Privacy Policy

1. Information we collect

1.1 Account information

We use your email address for passwordless authentication, account operations and support. Supabase maintains your account identifier and authentication/session records. Your profile includes a display name and a marker recording whether the first-activation owner notification has been handled.

1.2 Goals, participation and check-ins

We store your active goal, weekly target, check-in history, and recorded goal/target changes used for personal History. We also store the Community Circle or Private Clubs you belong to, club names, ownership and membership roles, invite records, and relevant creation and participation timestamps.

1.3 Organization enquiries and support

Organization enquiries contain your name, email, organization type, approximate group size and message. They are delivered by email to the owner, with your address as Reply-To. No lead database or organization account is created. Support correspondence includes the information you choose to send.

1.4 Technical information

Authentication cookies maintain your session. Hosting, authentication and email providers process technical information needed to deliver and secure their services, such as request details, IP addresses, device/browser information, timestamps and delivery or error records. Application diagnostics record operational status and failures.

If you install the app, its service worker caches a public offline fallback, not your authenticated board or History. The product has no AI features or algorithmic feed. It does not use your accountability data to target advertising.

1.5 Historical billing information

Historical membership and billing records remain where they already exist, including Stripe customer/subscription references, statuses and billing-event records. Community and consumer Private Clubs do not require payment. Stripe handles card and payment details for historical billing; Locked In Club does not store your full card details.

2. How and why we use information

We use account and accountability information to provide the service you request: authenticate you, manage participation and invites, display the appropriate board, save your progress and show your personal History. An email is required to authenticate; a display name, active goal and weekly target are required to participate in a board.

We use operational records for support, security, abuse prevention and administration. On first usable Community or Private Club setup, an operational email tells the owner your display name, email and starting space, including the club name when applicable. This is not a marketing subscription.

Organization enquiry details are used to respond to your enquiry and prevent spam. Basic spam protection temporarily retains one-way email digests in server memory for a ten-minute window, not a mailing list. Account and enquiry emails are not automatically subscribed to a newsletter or marketing list.

Where data-protection law requires a legal basis, providing your requested account/service supports contract performance; responding to enquiries, protecting the service and administering it supports legitimate interests; records required by applicable law support compliance with legal obligations. These purposes do not authorize unrelated marketing.

We do not sell personal accountability data.

3. Visibility and operational access

3.1 Shared boards

Participants in your Community Circle can see your display name, current active goal, weekly target, and current-week check-in progress. Private Club members see the same current board information only within Private Clubs they also belong to, once they have completed that space’s setup. People outside a Private Club cannot see its board.

Other members do not see your email address or payment and billing information through communal board queries. They cannot edit your goal or check-ins. Club owners can manage their club’s membership, not other members’ progress.

3.2 Personal History

Other members cannot browse your longer-term History, target hit rate or weekly streak record. Each space has a separate personal record. The History view covers the recent 12 UTC weeks; that display limit is not a deletion schedule for older records.

3.3 Product administration

Personal History is private from other members, not from the service operator. The owner has authorized administrative access for operating and supporting the service, including account/contact information, group membership, goals and activity summaries. Community removal and Circle transfer are explicit owner actions. Service providers process information as described below.

4. Service providers and external WhatsApp

Supabase provides authentication and the database. Vercel hosts the website and server functions. Resend delivers operational emails, including first-activation notifications and organization enquiries. Stripe infrastructure remains for historical billing and associated records, not free consumer signup. These providers process the information needed for their respective services.

The optional WhatsApp group is an external conversation space operated through WhatsApp and Meta. Joining requires a separate choice after acknowledging the Community Guidelines. Depending on WhatsApp’s settings and features, other participants may see your phone number, profile information and messages. Private Clubs do not automatically get WhatsApp chat.

WhatsApp messages are not part of the website board database. External services and public contact platforms also have their own terms and privacy practices. We cannot control what another participant records or shares outside the product; avoid including information you do not want shared.

5. Data retention and deletion

Account and accountability data are retained while your account exists. Leaving or being removed from a Circle or club ends the relevant board access but does not automatically delete your goals, check-ins or personal History. Retained records can support your own History and rejoining.

Records may remain for a reasonable operational period after participation ends. Retention depends on account status, continuity of personal records, unresolved support or security matters, and applicable recordkeeping obligations. Enquiries and activation notices also remain in the owner’s operational mailbox and provider records; they are not erased by closing a browser session.

You may request account deletion. Your account, profile, goals, and check-ins can be removed through a reviewed request. Deletion is not an automatic consequence of inactivity, and provider backups, security records or legal/accounting records may have separate retention requirements. Stripe may retain financial records under its policies and applicable obligations.

WhatsApp messages and group history are governed separately by WhatsApp. Locked In Club cannot necessarily remove past messages from every participant’s device.

6. Security

The product uses authenticated server requests and database access policies to restrict boards to the relevant participants and writes to the record owner. Administrative access is restricted. These safeguards reduce risk but cannot guarantee absolute security or prevent another participant from copying information they are allowed to see.

Keep access to your email and device secure. Do not share sign-in codes or private invite links publicly. Avoid entering sensitive health, financial or third-party personal information into goals, check-ins or enquiries.

7. Your choices and rights

You can edit your current goal/target, use available membership controls, choose not to join WhatsApp, and request account deletion or help correcting account information through the contact links below.

Depending on applicable law, you may have rights to access, correct, delete, restrict or receive a portable copy of your personal information, and to complain to your local data-protection authority. Requests may require identity verification and can be subject to legal exceptions.

Right to object: where applicable, you may object to processing based on legitimate interests. If processing relies on consent, you may withdraw that consent without affecting earlier lawful processing. Contact the operator to make a request.

8. International processing

The service and its providers may process information outside your country. Processing locations and applicable protections depend on the provider and service configuration. Contact the operator for information about relevant processing locations and transfer safeguards; this policy does not promise that all data stays in your country.

9. Changes to this policy

Updates will be published on this page with a revised date. Material changes will be communicated as required by applicable law. This policy describes current operations, not a subscription to future marketing or consent to undisclosed new uses.

10. Contact

For privacy questions, access/correction requests or deletion requests, contact Raghav Kalra through the public contact links on the About page.