PWA LOCK · POLICIES

Privacy Policy

Effective 2026-09-20

pwalock.com operates this service. This notice describes the data handled by this implementation.

Information we store

We store your account email, a salted password hash, account creation time, the terms version you accepted, app names, destination URLs, cover settings, patterns, and salted app-password hashes. Do not put secrets in app URLs or names. Patterns are stored as settings, not encrypted secrets.

Sessions and abuse prevention

Essential cookies hold account sessions, unlock sessions, and form security tokens. We store hashed session identifiers and short-lived login handoffs. Account sessions expire after seven days; handoffs expire after one minute. Rate-limit identifiers derived from IP addresses and account identifiers are hashed and expire with their rate-limit window. Expired records are removed on subsequent related activity. We use this information to operate access controls and limit abuse.

Traffic and hosting

Our hosting provider, Cloudflare, runs this service on its edge network and processes the requests and operational data needed to serve it. Direct launch sends subsequent app traffic directly to the destination; its operator receives your connection information and applies its own policy. For proxied apps, requests, responses, and upstream login information pass through our server. The application does not intentionally persist those bodies, but the proxy can process them in memory. Hosting infrastructure may retain operational logs under the operator's hosting settings.

Cover apps and weather

Cover apps store game progress, best scores, calculator history, preferences, and timer state locally in this browser. Clearing site data removes that state. Weather stores the selected city or rounded device location and the last forecast locally. Device location is requested only when you choose Use my location. City search uses a bundled GeoNames database on our server. Weather requests send coordinates rounded to two decimal places through our server to MET Norway; that provider receives our server connection rather than your device IP. Our server temporarily caches forecasts and applies request limits. MET Norway may retain API logs under its terms and privacy information.

Files on your device

The optional vault stores files in your browser's origin-private storage. It is not a cloud backup and is not encrypted by PWA Lock. Browser or device access may expose it; clearing site data can delete it. Proxy-based downloads pass through the server. Direct launches do not include the injected vault integration.

Use and sharing

We use account data to provide the service, respond to requests, and prevent abuse. This app includes no advertising or third-party analytics scripts and does not implement personal-data sales. Data may be processed by hosting providers or disclosed when legally required. Third-party apps may use their own cookies or analytics.

Payments

Paid plans are billed by Creem, our merchant of record. When you start a checkout we send Creem your account identifier and email address; Creem collects your payment details and billing address itself and tells us which plan you bought and when it renews or ends. We never see your card number. Creem's privacy policy applies to the data it handles.

Retention and your choices

Account and app records remain until removed by the operator. You can request access, correction, deletion, withdraw consent by requesting account closure, or raise a privacy grievance through contact@pwalock.com. We may retain information when necessary to meet legal obligations or investigate abuse. Backup and hosting-log retention depends on deployment settings; ask the operator for the current schedule and hosting location. Log out to revoke account sessions across apps, and clear browser site data to remove local files and cached covers.

Contact and updates

Contact contact@pwalock.com with privacy requests or concerns. This notice will be updated when the service's practices change.