What PWA Lock protects, and what it does not

PWA Lock protects one thing: entry through the locked address on your home screen. Tapping the icon shows a cover app or a password field, and nothing loads until the lock password is entered. PWA Lock does not change the original website, which stays reachable at its own address for anyone with its login. It does not encrypt anything, back anything up, or hide anything from someone who has your unlocked phone and knows your passwords. This is the trust page, written by the people who build PWA Lock: each situation, what passes through our servers, what stays on your phone, and how to check before you pay.

Which situations does the lock cover?

"Protected" means the lock password stands between that person and your app at the locked address, and nothing more. iPhone app locks, private browsing and PWA Lock compared compares these answers with Apple's own tools, which sometimes win.

What passes through PWA Lock's servers?

After you unlock, your browser keeps talking to the locked address while PWA Lock's servers fetch each page from the original site and return it under that address: a reverse proxy, in MDN's terms. Because every request passes the same address, the lock can relock the app and the vault can catch downloads; the browser's same-origin policy would allow neither at the site's own address.

• Pages, scripts, stylesheets, data, video and downloads are all fetched by our servers; links to the original domain are rewritten so you stay inside the locked address.
• The site's own login passes through too: the form you submit to sign in travels through our servers on its way there.
• The site's cookies are forwarded to it and set back in your browser, scoped to the locked address. PWA Lock's own cookies are stripped before forwarding, and the site cannot overwrite them.
• Headers naming your device's network address are removed, so the site sees a connection from our hosting. That is a side effect of proxying, not anonymity: the site still knows who logged in.

None of it is written to a database; the code does not intentionally store request or response bodies. What is stored is listed in the privacy policy: your account email, salted password hashes for the account and each app, app names, website addresses, cover settings and passcodes, hashed session identifiers, and what Creem, our payment partner, tells us about your plan. Creem handles card details itself; we never see card numbers. Hosting is Cloudflare Workers, whose infrastructure may retain operational logs. pwalock.com has no ads, no third-party analytics scripts and no tracking pixels.

Sites that redirect to a third-party login, send you to another domain or check the address they are served from may misbehave through a proxy; Why a website login may fail inside a web-app wrapper explains which ones. That is a compatibility limit, not a privacy one.

How long does an unlock last, and what ends it?

The relock is a small script added to every page PWA Lock serves. When the page is hidden it waits a moment, so a system sheet or same-app navigation does not count, then clears the unlock and shows the lock page; a vault download in progress delays it until the file is saved. It runs in your browser, so a crashed or suspended page may not run it, but the unlock cookie expires on its own after 15 minutes and the app re-checks with the server when it comes back into view. Log out of all apps revokes account logins everywhere; it does not change a lock password, which cannot be changed from the dashboard yet (create a new app, or write to contact@pwalock.com).

What lives on your phone?

The vault is browser storage

With a vault passcode set, downloads started inside the app go to the app's vault instead of the Files app. It is the browser's origin-private file storage on that device: PWA Lock does not encrypt it, does not upload it and cannot restore it. Clearing website data deletes it, the browser may evict it under storage pressure, and anyone who can use the unlocked browser or device can reach it. It keeps downloads out of Photos and Files; it is not a safe. Where do iPhone web downloads go? explains each location.

Cover state lives there too

Each cover is a real small app whose state (calculator history, a 2048 board, the timer's deadline, the weather app's last city) lives in the same storage and goes when website data is cleared. The Weather cover sends the chosen city or a rounded device location to our server, which asks MET Norway for the forecast; your device's address is not passed on, and location is requested only when you choose Use my location.

A cover is a convenience, not a security factor

The cover hides the password field. The passcode that reveals it (typing 2048= on the calculator, or tapping cells in order) is checked by a script in the lock page, so anyone who reads the page's source can see it, and on a device where your account is logged in, the locked address followed by /__lock/login?unlock=1 shows the field with no cover at all. The cover changes what someone sees; the lock password decides what they can open. Cover apps: what a calculator can hide covers each one.

What if you forget a password?

PWA Lock sends no email at signup, does not verify your address, and has no self-service reset for the account password or a lock password. Recovery is operator-assisted: we verify a request by replying to the email address on the account (see the support page), so that mailbox is effectively your recovery key and should be one you control. Nobody can tell you a forgotten lock password, because only a salted hash is stored; the site's own data is unaffected, so create a new app or write to contact@pwalock.com from the address on your account. Do not reuse the site's own password as the lock password.

How should you evaluate PWA Lock before paying?

1. Start with one app that holds nothing sensitive: follow the setup guide with a public site or throwaway account, confirm it works through the proxy, and watch the relock as you switch away and back.
2. Read the privacy policy and the terms. The terms call the service an experimental beta and tell you to keep independent copies of important files.
3. Decide the trust question per site: a locked news reader costs you nothing if a proxy sees it; a bank has its own login and gains little from anyone's proxy.
4. Pick a plan for the apps you will actually lock (Starter, Personal or Pro compares them). Every plan starts with a 14-day free trial: the card is saved at checkout and first charged when the trial ends, and cancelling before then costs nothing.