Lockpic
Lockpic Privacy Policy
Lockpic is an offline encrypted photo and video vault for Android. This policy explains how Lockpic accesses and handles data.
Summary
Lockpic does not create user accounts and does not operate a server or cloud service. The app has no internet permission. Lockpic does not collect, receive, sell, rent, or share vault contents, patterns, recovery phrases, biometric data, usage analytics, advertising identifiers, crash reports, or device identifiers.
Data Lockpic accesses and stores
Lockpic accesses photos and videos only when you select them through Android's system photo picker. Imported media, thumbnails, filenames, albums, favourites, dates, dimensions, and other vault metadata are stored in encrypted form within Lockpic's private storage on your device.
Your unlock pattern, recovery configuration, encrypted key material, backup status, security settings, and cached Pro entitlement are also stored locally. Lockpic does not store your biometric fingerprint or face data. If biometric unlock is enabled, Android's system biometric service performs authentication and Lockpic receives only the cryptographic success or failure result.
How data is used
Local data is used only to provide Lockpic's functions: encrypting, organising, displaying, playing, recovering, backing up, restoring, exporting, and deleting your vault items; enforcing auto-lock; and remembering app settings and a Pro entitlement.
Lockpic does not use data for advertising, profiling, analytics, credit decisions, or sale.
Website analytics
The Lockpic website uses Cloudflare Web Analytics to understand aggregate page performance and visits. Cloudflare states that this service is cookie-free and does not collect personal data; it measures timing and performance information from page loads. The Android app does not use this website analytics service.
Data sharing and user-directed transfers
Lockpic does not transmit vault data to the developer or third parties. When you export media or an encrypted backup, Android lets you choose the destination. The selected storage provider or app may then handle that exported file under its own privacy policy. Exported media is no longer protected by Lockpic's vault encryption. Backup files remain encrypted, but you are responsible for protecting the backup and recovery phrase.
If you buy Lockpic Pro, the purchase is processed by Google Play. Google may process purchase and account information under Google's own privacy policy. Lockpic receives purchase status and product information through Google Play Billing and caches only whether Pro is owned on the device. Lockpic does not receive or store your payment-card details.
Security
Vault media and metadata are encrypted and authenticated at rest. Keys are derived or protected using the unlock pattern, Android Keystore, and modern cryptographic primitives. Decrypted video is streamed from encrypted storage and decrypted image pixels are not written to Lockpic's disk cache. Android backup and data extraction are disabled, and release builds block ordinary screenshots and screen recording.
No security measure is absolute. A rooted or compromised device, a device used while the vault is unlocked, exported plaintext files, or disclosure of the real pattern or recovery phrase can expose data. Lockpic has automated security tests but has not yet had an independent security audit.
Retention and deletion
Data remains on your device until you delete it. Items moved to Recently Deleted can be restored for up to 30 days and are then eligible for permanent deletion. You can also delete vault items within the app or erase all local Lockpic data by uninstalling the app or clearing its storage in Android settings.
The duress feature permanently destroys the wrapped keys for other vaults. Encrypted, undecryptable blobs may remain in local storage to preserve plausible deniability until Lockpic's app data is cleared or the app is uninstalled.
Lockpic cannot retrieve or delete data on your behalf because the developer does not receive it and Lockpic has no account or server. Copies that you export, including encrypted backups, remain wherever you saved them and must be deleted by you from those locations and any provider trash or backups.
Children
Lockpic is not directed to children under 13. Lockpic does not knowingly collect personal data from children or from any other user.
Changes to this policy
This policy may be updated when Lockpic's features or legal obligations change. The effective date above will be revised, and material changes will be presented through the app or its Google Play listing where appropriate.
Contact
For privacy questions, contact Lockpic at support@lockpic.org.