LockInBear

Privacy Policy

Last updated: July 4, 2026

LockInBear ("we", "the app") helps you block apps and websites using Apple's Screen Time (Family Controls) framework on iOS and macOS.

Summary

• Block lists, schedules, and Screen Time selections stay on your device unless you turn on optional cloud features.
• Optional features (account, sync, support, App Delete Prevention) send only what is needed for that feature.
• We do not sell your data.

Data stored on your device

• Block sessions and schedules (App Group container / SwiftData)
• App and website selections (Apple FamilyActivitySelection tokens — opaque identifiers)
• Unblock password hash (SHA-256); plaintext password in iOS Keychain when used
• Saved QR/barcode vault entries for emergency unblock (PRO)
• PRO subscription status (StoreKit + local App Group flag)
• Theme preference, unblock defaults, strict-mode local state
• APNs device token (stored locally until uploaded after sign-in, for support-reply notifications)

Data sent to our servers (optional / feature-gated)

Feature	Data sent	Purpose
Sign in with Apple	Apple identity token → Supabase Auth	Account identity (optional)
Sync (PRO, opt-in)	Schedule/session metadata, device ID, JWT	Cross-device backup; new devices receive schedules as disabled
App Delete Prevention	Device ID, 4-digit recovery code	Encrypted storage for operator-assisted recovery after cooldown
Emergency Reset	Device ID, reason text, category, optional email	Cooldown timer and audit ticket
Need Help (support form)	Category, message, app version, device ID	Support thread in Supabase; copy logged to Notion
Support reply notifications	APNs device token (after sign-in)	Push when an operator replies while the app is backgrounded
Account delete	Bearer JWT	Delete Supabase user and related rows

We do not upload your raw app-picker labels, browsing history, or Screen Time usage graphs.

Apple services

• Screen Time / Family Controls — Required to apply blocks. Governed by Apple's Privacy Policy.
• StoreKit — Purchases processed by Apple.
• Sign in with Apple — When you choose to sign in.
• APNs — Support-reply alerts after you grant notification permission.

Third-party processors

Provider	Role
Supabase	Authentication, sync database, support threads, push tokens
Cloudflare	API hosting (Workers), rate limiting and strict-mode storage (KV)
Notion	Operator support ticket log
Apple	Screen Time, StoreKit, Sign in with Apple, APNs

API base: https://lockinbear-support.lockinbear.workers.dev

Data retention

• Sync data: Until you delete items or delete your account.
• Strict-mode codes: Until recovery is delivered and keys are cleared, or manual cleanup.
• Support tickets: Per Notion workspace policy; Supabase data until account deletion.
• Push tokens: Until account deletion or token refresh.

Account deletion

Settings → Account → Delete Account removes your Supabase user and synced data (including support messages and push tokens).

Children's privacy

LockInBear is not directed at children under 13. We do not knowingly collect personal information from children.

Contact

learnwithtokki@gmail.com

Changes

We may update this policy. The "Last updated" date above will change when we do. Continued use after changes constitutes acceptance.