Skip to main content

Privacy Policy

Last updated: October 5, 2026

Introduction

LockYit ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we handle your information when you use our secure information manager and vault application.

The key principle: LockYit is designed with privacy at its core. Your vault data is encrypted on your device and we cannot access it.

Information We Collect

Account Information

When you create a LockYit account, we collect:

  • Email address - Used for account identification and recovery
  • Device identifier and device name - Used to manage the devices that sign in to your account
  • Sign-in verifier and encrypted copies of your keys - Used to sign you in and to recover your account. The verifier is not your password, and we cannot decrypt the keys.
  • Two-factor authentication settings, if you turn it on - Used to check your sign-in codes
  • Plan and subscription status - Used to provide the features of your plan

We do NOT collect or store:

  • Your master password
  • Your vault contents
  • Your encryption keys in a usable form (we hold only encrypted copies, which we cannot decrypt)

Vault Data

All vault data (passwords, notes, documents, etc.) is encrypted locally on your device using AES-256-GCM encryption before any processing occurs. We use zero-knowledge architecture, meaning:

  • Your data is encrypted with keys derived from your master password
  • Your master password never leaves your device
  • We cannot decrypt or access your vault contents
  • If you lose your master password and recovery key, your data cannot be recovered by anyone

Local Storage

LockYit is a local-first, offline-first application. Your vault is stored on your devices, not on our servers. We do not have access to it.

How We Use Your Information

We use your email address solely for:

  • Account identification
  • Account recovery verification
  • Essential service communications

We do NOT:

  • Sell your information to third parties
  • Use your data for advertising
  • Share your information with data brokers
  • Put analytics or tracking code in the LockYit app

This website (lockyit.com) uses Google Analytics, with IP anonymization, to count visits to its pages. It has no access to the LockYit app or your vault.

Data Security

We employ industry-standard security measures:

  • AES-256-GCM encryption - Applied on your device to all vault data, including attached files and their names
  • Zero-knowledge architecture - We cannot see your data
  • Local-first storage - Your vault is stored on your devices
  • Secure key derivation - PBKDF2-HMAC-SHA256 derives the key that protects your vault from your master password

Your Rights

You have the right to:

  • Access - Export all your vault data at any time
  • Deletion - Delete your account and all associated data
  • Portability - Export your data in standard CSV format

Children's Privacy

LockYit is not intended for users under 16 years of age. We do not knowingly collect information from children under 16.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

Contact Us

If you have questions about this Privacy Policy, please contact us at: [email protected]