Legal
Cookie Policy
Last updated: October 26, 2026
1. Your choice
On public pages, new visitors see a compact cookie banner. Optional analytics is off by default and only starts after you choose Accept analytics. Choosing Reject optional, closing the banner, or ignoring it leaves optional analytics off.
You can change your choice at any time with Cookie settings in the footer or Settings. Withdrawing analytics consent stops future optional analytics and removes the local pseudonymous analytics ID. It does not sign you out or delete your plans, study data, or guest allowance.
Necessary storage is always available because the service cannot provide sign-in, local study data, or the guest message limit without it. We do not use advertising cookies, sell data, or run third-party ad trackers.
2. Necessary cookies and storage
These items support the feature you requested. They are not used for advertising or optional analytics. Lifetimes are browser-side; clearing site data removes local items.
| Name | Type / provider | Purpose | Lifetime |
|---|---|---|---|
liq | Cookie, Locked In server | Stores the guest message count and a tamper-resistant signature so clearing the chat cannot reset the five-message allowance. The value does not contain your raw IP address or guest device ID. | 1 year; set with SameSite=Lax and Secure on HTTPS. |
lockedin-supabase-auth | localStorage, Supabase | Keeps you signed in and lets your account-scoped data sync. Legacy sessions may use a Supabase sb-*-auth-token key. | Until sign-out, session expiry or revocation, or site data is cleared. |
lockedin-v3lockedin-v3:user-<id>lockedin-v2 | localStorage, Locked In | Stores plans, chat history, check-ins, goals, exams, streak and XP data, onboarding answers, and preferences. Per-account archives keep one account's local state from being shown to another; lockedin-v2 is a rollback copy. | Until you clear it, or it is archived on sign-out. |
lockedin-guest-idlockedin-guest-used | localStorage, Locked In | Identifies this browser for the guest allowance and mirrors the server count as a floor. Clearing chat or changing cookie consent does not reset the allowance. | Until site data is cleared. |
lockedin-theme, lockedin-mode, lockedin-plan-preference-v1, lockedin-ics-url, lockedin-calendar-cache, lockedin-roast, lockedin-roast-hint, lockedin-effort, lockedin-checkin, lockedin-freeze-earned, lockedin-device-id, lockedin-referrer, lockedin-invite-shared, lockedin-streak-shared, lockedin-leaderboard, lockedin-signed-out, lockedin-last-touch | localStorage, Locked In | Remembers feature preferences and local app state such as theme, selected mode, plan UI choice, connected calendar address/cache, reminder and referral state, local leaderboard mirror, sign-out state, and the last visit timestamp used to suppress nudges. | Until site data is cleared or the feature removes it. |
lockedin-plan-selection-pendinglockedin-guest-entryli-install-dismissed | sessionStorage, Locked In | Keeps the one-time post-signup plan step, the explicit guest choice for this tab, and install-prompt dismissal. | Until the tab closes or site data is cleared. |
lockedin-consent-v1 | localStorage, Locked In | Stores only the consent version, whether optional analytics is allowed, and the time you chose. No email, user ID, token, or other personal data. | Until you change your choice or clear site data. |
Cache Storage lockedin-v6 | Service worker, Locked In | Caches the static app shell and icons so the installable app opens faster and can show basic screens offline. It does not cache account data or AI responses. | Until the service worker updates, or site data is cleared. |
| Cloudflare Turnstile | Third party, only when configured | Security challenge used on protected AI requests when Turnstile is enabled. Cloudflare may set its own cookies or browser storage during the challenge; its names and lifetimes are controlled by Cloudflare and are not reproduced here. | Set by Cloudflare; removed according to its storage rules or when site data is cleared. |
| Razorpay Checkout | Third party, only when you open checkout | Runs the payment window and helps Razorpay remember checkout choices, maintain the session, and prevent fraud. Razorpay may set its own cookies or browser storage on its domains; its names and lifetimes are controlled by Razorpay and are not reproduced here. Test-mode checkout does not charge real money. | Set by Razorpay; removed according to its storage rules or when site data is cleared. |
3. Optional analytics
These items start only after you allow optional analytics. Vercel Analytics and Speed Insights are designed to be cookie-free. We do not send names, emails, message contents, syllabus text, or keystrokes to them.
| Name / SDK | Provider | Purpose | Storage / lifetime |
|---|---|---|---|
| Vercel Analytics | Vercel | Aggregate page views and product events such as plan generation, focus activity, and share actions. | Cookie-free SDK. Loaded only after consent; no Locked In cookie is set for it. |
| Vercel Speed Insights | Vercel | Aggregate performance measurements such as page-load timing. | Cookie-free SDK. Loaded only after consent; no Locked In cookie is set for it. |
lockedin-anon-id | Locked In / Supabase | Random pseudonymous ID used to send a small set of first-party funnel events to our Supabase record_event function. Event values are short names and numbers, not message contents. For signed-in users, the server may associate the event with the account. | localStorage until consent is withdrawn or site data is cleared. Historical server-side event rows are not automatically deleted by withdrawing consent; you can request deletion through the Privacy Policy process. |
4. What we do not use
Locked In does not use advertising cookies, cross-site advertising pixels, social media trackers, session replay, or fingerprinting. Razorpay may use its own fraud-prevention tools inside its checkout window; those are controlled by Razorpay. We do not sell or rent personal data. Server-side account records, prompts, and payment data are described in the Privacy Policy, not on this page.
5. Browser controls
You can block or delete cookies and site data in your browser settings. Blocking necessary storage may prevent sign-in, local study data, or guest-limit enforcement from working. Browser controls do not change a preference already saved in Locked In; use Cookie settings for that.
6. Changes and contact
We will update this inventory when we add or remove a provider, storage item, or purpose. The revision date at the top shows when the page last changed. A new optional purpose will start off until you choose it.
Questions or requests can be sent to lockedin1436@gmail.com. We aim to respond within 30 days.