Privacy policy

The short version

• LockSet has no account and collects nothing. Your training stays on your device. We never receive it.
• Two optional features can send data to another company, and only when you use them: the AI assistant sends the data it shows you to the AI provider you choose, and on Android, reading a QR code uses Google ML Kit, which sends diagnostics to Google.
• Apple Health and Health Connect data is read and written only with your permission, and is never sent to us.
• This website has no cookies, analytics or trackers.

Who we are

LockSet is made by Rodman Swanston, an independent developer in the United States (“we”, “us”). Questions about this policy: support@lockset.app.

What stays on your device

Everything you put in LockSet is stored in the app on your phone or tablet: your plan and routines, workouts, sets and notes, body weight and measurements, the photos and videos you add, your gym cards, your settings and the conversation with the AI assistant. There is no LockSet server, so none of it is sent to us, and we can’t see, recover or delete it for you.

• Backups and exports go where you choose to save or send them (for example Files, iCloud Drive, Google Drive or another app). Those services handle them under their own terms. An encrypted export is locked with a passphrase that LockSet doesn’t keep. If you encrypt automatic backups, LockSet keeps that passphrase in the device’s secure storage, to make the copies, and never puts it in a backup.
• Your device’s own backups (iCloud Backup, or Google’s backup on Android) may include LockSet’s data, depending on your device settings. That is between you and Apple or Google.
• API keys for the AI assistant are kept in the device’s secure storage (Keychain or Keystore), and never in backups or exports.

What we collect

Nothing. LockSet contains no analytics, advertising, crash-reporting or tracking code. It doesn’t use advertising identifiers, doesn’t track you across apps or websites, and doesn’t sell or share personal information. Logging, history, routines, charts and timers all work with no network connection.

Permissions

LockSet asks for a permission only when you use the feature that needs it. You can change each one in your device’s settings.

• Camera: to take progress pictures and videos, and to scan a QR code (a gym membership card or a plan someone shared).
• Microphone: on iPhone, for the sound of a video you record with the camera.
• Photos: to add pictures and videos to your progress, workouts and exercises, to read a code from a picture, and, if you ask, to save a share image to your library.
• Notifications: rest-timer and reminder alerts, scheduled on the device. Nothing goes through a server.
• Face ID, fingerprint or passcode: for App lock. Your device checks it; LockSet only learns whether it succeeded.
• Apple Health or Health Connect: see below.

Apple Health and Health Connect

Health access is off until you turn it on, and you choose what LockSet may read and write. With your permission, LockSet writes the workouts you finish (with their duration, estimated active energy, the distance of an activity and, on iPhone, the effort) and the weigh-ins you log, and reads body weight, workouts from other apps, heart rate and body fat. It removes what it wrote when you delete it in LockSet.

Health data is used only for features inside the app. It is never sent to us, never used for advertising and never sold or shared for marketing. Weigh-ins and workouts that LockSet reads from Health become part of your log, so they are included when you export or back up your data, and the AI assistant (if you use it) sends them with the rest of your log. Heart rate and body fat are never sent anywhere. You can withdraw access at any time in the Health app or in Health Connect.

The optional AI assistant

The AI assistant is off by default and is the only part of LockSet that sends your training data online. To use it, you add an API key from a provider you choose (OpenAI, Anthropic, Google, or a server you set up yourself). Before the first request, LockSet shows you exactly what it will send and to whom, and nothing is sent until you agree.

When you send a message, LockSet sends the provider:

• your plan: routines, exercises, sets, reps, loads, rest, progression rules and the weekly schedule, plus the name and muscle group of each exercise you created;
• your training from the last 12 weeks: sets, reps, loads, effort, durations, the number of personal records, workout notes and totals computed on the device;
• your weigh-ins from the same weeks and your goal weight (including weigh-ins and activities LockSet read from Apple Health or Health Connect);
• your message, the last few lines of the conversation, suggestions you declined, a plan draft you ask it to revise, and your answers to its questions (goal, experience, training days, session length, equipment, limits, likes and dislikes);
• preferences: unit, language, effort scale, today’s date, and your equipment profiles.

It never sends your name, photos or videos, measurements, gym cards, heart rate or body fat. Check connection sends only your key, to list the models it can use.

Requests go straight from your device to the provider over an encrypted connection, with your key in a request header. There is no LockSet server or proxy in between, and we never receive the data, the replies or your key. The provider processes the request under its own terms and privacy policy, which you accepted when you created the key: OpenAI, Anthropic, Google (and the Gemini API terms, which explain how Google may use requests made on its free tier). The provider bills your account for each request.

You can turn the assistant off at any time in Settings › AI assistant, which also deletes your keys from the device.

QR codes on Android

On Android, reading a QR code (a gym membership card or a shared plan, with the camera or from a picture) uses Google ML Kit, part of the camera’s barcode scanner. The code is read on the device, but ML Kit sends Google diagnostics about its own use: device and app information, a per-installation identifier, performance metrics, API settings and error codes. Google describes this in its ML Kit data disclosure. We don’t receive any of it. It happens only when you read a code. On iPhone and iPad, codes are read with Apple’s on-device frameworks and nothing is sent.

Sharing and links

When you share a workout card, a plan or a file (to Instagram, WhatsApp, Photos, the share sheet or another app), that app receives what you chose to share and handles it under its own terms. For Instagram Stories, LockSet names itself with its Meta app ID so Instagram can show where the image came from. Links in the app (a provider’s key page, an exercise’s source, the credits) open in your browser.

Purchases and the app stores

LockSet Pro is bought through the App Store or Google Play, which process the payment. LockSet checks on the device whether you have Pro; we never receive your payment details. The stores give us sales reports and order records (such as dates, countries, prices and order numbers). If you choose in your device settings to share analytics or crash reports with app developers, Apple or Google may give us crash reports and statistics about the app; you control that in your device’s settings, and LockSet doesn’t add any of its own.

If you email us

When you write to support@lockset.app, we receive your email address and whatever you send. The mailbox is hosted by Namecheap (Private Email), which stores the messages for us under its privacy policy. We use them only to reply and to fix what you report, and we delete them when you ask.

This website

lockset.app has no cookies, analytics, advertising or tracking, and loads no third-party scripts, fonts or embeds. It is hosted on Cloudflare. To deliver the pages and protect the site, Cloudflare processes each request, including your IP address, browser details and the page you asked for, and may keep it in logs for a limited time. See Cloudflare’s privacy policy.

Your choices and rights

Because your data is on your device, you control it directly: export it any time (free on every plan), or erase it with Settings › Data & backup › Reset everything or by deleting the app. We hold no copy to access, correct or delete. For emails you sent us, ask us to delete them. Depending on where you live, laws such as the California Consumer Privacy Act or the GDPR give you rights over personal data; we don’t sell or share personal information, don’t use it for targeted advertising, and will answer any request at support@lockset.app. For data an AI provider or Google ML Kit received, contact that company.

Children

LockSet isn’t directed at children under 13. It collects nothing from anyone, including children.

Security

Your data is protected by your device’s own security and encryption. You can add App lock, and encrypt backups with a passphrase. Requests to an AI provider use HTTPS only.

Changes

If this policy changes, we’ll update this page and the date at the top. If LockSet ever starts to collect data, this policy and the stores’ privacy labels will say so before it does.

Contact

Rodman Swanston · support@lockset.app · Support