Privacy Policy

Who is responsible

LockinBro UF is the data controller. If you have questions, want to see your data or want it deleted, email us.

hej@lockinbro.se

What we store

Account

Your email address, which you sign in with. If you sign in with Apple, we also store Apple’s identifier for your account, and the name Apple sends becomes your display name until you change it. We also store a key from Apple that is only used to end the connection to your Apple ID when you delete your account. It is deleted with the account.

Profile

Username, display name, profile picture, cover photo if you have chosen one (only you see it), your weekly goal, your own goals (name, subject, hours and end date, which only you see), which break rhythm you chose as your starting point and the lengths in your custom rhythm, your notification and visibility settings, when you accepted the privacy policy, and which tips in the app you have already seen.

Study sessions

Subject or a custom subject name you wrote, when you started, when you stopped and how long you studied. If you have chosen them, we also store the place, the goal for the session, a caption, what you wrote you were going to do and whether you answered that it got done. What you wrote is visible to the same people who see the session, and if you answer Not quite (Inte riktigt), nothing is stored. The session’s rhythm is stored, with the lengths if you made your own, and when you took a break if you took one yourself or changed rhythm in the middle of the session. Only you see the breaks. If a session is ended automatically, we store that you have not confirmed it yet, and if it goes on for a long time, we store when we asked whether you are still studying. If you have chosen a place and Show to friends (Visa för vänner), the session counts toward how many sessions have been done there this week and in the last thirty days. Those numbers are visible to everyone, but only when they are at least three, and never who.

Photos

The two photos taken when you start a session, one with the back camera and one with the front camera.

Friends

Who you are friends with, which requests are unanswered, and who you have blocked.

Days in a row

How many days in a row you have studied and your record, the same for the shared streak with each friend, and which day you used the month’s rest day.

Milestones

Which milestones you have reached, and when.

Groups

Groups you have created or joined and your role in them, the group’s name, picture, goal and subjects, and which of your sessions you have chosen to add to a group. An invitation to a group stores who invited whom and when, until the person invited joins or declines, or the group is deleted. If you want to join a group and are waiting for approval, we store which group it is, who invited you and when, until a leader approves or declines, you change your mind, or the group is deleted. If you enter a group code that does not exist, the time is stored, so that no one can guess their way into other people’s groups.

Chains

When you start a session after a friend, we store which session you continued after.

Reactions and nudges

Reactions you give on other people’s sessions, and nudges you send or receive: who, which of the fixed phrases, and when.

Duels

Duels you send or receive: who, whether it was accepted, and when it started and ended.

Checked-off places

Which places you have checked off. Only you see this.

Place ratings

If you rate a place, we store your stars, your answers about power outlets and whether you can sit there for a long time, and whether you have answered what it was like to study there: quiet, okay or lively. Others never see who gave which rating, only the average and the number of ratings for the place. If only you have rated a place, the average is the same as your rating. What it was like to study there is shown only once at least three people have answered.

Reports about opening hours

If you tell us that a place’s hours are wrong, we store that you did, when, and which hours were listed then.

Tips about places

If you suggest a place, the tip is stored with who sent it: the name, the type, the location you chose on the map, what you wrote about why, and when. The tip is visible only to you and to those of us who review it. If it is approved, it becomes a regular place in Spots, without your name.

Schedule

Sessions you have planned and tests you have added: the time, the test’s name, and if you chose them, subject, place, length and reminder, and whether a test is a final exam (tenta). The schedule is visible only to you, never to friends or in a group.

Reports

If you report someone, we store who you reported, which session it concerned, the reason, what you wrote yourself if you chose Something else (Något annat), and the time. The report also stores the session’s subject and when it started, so that it can be understood even if the session is deleted. That you do not want to see the session again is also stored, and is visible only to you.

Suspensions

If your account is suspended, we store when it happened, the reason, who on our side did it, and when the suspension was lifted. A suspension does not delete anything in itself, except your phone’s technical code for notifications, so that no notifications arrive while it applies. If it is lifted, the code is stored again the next time you open the app, if you have notifications turned on. If the account is suspended because of a report, however, the reported session and its photos are deleted. While the account is suspended, you see a screen that says when and why. From there you can email us, sign out or delete the account.

Notices about removed sessions

If one of your sessions is removed after a report, a notice to you is stored: the session’s subject, when it started, the reason given and when you closed the notice. Who reported it and what they wrote is not in the notice.

Notifications

A technical code that identifies your phone, so that notifications reach the right phone, and whether it is an iPhone or an Android. It says nothing about who you are. For each notification we send, we store what kind of notification it was, to whom and when, so that we can keep to the limit on how many you get.

The waitlist on the website

If you join the waitlist on lockinbro.se, we store your email address, when you did it and where on the page you entered it. We use the address for a single email, when the app is released. The waitlist is not connected to any account in the app.

Your exact location never leaves your phone

What we store about location is the place you choose for a session, like a library or a café, and a yes or no on the session for whether you were there. Where your phone is located is never sent to us.

Location sharing is off by default. If you turn it on, your location is used to sort study places by distance, and to see whether you were at the place you chose for a session.

When you start a session and when you end it, your phone compares your location with the place you chose. The comparison happens on your phone, and the only thing stored is a yes or no on the session: whether you were there. No location, no distance. Yes means you can answer what it was like to study there.

Your location is never sent to us and is not stored anywhere. Distances are calculated on your phone. When the map shows where you are, the phone’s own map service is used — Apple Maps on iPhone, Google Maps on Android — which then receives your location to draw the dot.

Why we are allowed to store this

All processing of personal data needs a legal basis. Here is ours, item by item.

Account, profile, sessions, photos, friends and days in a row

Performance of a contract. We cannot provide the app without them.

Place ratings, reports about opening hours and tips about places

Performance of a contract. They are part of the app you use.

Milestones, groups, sessions together, chains, reactions, nudges, duels and checked-off places

Performance of a contract. They are parts of the app you use.

Blocks, reports, suspensions and incorrect group codes

Legitimate interest. It is about the app being safe to use.

Notifications and the log of sent notifications

Consent, when the phone asks for permission. Notifications are on by default. You turn them off in Settings (Inställningar), one at a time or all at once.

Location

Consent. Your location is used only when you have turned on location sharing yourself and given the phone permission, and you can turn it off whenever you want. It is never sent to us and is not stored anywhere.

The waitlist on the website

Consent. You enter the address yourself, and you can ask us to remove it whenever you want.

How long

Photos: 24 hours

The photos are deleted automatically one day after the session started. This is done by a scheduled job, not by hand. If someone has reported the session, the photos are kept until the report has been reviewed, and are then deleted in the same way. In the meantime they are visible only to those of us who review the report. A photo that has already been shown may remain for a while in the saved copy on the phone that showed it. If you start a session without a connection, the photos stay on your phone until they have been sent, and are deleted there once they are uploaded. If we do not accept the session, they stay until you try again or remove it.

The fact that you studied: until you delete your account

The session itself remains even after the photos are gone, that is, subject, time and length. Without it we cannot calculate streaks or statistics.

Incorrect group codes: one day

The time of a group code that did not exist is counted for one day. It is deleted at your next attempt after that, and always with the account.

Planned sessions: thirty days

A session you have planned is deleted automatically thirty days after its time, whether it happened or not.

The phone’s notification code: until you sign out

The code is deleted when you sign out on the phone, when the account is suspended and when you delete the account. If you sign in again with notifications turned on, it is stored again.

The waitlist on the website: until the app has been released

The address is deleted once the email about the app’s release has been sent. If you want to be removed before then, email hej@lockinbro.se and we will remove it.

Everything else: until you delete your account

Profile, profile picture, friends, blocks, days in a row, milestones, groups, chains, reactions, nudges, duels, checked-off places, tests with names and dates, place ratings, reports about opening hours, tips about places, sessions you have chosen not to see again after a report, Apple’s key and the log of sent notifications remain as long as you have an account.

Reports: even after the account has been deleted

A report is also kept after it has been handled, and remains without a name if the account is deleted. A suspension is kept until the account is deleted, and so is a notice about a removed session.

Who can see what

Your sessions and photos are visible to you and to friends you have accepted. Beyond that, a session is visible only where you have put it yourself: if you choose to add a session to a group you are in, that session is also visible to the group’s members, including those you are not friends with. This happens one session at a time and never automatically. Being in a group does not make your other sessions visible there, but the group’s members see how many days in a row you have studied. If either of you has blocked the other, neither of you sees the other’s sessions. This is not just a rule in the app; it is enforced by the database.

When you are studying right now, your friends see it, and if you have chosen a place for the session, they also see on the map that you are there.

Every time you choose a place for a session, you also choose Show to friends (Visa för vänner) or Only me (Bara för mig). With Only me, the place is stored so that only you can read it: your friends see the session but not where you are, you do not show up on the map, the session does not count toward the place’s numbers, and no notifications mention the place. This is enforced by the database. The choice applies to the whole session, and what you chose last is saved on your phone as the default.

If you turn on Can become a legend at spots (Kan bli legend på spots) under Settings (Inställningar), your sessions at each place over the last 90 days are counted, except those that are Only me. If you have studied the most sessions at a place, at least three, your friends see a crown with your name there. Others see only that the place has a legend, never who. It is off by default.

Your username, your display name and your profile picture are visible to others who use the app, for example in search, so that someone can send you a friend request. The rest of your profile, like your weekly goal, your settings and when the account was created, only you see.

Your friend list is used to suggest people to your friends’ friends: if you and someone have a friend in common, you may be suggested to each other under People you may know (Du kanske känner). The suggestion shows how many friends you have in common, never which ones. You can turn it off with Visible to friends of friends (Syns för vänners vänner) under Settings (Inställningar), and then you are not suggested to anyone.

Where the data is stored

The database and the photos are stored with Supabase in the eu-north-1 region, which is Stockholm. Supabase in turn uses subprocessors, for example for the network in front of the database and for sending the sign-in code by email, and they may be outside the EU.

This leaves the EU. Notifications are sent via Expo’s notification service in the USA and on to Apple or Google. What goes there is the phone’s technical code, the notification’s text — which may contain a friend’s username, a subject or a number of hours — and an internal code for which screen the notification opens. If you sign in with Apple, the sign-in happens at Apple. The map is loaded from Apple Maps or Google Maps, which learn which area you are looking at, and your location when the map shows where you are.

Delete everything

Under Settings (Inställningar) you will find Delete account (Radera konto). It removes the account, the profile, all sessions, all photos, friends, blocks and streaks. If you are the chair of a group, the chair passes to the person with the highest role after you, and if roles are equal, to the person who has been a member the longest, so that the group remains for the others. A suspended account is skipped. If there is no one else who can take over, the group is deleted. If you signed in with Apple, the connection to your Apple ID is also ended at Apple. This cannot be undone.

One exception: reports remain, both those against you and those you made yourself, without your name. A report keeps what was reported: the reason, the session’s subject and when it started. We need to be able to show that we review what is reported. Everything else is gone and we keep no copy.

You can also email us and we will do it for you.

Your rights

You have the right to know what we store about you, to have errors corrected, to have everything deleted and to object to how we process the data. Contact us at the address above, and we will reply as soon as we can.

If you think we are handling your data incorrectly, you can turn to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten). You do not need to ask us first.

imy.se