activity, rules, settings, device and token metadata, ingest status, feedback, waitlist, mappings and session corrections. Credentials, hashes and internal security counters are excluded. Temporary database snapshots are removed after the download or cancellation; interrupted snapshots are cleaned on a later export. Large exports take time. Export remains available after your trial ends.
• Correct: while tracking access is active, edit or delete sessions in Analytics and change rules. Session corrections and deletion markers are preserved during reclassification. Archiving a zone keeps its history.
• Stop collection: revoke a device's token on the Integrations page, uninstall the extension, or stop the desktop sync. Revocation blocks future cloud ingestion; it does not erase a collector's local records.
• Complain: if you're unhappy with how we handle your data, contact us first. You can also complain to the Data Protection Board of India.

Children

Lockmeter is not intended for anyone under 18, and we don't knowingly collect data from children.

Changes to this policy

If we change what we collect or how we use it, we will update this page and change the date at the top. For significant changes we will also email account holders before they take effect.

Contact

Questions or requests about your data: support@lockmeter.com. See also our terms of service.