The short version: your photos, videos and files are encrypted on your device before Lockilee stores them, and they never leave your phone unless you personally choose to share a specific file. Our servers only ever hold your email, your device list, and your subscription status.
1. Who we are
Lockilee is developed and operated by XigmaPro ("Lockilee," "we," "us"). This policy explains how we handle information when you use the Lockilee Android application (the "App") and its supporting backend service.
2. What we never collect
Lockilee is built around one rule: the content you protect is yours alone. We do not collect, receive, transmit, or store:
- The photos, videos, documents, or any other files you import into your vault
- Thumbnails or previews of your vault contents
- The names of your folders or the file names inside your vault
- Your vault PIN, biometric data, or the encryption key derived from them
All of the above are encrypted and stored exclusively in app-private storage on your device. There is currently no cloud backup or sync feature in Lockilee — nothing is uploaded automatically, ever.
3. What we do collect
To provide accounts, device management, and subscriptions, our backend stores a minimal account record:
| Data | Purpose |
|---|---|
| Email address | Signing in via one-time passcode (OTP), account recovery |
| Device identifiers & device name | Showing you the "Devices" list in Settings so you can review or revoke access |
| Subscription status | Determining whether your account is on the Free or Pro plan, verified through Google Play Billing |
| Basic request metadata (IP address, timestamps) | Rate-limiting sign-in attempts and securing the API against abuse |
4. How authentication works
Lockilee uses passwordless, email-based sign-in: you request a 6-digit code, we email it to you, and you enter it in the app. We do not store passwords. Session tokens are stored securely on your device and can be revoked at any time from the Devices screen.
5. Third parties
- Email delivery: one-time sign-in codes are sent through a transactional email provider (Inboxili), which processes your email address solely to deliver that message.
- Google Play Billing: subscription purchases are handled entirely by Google Play; we receive only a purchase/subscription status, never your payment details.
We do not sell your data, and we do not share it with advertisers. Lockilee contains no third-party advertising or analytics SDKs.
6. Data retention
Your account record (email, device list, subscription status) is retained for as long as your account exists. Vault contents live only on your device for as long as you keep them there or until you delete your account, which triggers a local, secure wipe.
7. Your rights & deletion
You can delete your account and permanently erase your local vault at any time from Settings → Danger Zone → Delete account inside the app. See our Data & Account Deletion page for full details, including how to request deletion if you no longer have the app installed.
8. Security
Vault content is encrypted on-device; the local database index is protected with SQLCipher. Screenshot protection and app-switcher content hiding are available as optional settings. Because we never receive your files, a compromise of our backend cannot expose your vault contents.
9. Children's privacy
Lockilee is not directed at children under 13, and we do not knowingly collect information from them.
10. Changes to this policy
We may update this policy as the App evolves (for example, if an optional cloud-sync feature is introduced in the future — which would be opt-in and clearly disclosed here before it ships). Material changes will be reflected by updating the "Last updated" date above.
11. Contact us
Questions about this policy or your data? Email sales@xigmapro.com.