Privacy policy

Effective 19 October 2026 · Updated for memberships · Covers the Lockspot app (version 1) and this website.

Lockspot is an iPhone app that blocks the apps you choose while you're inside places you draw on a map, or while you hold to lock in. It's free to download, and after a short setup it needs a Lockspot Pro membership. Benjamin Hirsch, an individual developer in Highland, Utah, USA, makes Lockspot and runs this website.

What stays on your iPhone

Location. If you allow it, Lockspot uses your location to show you on the map and to check whether you're inside a zone you drew. With "Always" access, iOS wakes Lockspot near your zones so it can check in the background. Your location and the shapes you draw are processed and stored only on your iPhone. They're never sent to us or to anyone else, and your account never holds them. To draw the map, your iPhone asks Apple Maps for the map tiles of the area on screen (see Apple's services).

Screen Time choices. Lockspot uses Apple's Screen Time framework (Family Controls) to block the apps you pick. iOS gives Lockspot anonymous tokens for those apps, not their names, and Lockspot keeps them on your iPhone. Lockspot doesn't read or send your app usage, and Apple's rules don't let apps send Screen Time data off your iPhone.

Your activity in the app. Your zones, lock-in sessions, streaks, if-then plans and weekly recap are saved on your iPhone so the app works. They never leave it unless you choose to share your recap yourself, for example through the iOS share sheet.

Your account

You create a Lockspot account during setup. There are two ways to sign in, and neither uses a password.

• Sign in with Apple. Lockspot asks Apple for no name and no email, so Apple shares only an ID that is the same across apps from Lockspot's developer and different for every other developer.
• Email and a 6-digit code. You type your email address, and Supabase, the sign-in service Lockspot uses, sends you a 6-digit code to type into the app. The email goes out through Resend, an email delivery service. Your email address is stored with your account so you can sign in again. Lockspot uses it only to sign you in, and doesn't send you marketing.

Supabase stores the ID from Sign in with Apple, or your email address, with a Lockspot account ID, when the account was created and when you last signed in, and keeps standard security logs of sign-in requests.

Your membership

You buy Lockspot Pro through Apple's App Store, and Apple never gives Lockspot your payment details. RevenueCat, the service Lockspot uses to check memberships, receives your Lockspot account ID and the purchase history Apple shares for Lockspot: which plan you have, when it started, renews or ended, whether it began with a free trial, any refund, and the App Store country and price. Lockspot uses this to unlock the app, to restore your membership on another iPhone, and to see overall totals, such as how many people subscribed this month. It never sees your zones, apps or location.

The services that handle it

Supabase, Resend and RevenueCat handle your account and purchase data on Lockspot's behalf, as service providers (processors), and only to run Lockspot. Neither kind of data is used for advertising or to track you across other companies' apps or websites, and neither is sold.

• Supabase runs sign-in and stores accounts. See Supabase's privacy policy.
• Resend delivers the sign-in code emails, so it receives your email address and the email with your code. It isn't used if you sign in with Apple. See Resend's privacy policy.
• RevenueCat checks App Store purchases and keeps your purchase history. See RevenueCat's privacy policy.

Like any online service, they also receive the details every internet connection carries, such as your IP address and your app and iOS version. Lockspot doesn't use these to locate you.

How long it's kept

• Your account and your purchase history are kept while you have an account. Deleting your account deletes them from Supabase and RevenueCat (see Your controls).
• Supabase's security logs of sign-in requests expire on Supabase's own schedule.
• Resend keeps a delivery record of each code email (the address, the time and whether it arrived) for a limited time on its own schedule.
• What the app stores on your iPhone stays there until you delete it or delete the app.
• Apple keeps its own record of your purchases under Apple's privacy policy.

Apple's services

The map is Apple Maps. To show map tiles, your iPhone requests them from Apple, and Apple handles those requests under its own privacy policy. Sign in with Apple, payments and subscriptions are handled by Apple too. If you choose to share crash reports with Apple in iOS settings, Apple may pass anonymous crash data to developers; Lockspot doesn't add any crash reporting of its own.

What we never do

• We never send your location, your zones, your app picks or your Screen Time data off your iPhone.
• We don't sell personal data or share it for advertising.
• We don't track you across apps or websites, and Lockspot never asks for permission to track you.
• We don't use advertising tools, and we don't measure how you use the app.
• We don't ask for your name or a password, and we ask for your email address only if you choose to sign in with it.

Your controls

• Turn off location: Settings > Apps > Lockspot > Location (on iOS 17 or earlier: Settings > Lockspot > Location). Zones stop working; holding to lock in still works.
• Turn off Screen Time access: in Settings > Screen Time, remove Lockspot's access. Blocking stops.
• Cancel your membership: in Settings, tap your name, then Subscriptions > Lockspot, or use Manage subscription in Lockspot. When a membership ends, Lockspot ends any lock-in and pauses every zone, so nothing stays blocked. Your zones stay on your iPhone in case you come back.
• Delete your account: in Lockspot, open Settings > Account > Delete account, or tap the Account button at the top right of the membership screen. Deleting an account doesn't cancel an App Store subscription, so Lockspot offers Manage subscription first. It then deletes your account from Supabase and your record from RevenueCat, and signs you out on your iPhone. If you signed in with Apple, it asks you to confirm with Apple once more and removes Lockspot's Sign in with Apple access. If that Apple step can't finish, your account is still deleted, and Lockspot shows you how to remove its access yourself: Settings > your name > Sign in with Apple > Lockspot > Delete.
• Stop using Sign in with Apple: Settings > your name > Sign in with Apple > Lockspot > Delete. Lockspot signs you out on that iPhone. This doesn't delete your account data; use Delete account for that.
• Delete the app: every block is lifted and all data the app stored on your iPhone is removed. Deleting the app doesn't delete your account or cancel your membership, so do those first.

This website

This site is hosted on GitHub Pages. Like any web host, GitHub receives your IP address and standard request details, such as your browser and the page you asked for, and logs them for security. We can't see or control those logs; GitHub's Privacy Statement covers them.

The site sets no cookies and uses no local storage, analytics, tracking pixels or third-party embeds. Its fonts are hosted on the site itself, so loading a page doesn't contact Google or anyone else.

App Store links open Apple's site or app, where Apple's privacy policy applies. GitHub links go to GitHub, and the links to Supabase's, Resend's and RevenueCat's privacy policies go to their sites. We don't add tracking parameters to any of them.

Do Not Track

Neither the app nor this site tracks you, so Do Not Track and Global Privacy Control signals don't change anything.

Who can receive data through this site

• GitHub hosts the site and keeps logs of requests, including IP addresses, for security.
• Apple receives your request when you follow a link to the App Store, under Apple's own privacy policy.

No one else receives data through this site.

Support questions

Support questions go through GitHub Issues on this site's repository. Asking there needs a GitHub account, and GitHub requires its users to be at least 13. Questions, replies and usernames are public, and GitHub's Privacy Statement applies to them, so leave out personal details about yourself or anyone else, including your email address and receipts.

You can edit your own posts at any time. If you want a post of yours removed, reply on it and ask, and we'll delete it.

Who's responsible and your rights

Benjamin Hirsch, an individual developer in Highland, Utah, USA, makes Lockspot and runs this website, and is responsible for both.

Supabase, Resend and RevenueCat process account and membership data for us. GitHub runs its server logs as its own controller, under GitHub's Privacy Statement and its own retention rules. We never receive them.

The personal data we handle is your Lockspot account and membership data, and anything you post on our GitHub repository. We use account and membership data to provide the membership you signed up for (GDPR Article 6(1)(b), performance of a contract). For support questions, the legal basis is our legitimate interest in answering them and helping the people who use Lockspot (GDPR Article 6(1)(f)). Questions stay on GitHub until they're deleted.

You have the right to ask for access to personal data we hold about you, and to have it corrected (rectification) or deleted (erasure). You can ask us to restrict how it's used, object to how it's used, and give it to you in a portable format. You can delete your account and its data yourself in the app at any time. You can also complain to your local data protection authority. Supabase, Resend, RevenueCat and GitHub may store and process data in the United States, under the safeguards described in their own privacy policies and data protection terms.

A private email address for privacy requests will be added to this page. Until then, open a question on GitHub, leave out personal details, and say you'd like to make a privacy request.

Children

Lockspot is a self-control tool for the person using the phone, and it isn't directed at children under 13. It doesn't ask anyone for a name or an age, and it asks for an email address only if you choose to sign in with one. If you believe a child under 13 has created a Lockspot account, delete it in the app or contact us below and we'll delete it.

This website doesn't knowingly collect information from children either. The GitHub support channel is for people 13 and older; if you're younger, ask a parent or guardian to get in touch for you.

Changes

If a future version sends more data off your iPhone, we'll update this policy before that version ships and change the effective date above.

19 October 2026, updated for memberships: Lockspot now needs an account and a Lockspot Pro membership, so this policy now explains your account, your membership, the services that handle them, how long they're kept and how to delete them. Earlier that day, the policy was extended to cover this website as well as the app.

Contact

Questions about privacy: open a question on GitHub. Please don't include personal details there, because questions are public.

Lockspot is made by Benjamin Hirsch.