Locked In — Privacy Policy
Operational privacy policy for publication. Prepared for Health Intellect LLC d/b/a Locked In. This is not licensed legal advice and does not create an attorney–client relationship. Attorney review remains recommended before App Store / Play submission.
Effective date: September 2, 2026
Operator: Health Intellect LLC, a Texas limited liability company, doing business as Locked In (“Locked In,” “we,” “us,” or “our”). TSNC is a separate brand.
Sites / apps: https://lockedin.cc , https://app.lockedin.cc , and any Locked In mobile apps that link here (the “Service”).
This Privacy Policy explains what we collect, how we use it, and your choices. It works together with our Terms of Service.
1. Who is responsible
Health Intellect LLC operates Locked In. For privacy questions or requests, contact info@lockedin.cc.
Mailing address for privacy notices:
Health Intellect LLC (Locked In)
507 Woodway Ln, Longview, TX 75605
United States
2. Information we collect
2.1 You provide
- Account data: email, password or auth tokens, display name if any.
- Stake data: habit/goal text, stake amount (from offered tiers such as $5–$100), deadlines, proof type, status (e.g. active / succeeded / forfeited / charge_failed).
- Electronic signature / acceptance records: signature image or data URL stored on the Stake, plus timestamps that you agreed to stake rules, Terms, or payment authorization.
- Proof content: photo proof (often stored as an image URL or inline image data on the proof record) and related metadata; captions or notes you add. Video or other proof types if we enable them later.
- Support messages: emails or in-app messages you send us.
2.2 Location
If a stake requires GPS/location proof, we collect precise geolocation coordinates (latitude and longitude from browser or device geolocation) when you submit proof. We use them to evaluate whether proof meets that stake’s rules. You can deny location permission, but then you may be unable to complete location-required stakes (which can result in a forfeit under the Terms if you already created such a stake).
2.3 Payments (Stripe)
We use Stripe to collect and store payment methods via SetupIntent (including off-session usage so we can charge later) and to charge forfeits via off-session PaymentIntent when a stake is forfeited.
- We do not receive or store full card numbers (PAN) or CVCs on our servers (Stripe Elements / Stripe.js).
- We may store Stripe customer IDs, payment-method IDs, last4, brand, exp month/year, billing name/ZIP if provided, and charge/forfeit status (including failed charges).
- Stripe processes payment data under its own privacy policy: https://stripe.com/privacy
2.4 Automatically collected
- Device and browser type, OS, app version, language.
- IP address, approximate location derived from IP.
- Log data, diagnostics, crash reports.
- Cookies or similar technologies on the web app (session, preference, security).
- Store identifiers if you use iOS/Android apps (as provided by the platform and our SDKs).
2.5 Backend storage note
Application data (accounts, stakes, signatures, proofs) may be stored in our database (including PocketBase collections with a lockedin_ prefix / lockedin_users auth, or successor systems). Hosting providers process data on our behalf.
3. How we use information
We use personal information to:
- create and secure accounts;
- run stakes, evaluate proof (including photo and GPS), and decide charge vs no-charge;
- save payment methods and charge forfeits you authorized;
- prevent fraud, abuse, and payment risk;
- provide customer support;
- improve the Service and develop features (including a mobile app);
- send transactional email (receipts, stake reminders, security notices);
- send transactional email (stake reminders, receipts, security, account notices); we do not currently send marketing/promotional email (if that changes, we will update this Policy and honor opt-out);
- comply with law, enforce Terms, and protect rights and safety.
We do not sell your personal information for money. We do not use proof photos or GPS to build advertising profiles for third parties.
4. Legal bases (where relevant)
If a law requires a “legal basis” (for example if we later serve users in jurisdictions with GDPR-style rules), we rely on: contract performance (providing the Service and stakes), legitimate interests (security, improvement, fraud prevention), consent (precise location where required; marketing where required), and legal obligation.
5. How we share information
We share personal information with:
- Stripe — payments and payment-method storage;
- Hosting, database, and email providers — to run the Service; standard server logs and diagnostics as needed for security and reliability (no separate marketing analytics SDKs named at this time);
- Professional advisors (lawyers, accountants) under confidentiality when needed;
- Authorities when required by law or to protect rights and safety;
- A buyer or successor if we sell or reorganize the business, subject to this Policy’s standards.
We do not share your proof photos or GPS with other users as a public feed unless we clearly launch and disclose a social feature and you choose to participate.
6. Retention
We keep account and stake records while your account is active and for a reasonable period afterward for disputes, fraud prevention, tax/accounting, and legal compliance. Proof media may be retained for the same reasons tied to the stake. You may request deletion (Section 9); we may retain limited records when we must.
7. Security
We use administrative and technical measures appropriate to the Service (access controls, encryption in transit to our apps, Stripe for card data). No method of transmission or storage is 100% secure.
8. Children
The Service is for users 18+. We do not knowingly collect personal information from children under 13. If you believe a child provided data, contact info@lockedin.cc and we will delete it as required.
9. Your choices and rights
- Access / update: correct account info in-product or by emailing us.
- Delete account: email info@lockedin.cc to request deletion (logging out does not delete your account). If we later add in-product deletion, that path will also appear here. Deletion does not cancel amounts already owed under an authorized forfeit.
- Location: control via device settings; denying location may block location-required proof.
- Marketing email: unsubscribe via the link or by emailing us.
- Cookies: control via browser settings (some features may break).
California / state privacy rights (if applicable): Depending on your state, you may have rights to know, delete, correct, or opt out of certain “sharing” for cross-context behavioral advertising. We do not sell personal information. To exercise rights, email info@lockedin.cc. We will not discriminate against you for exercising privacy rights. If we later use advertising SDKs that constitute “sharing,” we will update this Policy and provide an opt-out.
Appeals: If we deny a request, you may appeal by replying to our decision email.
10. International users
We are based in the United States. If you use the Service from elsewhere, you understand your information may be processed in the U.S., where laws may differ from those in your country.
11. Mobile permissions
iOS/Android apps may request camera (proof photos), photo library, and precise location. Those permissions are used for stake proof and related features described above. App Store / Play privacy labels should match this Policy; update labels when practices change.
12. Do Not Track
There is no uniform DNT standard; we do not respond to DNT signals at this time.
13. Changes
We may update this Policy by posting a new version and changing the effective date. Material changes will be highlighted in-product or by email when appropriate. Continued use after the effective date means you accept the updated Policy.
14. Contact
info@lockedin.cc
Ship notes (not part of user-facing Policy)
Status: Placeholders filled 2026-09-02. Ready for LockedIn PR #4 after #3.
- Operator + address + info@lockedin.cc filled
- Marketing: transactional-only
- Analytics: none named beyond hosting/Stripe/logs
- Still ship: 18+ gate; account-deletion UX; App Store / Play privacy labels matching photo + precise location + purchase history