Privacy Policy
Last updated: 15 August 2026
Welockin helps you block distracting apps and websites during focus sessions. This policy explains what data the Welockin apps (Android, iOS, macOS and Windows) and this website collect, how it is used, and the choices you have. We keep it plain: we do not sell your data, we do not run advertising, and the sites you browse never leave your device.
The short version. We store your email and the blocklists and focus history tied to your account so they sync across your devices. The distraction blocking itself runs entirely on your phone. Welockin never sees or records the websites you visit. You can delete your account and all its data at any time.
Who we are
Welockin (“we”, “us”) is the data controller for the personal data described here. For any privacy question or request, contact us at hello@welock.in.
Data we collect
We collect only what the product needs to work. Specifically:
| Data | Why we collect it |
|---|---|
| Email address | Your account identifier and the address we use to reach you about your account. |
| Password | To sign you in. It is stored only as a salted one-way hash. We never store or see your actual password. |
| Device identifier & name | A random ID generated on your device (for example android-…), plus a device label and platform, so your account can list your devices and keep them in sync. It is not your phone’s hardware ID or advertising ID. |
| Blocklists | The names of the blocklists you create and the apps and websites you choose to block, so the same setup follows you across your devices. |
| Focus session history | For each session: a label, start and end time, planned duration, whether you completed it, and whether it was a hard lock. This powers your streaks and stats. |
What stays on your device and is never sent to us
The blocking engine is fully local. In particular:
- Your browsing. During a session, Welockin runs an on-device VPN that acts as a local DNS filter: it simply refuses to resolve the domains on your blocklist. Your web traffic is not routed through our servers. We do not see, log or store the websites you visit or the content of any traffic.
- Your installed apps and app usage.To show the block screen when you open a blocked app, Welockin reads which app is currently in the foreground (Android’s Usage Access). This check happens entirely on your device. The list of your installed apps and your usage is never uploaded.
Analytics on this website
Everything above is about the Welockin apps. This section is about welock.in, the website you are reading. They are separate, and it is worth being exact about which is which.
We use PostHog to understand how people find and use this site, so we know which pages are worth improving. It records the pages you open here, the language you read them in, the buttons and links you interact with, and technical details your browser sends anyway: device type, browser, referring page, and an approximate location derived from your IP address.
To recognise you as the same visitor between pages and on a later visit, PostHog stores an identifier on your device, in a cookie and in local storage, named ph_<project>_posthog. It contains a random id, not your name or email. We do not show a cookie banner. Deleting the cookie and local storage for this site removes the identifier, and a browser extension that blocks analytics will stop the collection entirely. Neither affects anything else on the site.
None of this touches the blocking engine or your browsing outside this website. Analytics here sees the pages of welock.in you visit, in the same way any website can see its own traffic. It cannot see the sites you visit elsewhere, and it is not connected to your blocklists or your focus sessions. Those remain as described above.
PostHog processes this data on infrastructure in the United States. If you are in the EEA or the UK, that is an international transfer; see International transfers below.
Permissions and why Welockin needs them
Android asks you to grant the sensitive permissions below. Each one maps to a specific feature:
| Permission | What it is used for |
|---|---|
| VPN service | Runs the on-device DNS filter that blocks websites during a session. No traffic leaves your device through us. |
| Usage Access | Detects the app in the foreground so a blocked app can be covered by the block screen. Read on-device only. |
| Display over other apps | Shows the full-screen block screen over a blocked app. |
| Foreground service (special use) | Keeps the filter alive for the whole session, with an ongoing notification so you always know it is running. |
| Notifications | Shows the ongoing-session notification and session updates. |
| Run at startup | Resumes a still-running locked session after a reboot, so a session can’t be escaped by restarting the phone. |
| Network access | Signs you in and syncs your account. |
How we use your data
- To create and secure your account and sign you in.
- To sync your blocklists and focus history across your devices.
- To show your streaks, stats and session history.
- To operate, maintain and improve the service and to respond to your support requests.
We do not use your data for advertising, and we do not build advertising profiles about you.
Sharing
We do not sell your personal data and we do not share it with data brokers or advertisers. We use a small number of service providers strictly to run Welockin, for example cloud hosting and database infrastructure for our backend at app.connect.welock.in. They process data only on our instructions. We may also disclose data if required by law or to protect our rights and users.
Third-party stores & payments
On Windows and macOS, purchases are processed by Lemon Squeezy as merchant of record; on iPhone and iPad they are handled by the Apple App Store. Welockin never receives or stores your card number. Both process the payment under their own privacy policies.
Retention & deletion
We keep your account data for as long as your account exists. You can delete your account and all associated data at any time, in the app (Profile → Delete account) or from welock.in/delete-account. Deletion is permanent. See that page for exactly what is removed and how long it takes.
Security
Data is encrypted in transit (HTTPS). Passwords are stored only as salted hashes, and your login token is kept in your device’s secure storage (Android Keystore / iOS Keychain). No system is perfectly secure, but we work to protect your data with industry-standard measures.
Your rights
Depending on where you live (for example under the GDPR or CCPA), you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. You can exercise most of these directly in the app, or by emailing hello@welock.in. We will not discriminate against you for exercising these rights.
Children
Welockin is not directed to children under 13 (or under 16 in the EEA/UK), and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.
International transfers
Your data may be processed in countries other than your own, including where our infrastructure providers operate. In particular, the website analytics described above are processed by PostHog in the United States. Where required, we rely on appropriate safeguards for such transfers.
Changes to this policy
We may update this policy from time to time. When we do, we’ll revise the “Last updated” date above and, for material changes, provide additional notice.
Questions or requests? Email hello@welock.in.