Privacy Policy

Applies to the UNLOCKD web app and the UNLOCKD iOS app. Last updated: 31 July 2026.

UNLOCKD keeps track of the subscriptions you pay for and stores the login for each one. That only works if you trust it, so this page says exactly what is stored, where it goes, and what happens to it — in plain language, with no boilerplate.

The short version. Your email address and the subscription entries you choose to add are stored in UNLOCKD's database so they sync between your devices. Passwords are encrypted on your own device first, with a key derived from your master passphrase — that passphrase never leaves your device, so your passwords are unreadable to UNLOCKD and to anyone else holding the database, and how much work it would take to break that open depends on how strong a passphrase you chose. There is no analytics, no tracking, no advertising, no bank connection, and nothing is ever sold or shared for marketing. You can export your data and delete your account yourself, from inside either app.

What UNLOCKD stores

Your email address. It is your account. It is used to sign you in, to send the email that confirms your account, and to attach your vault rows to you. That's all.
The subscription entries you add. For each one: the service name and domain, the sign-in URL, a category, the username, the password (encrypted — see below), the plan name, the price and currency, the billing cycle, the next renewal date, whether you've marked it cancelled, and any notes you write.
A little account state. Your display-currency preference, and — if you choose to make the optional one-time supporter contribution — the fact that you did, the amount, and a payment reference. Card numbers never touch UNLOCKD.
Key material that is public by design. A random salt, the number of key derivation rounds, and a short encrypted verifier string used to check that a passphrase is correct. None of these reveal anything about your passphrase.

Everything is kept until you delete it. Be aware that only the password field is encrypted: the plan name, price, renewal date, notes and the rest are stored as you typed them, because the app has to total, sort and calendar them. Don't put a second password in the notes field.

What UNLOCKD does not collect

No analytics and no tracking. There is no analytics SDK, no tracking pixel, no advertising identifier, and no cross-app or cross-site profile of you. The apps ship with none.
No ads. UNLOCKD does not show advertising and does not work with ad networks.
No data sales or sharing. Your data is never sold, rented, or handed to a data broker, and it is never shared with anyone for marketing or credit decisions.
No bank connections. UNLOCKD never links to a bank, card, or financial aggregator. It knows what you pay because you told it, not because it read your statements.
No location, contacts, photos, or health data. The apps do not ask for them.

How your passwords are protected

Each password is encrypted on your device with AES-256-GCM before it is sent anywhere. The key is derived from your master passphrase using PBKDF2-HMAC-SHA256 with 600,000 rounds and a random per-account salt. A vault created before that number was raised keeps the round count it was built with — the count is stored alongside the vault, so an older vault still opens normally — and every vault created now uses 600,000. The server only ever receives and stores the resulting ciphertext.

What that does and does not buy you, plainly: without your master passphrase the stored ciphertext is unreadable, so anyone holding a copy of the database — UNLOCKD included — sees encrypted blobs and nothing else. But the practical strength of that protection is the strength of the passphrase you picked. Those rounds make guessing slow and expensive; they do not make a short or commonplace passphrase safe, because someone with the ciphertext can keep guessing offline for as long as they like. A long, unusual passphrase is what turns the maths into real protection — which is why both apps enforce a minimum length and show you a strength meter while you type.

Your master passphrase never leaves your device. It is not transmitted, not stored on the server, and there is no reset link, no recovery code, and no back door. This is the deliberate trade: if you lose your master passphrase, UNLOCKD cannot get your saved passwords back for you. There is no mechanism to do it and no support request that changes that — the key was never here to begin with.

On iPhone, the derived key is held in the iOS Keychain so the vault can be unlocked with Face ID, and a copy of your entries (passwords still encrypted) is stored in the app's private app-group container so the AutoFill keyboard extension can offer them. The key is marked this-device-only, so it never reaches iCloud or a backup; the mirrored entries stay inside the app's own container and are never sent anywhere. Both are cleared when you sign out. The vault locks itself after 24 hours of inactivity.

If you switch UNLOCKD on under Settings → AutoFill & Passwords, iOS is additionally handed a plain index of which website and username each saved login belongs to, so it can put a suggestion above your keyboard without having to wake the extension. That index contains no passwords — Apple's AutoFill design deliberately stores only the identifiers — and it is removed when you lock the vault or sign out.

One thing to know: when you use one-tap launch or Copy password, the password is placed on the iPhone clipboard so you can paste it. UNLOCKD marks that clipboard item local to this device, so it is not passed to your Macs and iPads over Universal Clipboard, and asks iOS to drop it after 90 seconds. What no app can do is stop another app on the same iPhone reading the clipboard inside that window — that is true of anything you copy — so paste it and move on.

Who processes your data

UNLOCKD is run by one independent developer, and these are the only services that handle your data:

Supabase — the Postgres database, authentication (including the email that confirms your account), and the backend functions. Row-level security means every query is scoped to your own user ID.
Netlify — hosts the website and web app. Netlify sees standard web request data such as your IP address.
Stripe — only if you make the optional one-time supporter payment on the web. You enter your card details on Stripe's own checkout page; Stripe receives them, UNLOCKD never sees or stores a card number. If you don't contribute, Stripe is never involved.
Apple — the same optional contribution made inside the iOS app goes through Apple's In-App Purchase system, so Apple handles the payment under its own privacy policy. UNLOCKD receives only a confirmation that a purchase was valid.

Requests the apps make to third parties

Beyond UNLOCKD's own backend, the site and the apps make four kinds of outside request. None of them carry your email address, your entries, or your passwords — but, as with any request from your device, the service on the other end can see your IP address.

Web fonts. The written pages on the site — this one, the extension policy and the cancellation guides — load two typefaces (Inter and Space Grotesk) from Google Fonts, so Google's font servers see the request. The web app itself and the iOS app load no web fonts at all; they use the font your device already has.
Service logos. To show a recognisable icon, the apps ask Google's public favicon service (google.com/s2/favicons) and, if that fails, unavatar.io for the icon belonging to a domain. They receive only the domain name — for example netflix.com — never which account it belongs to.
Exchange rates. To convert totals into your display currency, the apps fetch daily reference rates once a day from frankfurter.app. That request contains only currency codes, no amounts.
Links you tap. Launching or cancelling a subscription opens that service's own website or app. What happens there is covered by that service's privacy policy.

Deleting your account

You can delete everything yourself, without asking anyone:

On iPhone: Settings → Delete account, then confirm.
On the web: at the bottom of your vault, Delete account, then confirm.

In UNLOCKD's database, deletion is immediate and irreversible. Removing the account removes every row that belongs to it — subscriptions, key material, settings, supporter record — because they all cascade from the account itself. There is no soft delete, no 30-day grace period, and no copy kept behind for us to restore from. Once it's gone we cannot bring it back, so export your entries first if you want a record of them.

Two honest caveats, because "completely erased everywhere" would be a promise UNLOCKD cannot keep:

Payment records aren't UNLOCKD's to delete. If you made the optional supporter contribution, Stripe or Apple holds its own record of that transaction, as every payment processor must for tax and anti-fraud reasons. Those records live under their own retention policies, not UNLOCKD's, and deleting your account here does not reach into them.
Provider backups and logs expire on their own schedule. Supabase and Netlify keep short-lived database backups and routine server logs as part of running the service. Deleted rows can persist in those for a short window until they age out on the provider's rolling schedule. UNLOCKD cannot reach inside them to delete early, and nobody at UNLOCKD can use them to restore a vault for you either — the encrypted passwords in a backup are just as unreadable without your passphrase.

You can also delete a single subscription at any time, from either app, without deleting your account. If you would rather have deletion done for you, email sakaclothing.customerservice@gmail.com from your account's email address.

Your rights

You do not have to ask permission to exercise any of these, and there is nothing to pay:

Access. Everything UNLOCKD holds about you is what you see in the app when you're signed in and unlocked — your email address, your entries, your settings. If you'd like it confirmed in writing, email the address below from your account's email address.
Export (portability). Both apps can write a copy of your vault to a file on your own device — on iPhone from Settings, and on the web from your vault. The file is generated locally from your unlocked vault, and the passwords in it are decrypted, because an export you can't actually read somewhere else is no export at all. Treat it with the same care you'd give the vault itself: keep it somewhere safe, or delete it once you've used it.
Correction. Every field is editable in either app — open the entry, change it, save. Your email address is the one thing you can't edit yourself; email the address below and it will be changed for you.
Deletion. As described above: Settings → Delete account on iPhone, or Delete account at the bottom of your vault on the web, and it happens straight away.

Depending on where you live, you may also have the right to complain to your local data protection authority. If something here isn't right, please email first — it's one developer, and it will get read.

Children

UNLOCKD is not directed at children and is not designed for use by anyone under 13.

The browser extension

The optional UNLOCKD Subscription Capture extension for Chrome has its own, separate policy: read it here.

Changes to this policy

If what UNLOCKD stores or which services it uses ever changes, this page is updated and the date at the top changes with it. Material changes will also be announced in the app.

Who is responsible, and how to reach them

UNLOCKD is built and run by Brad Brunton, an independent developer based in Canada, who is the data controller for everything described on this page. Questions about this policy, your data, a request under Your rights, or a deletion request all go to one address — there is no other: sakaclothing.customerservice@gmail.com.