Privacy Policy

Effective October 5, 2026

LockIn ("we", "us") is made by Rhinoceros. This policy explains what LockIn collects, why, who can see it, and how to delete it. Questions: help@lockinlift.app.

The short version

Your posts are shared with your friends, not the public.
We don't sell your personal data.
Your phone number and contacts are scrambled (hashed) on your phone before anything is checked.
You can delete your account, and everything in it, from the app at any time.

What we collect

Account: your email address and password (passwords are stored securely hashed; we can't read them).
Profile: name, username, bio, home gym, profile and cover photos, and your time zone (so "today" matches your day).
Weight (optional): only if you add it. Shown to you and your friends, never to strangers.
Phone number (optional): stored only as a one-way scrambled code (a hash), used so friends who have your number can find you. We do not store the number itself.
Contacts (optional): if you use "find friends from contacts", the numbers are hashed on your phone and compared with other users' hashes. Your contacts list is never uploaded or stored.
Posts: the photos you take, muscle groups, gym or place, captions, and when you posted. Also likes, comments, friend requests, friendships, blocks and reports.
Notifications: a device token so we can send the notifications you turn on.
Camera and photos: used only when you take a photo, choose one, or save one. Lift photos are taken live with the camera.

Who can see what

Friends see your lifts, rest days and Social posts, but only after they've posted that day. They also see your profile, streak and (if you added it) weight.
Other users can find your name, username, profile photo and bio so they can add you. They can't see your posts unless you're friends.
LockIn admins can view accounts and posts to keep the community safe, handle reports and fix problems.
People you block, and banned accounts, can't see you at all.

How long we keep it

Social posts and rest-day photos are deleted about 7 days after posting (unless under review because of a report).
Gym lifts and your profile stay until you delete them or delete your account.
When you delete your account in the app (Edit profile → Delete account), your profile, photos, posts, likes, comments, friendships and other data are permanently deleted.

Where it's stored

LockIn's data is stored with our service providers: Supabase (database, login and photo storage, in the United States), Cloudflare (website and email forwarding) and Expo (app builds and notification delivery). They process data only to run LockIn.

Children

LockIn is for people 13 and older. We don't knowingly collect data from children under 13. If you think a child under 13 has an account, email us and we'll delete it.

Your choices

Edit or remove your profile details, weight and phone number in Edit profile.
Choose which notifications you get in Notifications.
Delete any of your posts, or your whole account, in the app.
Email help@lockinlift.app to ask for a copy of your data or for help deleting it.

Changes

If we change this policy we'll update the date above, and tell you in the app for important changes.