Simply Locked Privacy Policy

This Privacy Policy explains how SLKD Technologies LLC, a Wyoming limited liability company, operating as Simply Locked (“Simply Locked,” “we,” “us,” or “our”), collects, uses, stores, shares, and otherwise processes information in connection with simplylocked.app and related websites, applications, accounts, timers, Access Links, Crowd Key pages, and services (collectively, the “Service”).

Simply Locked is an adult-oriented software service. Information processed through the Service may be intimate or sensitive. Please read this Policy carefully before using the Service.

By using the Service, you acknowledge this Privacy Policy. This Policy is a notice, not a contract. Where the Terms of Service allocate risk, disclaim warranties, or limit liability, those provisions protect Simply Locked and remain in force.

Capitalized terms used but not defined here have the meanings given in the Terms of Service, where applicable.

1. Who We Are

For purposes of applicable privacy laws, SLKD Technologies LLC, operating as Simply Locked, is the entity that determines the purposes and means of processing personal information described in this Policy (the “controller” or “business,” as those terms are used under applicable law).

For privacy requests, include enough information for us to locate your account or timer records (for example, the email associated with an account, or a non-secret description of the relevant timer). Do not email private Control Links, Claim Links, Viewing Links, or Release Combinations unless we specifically ask you to do so through a secure channel.

2. Scope

This Policy applies to personal information we process when you:

• visit or use the Service;
• create, view, claim, control, or vote on a timer anonymously or while signed in;
• use Crowd Key, including submitting a plea or display name or casting a vote;
• create or use an optional account, when that feature is available;
• request that a timer link be emailed to you, when that feature is available;
• interact with optional premium or Simply Locked+ surfaces, when available;
• communicate with us; or
• otherwise interact with Simply Locked online.

This Policy does not apply to third-party websites, apps, or services that we do not control, even if they are linked from the Service.

3. Important Notice About Adult and Sensitive Information

Simply Locked is intended only for adults. Use of the Service may involve information that relates to consensual adult intimate activity, preferences, Control Modes (such as The crowd, A keyholder, Simply Locked, or Me), messages, Release Combinations, Crowd Key pleas, timer settings, or other content that you or another Participant choose to submit.

Under some privacy laws, such information may be treated as “sensitive personal information,” “special category” data, or similar. We process this information only to provide the Service you request, to secure and operate the Service, to enforce our Terms, and to comply with law. We do not use this information to infer characteristics about you for advertising, and we do not sell it.

You should assume that anyone who obtains a relevant Viewing Link, Control Link, Claim Link, or Public Crowd Link may be able to access information associated with that link. Treat private links as credentials. Public Crowd Links are intentionally shareable and may expose limited timer status, pleas, and display names to strangers.

Do not make Simply Locked the sole repository for information required for emergency physical release. Our processing of Release Combinations and unlock messages is for software features, not physical safety.

4. Information We Collect

We collect information in three main ways: (a) information you provide; (b) information generated by your use of the Service; and (c) information collected automatically by our systems or service providers.

4.1 Information you provide

• Timer and lock information. Duration and release settings, Control Mode selection, optional while-locked messages, optional Keyholder “On release” text, confirmation that a private link was saved, confirmation that a lock was set, and related timer settings.
• Release Combinations. For certain Control Modes (including The crowd and Simply Locked), we generate and store a Release Combination on our servers so it can be shown when you set the lock and again when the timer ends. We do not intend to expose that code on Public Crowd Key pages.
• Crowd Key content. Optional display names and pleas you submit for public Crowd Key pages, and vote choices (Keep / Show mercy) you cast.
• Account information (optional). If account features are available and you create an account, we collect an email address and password. Passwords are stored in hashed form. Accounts are not required to create or use a timer.
• Email link backup (optional). If that feature is available and you ask us to email you a timer link, we collect the email address you submit. Where accounts are also enabled, we may include a time-limited create-account link.
• Communications. Information you include when you contact us about support, privacy, security, legal, or other matters.
• Other content you choose to submit. Text or other information you enter into forms or fields on the Service.

Do not submit information about anyone under 18.

4.2 Information generated by the Service

• Timer identifiers and access tokens. Unique session identifiers and cryptographically strong bearer tokens used in Viewing Links, Control Links, Claim Links, Public Crowd Links, and related URLs. These tokens function as credentials. A person who possesses a token may exercise the permissions associated with it.
• Lock-start and control-transfer metadata. Whether a lock timer has started, whether control has been claimed, when those events occurred, and related handoff state.
• Crowd Key metadata. Vote counts, applied time deltas, challenge bounds, outcome-related fields, and similar records needed to operate Crowd Key.
• Crowd voter antifraud signals. A voter cookie and a one-way hash derived from network address information, used to reduce duplicate votes. We do not treat these signals as verified identity.
• Account associations. Optional links between an account and timers you save or create while signed in, when accounts are available.
• Timestamps. Creation, update, claim, lock start, end/release, vote, and similar event times needed to operate timers and accounts.
• Terms-acceptance signals. When you take an acceptance action (for example, Continue setup, confirming a lock is set, casting a Crowd Key vote, Accept control, or creating an account), we set a browser cookie so we do not repeatedly present the same acceptance gate in that browser. The HTTP request that performs the action may appear in server and security logs as described in Section 4.3.

4.3 Information collected automatically

• Technical and network data. Our hosting, reverse-proxy, and security providers (including Cloudflare and our cloud hosting provider) may process IP address, approximate location derived from IP, browser and device characteristics, request timestamps, requested URLs, referrer information, and similar diagnostic or security logs as part of delivering and protecting the Service. This includes requests used for Terms-acceptance actions and Crowd Key votes. We may hash IP addresses for Crowd Key duplicate-vote limits rather than storing raw IP with each vote permanently.
• Cookies and similar technologies. We use cookies and related storage as described in Section 8.
• Third-party front-end resources. Pages may load fonts or stylesheets from third-party content delivery networks (for example, Google Fonts and Tailwind’s CDN). Those providers may receive technical request data such as IP address and browser details when your browser fetches those resources.
• Product analytics (PostHog). When enabled, the Service loads software from PostHog, Inc. to understand how the Service is used. We send PostHog event names and non-secret properties we choose (for example, Control Mode selected, a duration bucket, whether a Viewing/Control/Claim/Public Crowd Link was copied, whether a lock was started, and Crowd Key vote events). We configure the integration to mask form inputs and sensitive on-page text (including Release Combinations, pleas, and similar fields) and not to send bearer Access Link tokens as analytics properties. We do not use PostHog for advertising.
  
  PostHog may also collect technical data through its own product, including a browser-assigned identifier, device and browser characteristics, page paths, cookies or local storage, and session recordings. That collection is described in PostHog’s privacy policy. Masking reduces, but does not eliminate, the chance that sensitive text appears in recordings.

We do not operate first-party advertising pixels. We enable PostHog to operate and improve the Service, not to sell personal information or to run cross-site ads.

4.4 Information we do not intentionally collect

• We do not require government ID, date of birth, phone number, or postal address to create a timer.
• We do not process payment card numbers on our servers unless and until a payment feature is enabled and described here or in checkout terms.
• We do not knowingly collect personal information from anyone under 18.

5. How We Use Information

We use personal information to:

1. provide, operate, maintain, and improve the Service;
2. create and display timers, messages, Release Combinations, Crowd Key pages, and related features;
3. authenticate access through bearer Access Links and, when available, accounts and sessions;
4. enable Keyholder control, viewing access, control-transfer / claim flows, and Crowd Key voting;
5. limit duplicate Crowd Key votes and reduce abuse;
6. send transactional emails you request (such as emailing a timer link) and account-related notices, when those features are available;
7. save timers to an optional account and show your saved locks, when accounts are available;
8. secure the Service, prevent abuse, detect fraud, debug issues, and protect users and Simply Locked;
9. enforce our Terms of Service and other policies, including recognizing that you took a Terms-acceptance action;
10. comply with law, respond to lawful requests, and establish, exercise, or defend legal claims;
11. communicate with you about the Service, including material changes to this Policy or the Terms; and
12. understand product usage through analytics so we can improve the Service.

We do not sell your personal information.

We do not share personal information for cross-context behavioral advertising as that term is defined under the California Consumer Privacy Act as amended by the CPRA (“CCPA/CPRA”), and we do not use personal information for targeted advertising based on cross-site tracking.

6. Legal Bases for Processing (EEA, UK, and Similar Laws)

If you are in the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction that requires a “lawful basis,” we process personal information on one or more of the following bases:

• Contract performance. Processing needed to provide the Service you request, including creating timers, operating bearer Access Links, Crowd Key, and Release Combinations, and, when those features are available, optional accounts and emailing links you ask us to send.
• Legitimate interests. Processing needed to secure, debug, prevent abuse of, operate, and improve the Service, including product analytics when enabled and Crowd Key antifraud hashing; to protect Simply Locked and users; and to enforce our agreements, balanced against your rights and interests.
• Consent. Where consent is the applicable basis, including for certain optional communications or for processing special-category / sensitive information that you voluntarily submit to use adult-oriented features. You may withdraw consent where consent is the basis, without affecting the lawfulness of processing before withdrawal. Withdrawal may prevent us from providing features that depend on that processing.
• Legal obligation. Processing needed to comply with applicable law.
• Legal claims. Processing needed to establish, exercise, or defend legal claims, where applicable.

7. How Information Is Shared

We share personal information only as described below.

7.1 With other participants you choose

The Service is designed for sharing. If you send someone a Viewing Link, Control Link, Claim Link, or Public Crowd Link, that person can access the information and permissions associated with that link. Simply Locked does not control how recipients store, forward, screenshot, or republish links you give them.

Choosing The crowd means you authorize public display of limited timer status and any plea or display name you provide to visitors of the Public Crowd Link. Vote effects may be visible to the Locked Person and other Participants with appropriate Access Links.

7.2 Service providers / processors

We use vendors that process information on our behalf to host, deliver, secure, and operate the Service. Depending on configuration, these may include:

• Cloud hosting. Amazon Web Services / AWS Lightsail (or successor hosting providers) for application hosting and database storage.
• Edge / DNS / security. Cloudflare for DNS, HTTPS, proxying, caching, and related network security.
• Email delivery. Transactional email providers such as Amazon SES (or successor providers) when email features are enabled.
• Payment processors. Third-party checkout providers, if and when paid features are enabled.
• Front-end CDNs. Providers that serve fonts or CSS frameworks loaded by the browser.
• Product analytics. PostHog, Inc. (US Cloud), a third-party analytics and session-replay service described in Section 4.3. When enabled, we disclose event names and non-secret usage properties to PostHog so we can understand how the Service is used. PostHog’s software may also collect additional technical and session-replay data under PostHog’s privacy policy.

Some of these providers process information on our behalf to host, deliver, or operate the Service. PostHog and front-end CDNs may also collect information through their own software or systems, as described in their privacy policies. We use PostHog for our own product analytics, not to sell personal information or to run cross-site ads.

7.3 Legal, safety, and business transfers

We may disclose information if we reasonably believe disclosure is necessary to:

• comply with law, regulation, legal process, or governmental request;
• enforce our Terms or investigate potential violations;
• detect, prevent, or address fraud, security, or technical issues;
• protect the rights, property, or safety of Simply Locked, users, or the public; or
• complete a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, in which case personal information may be transferred as part of that transaction subject to applicable law and continued protection consistent with this Policy or successor notice.

7.4 With your direction

We may share information when you ask us to or when you otherwise consent.

8. Cookies, Sessions, and Local Storage

We use the following categories of cookies and similar technologies:

• Strictly necessary. Session cookies used to keep you signed in or preserve short-lived UI state; CSRF cookies used to protect forms from cross-site request forgery; a Terms-acceptance cookie (currently named sl_legal_ack) set when you take an acceptance action so we do not re-prompt that browser; and Crowd Key voter cookies used to recognize prior votes on a challenge. The acceptance cookie stores an acknowledgment flag, not your Access Links or message content. It is typically stored for up to one year. These cookies are required for the Service to function securely and to operate acceptance and Crowd Key flows.
• Local browser storage. The Service may store non-essential UI preferences in your browser’s localStorage or sessionStorage (for example, whether a share panel was completed, whether a waiting state should be shown, Crowd Key toast state, or whether an email-backup prompt was dismissed). This data remains on your device unless you clear it.
• Analytics. When PostHog is enabled, PostHog may set a cookie and use localStorage to recognize returning browsers, measure usage, and record sessions, as described in PostHog’s privacy policy. These are not advertising cookies. You can clear or block them with your browser.

We do not use advertising cookies or third-party advertising trackers. You can control cookies through your browser settings. Blocking necessary cookies may break login, form submission, Crowd Key vote limits, or other features.

9. Bearer Links Are Credentials

Viewing Links, Control Links, Claim Links, Public Crowd Links, and similar tokens are secrets relative to their permissions. Anyone who has the link may be able to view, control, or vote on the associated timer according to those permissions.

You are responsible for:

• deciding who receives each link;
• keeping private Control Links, Claim Links, and private Viewing Links confidential;
• understanding that choosing The crowd intentionally authorizes wider circulation of the Public Crowd Link;
• avoiding public posting of private links; and
• understanding that screenshots, forwards, browser history, referrers, and shared devices can expose links.

If you believe a private link has been compromised, contact us at [email protected].

10. Email Communications

If email-link backup is available and you request an emailed timer link, we will send a transactional message containing the link you requested and, where applicable, a time-limited account-creation link. That email necessarily contains a credential-like URL. Protect your email inbox accordingly.

We may also send transactional or service emails related to accounts, security, or legal notices when those features apply.

We do not send marketing emails. If we introduce them, we will provide required notices and unsubscribe mechanisms.

11. Data Retention

We retain personal information for as long as reasonably necessary to provide the Service, fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements.

In practice:

• Timers, Release Combinations, unlock messages, and related records are retained while the timer remains on our systems, including after a timer has ended, unless we delete them in response to a verified deletion request or as part of ordinary operations.
• Crowd Key challenges and votes (including hashed voter and IP signals) are retained with the associated timer records unless deleted as above.
• Optional accounts are retained until you request deletion or the account is otherwise closed, subject to residual records we must keep. Account deletion, when accounts are available, is handled through a verified request to our privacy contact.
• Email verify / create-account tokens are retained for a limited period needed to complete account creation and prevent abuse, and may be invalidated after use or expiry.
• Security, server, and proxy logs may be retained for a limited period for security, debugging, and abuse prevention, according to our and our providers’ operational practices. Logs of a Terms-acceptance or Crowd Key vote request may include IP address, user-agent, and timestamp.
• Terms-acceptance cookie is stored in your browser for up to one year, or until you clear cookies.

When we delete information, residual copies may remain for a period in backups or disaster recovery systems until those copies are rotated out in the ordinary course.

Deletion of timer or unlock data may permanently remove software access to a Release Combination or release message. That is another reason the Terms require an independent emergency-release method.

12. Security

We implement technical and organizational measures designed to protect personal information, including HTTPS/TLS in transit, access controls on production systems, hashed account passwords when accounts are used, strong random tokens for bearer Access Links, hashed Crowd Key voter signals, and analytics masking for sensitive fields where configured.

No method of transmission or storage is completely secure. We cannot guarantee absolute security. You are responsible for safeguarding your devices, email accounts, passwords, private Access Links, and Release Combinations.

If we become aware of a personal-data breach that requires notice under applicable law, we will notify affected users and/or regulators as required.

13. International Transfers

Simply Locked is operated from the United States. Personal information is processed and stored in the United States and may be processed in other countries where our service providers operate.

If you access the Service from outside the United States, you understand that your information may be transferred to, stored in, and processed in the United States and other jurisdictions that may have different data-protection laws than your country of residence.

Where legally required, we will use appropriate transfer safeguards. You may contact us for more information about applicable safeguards.

14. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to certain processing of your personal information, and to appeal a refusal. You may also have the right to lodge a complaint with a supervisory authority.

To exercise available rights, email:

[email protected]

We may need to verify your identity before fulfilling a request. For account data, we may verify through the registered email or login. For anonymous timers, we may require information sufficient to locate the record without accepting unauthenticated requests that could expose another person’s timer. We will respond within the time required by applicable law.

We will not discriminate against you for exercising privacy rights conferred by applicable law.

Some features are provided only if certain information is processed. If you ask us to delete information required to operate a timer, Crowd Key challenge, Release Combination, or account, we may no longer be able to provide that feature, and related Access Links may stop working.

15. California Privacy Disclosures (CCPA/CPRA)

If you are a California resident, the following additional disclosures apply.

15.1 Categories of personal information

In the preceding 12 months, we may have collected the following categories:

• identifiers (such as email address, account ID, timer ID, online identifiers, Crowd Key voter cookies, and the Terms-acceptance cookie);
• customer records information (such as account email, when accounts are used);
• internet or other electronic network activity (such as interactions with the Service, Crowd Key votes, technical logs, and product analytics, including session recordings when PostHog is enabled);
• geolocation data at a coarse level derived from IP address by infrastructure providers; and
• sensitive personal information, which may include account login credentials and content that may reveal intimate adult preferences or activity you voluntarily submit, including Release Combinations and unlock messages.

15.2 Sources, purposes, and disclosure

• Sources: you; your browser/device; other Participants you share links with; Crowd Key visitors; and service providers.
• Purposes: the purposes described in Section 5.
• Disclosure for business purposes: to the providers described in Section 7 (hosting, security/CDN, email, front-end CDNs, payment processors when used, and product analytics / PostHog when enabled).

We do not sell personal information and do not share personal information for cross-context behavioral advertising. We do not have actual knowledge that we sell or share the personal information of consumers under 16.

We use sensitive personal information only as reasonably necessary to provide the Service, resist malicious or illegal actions, ensure security and integrity, and comply with law. Because our use is limited to those permitted purposes, we do not offer a separate “Limit the Use of My Sensitive Personal Information” control beyond verified deletion requests and ordinary product choices (such as not submitting optional messages, not choosing The crowd, or not creating an account).

15.3 Your California rights

Subject to legal exceptions, California residents may request to:

• know the categories and specific pieces of personal information we collected;
• delete personal information;
• correct inaccurate personal information;
• opt out of sale or sharing (not applicable because we do not sell or share as defined); and
• not be discriminated against for exercising CCPA/CPRA rights.

Submit requests to [email protected] with “California Privacy Request” in the subject line. You may use an authorized agent as permitted by law; we may require proof of authorization and identity verification. We will respond within the statutory timeline (generally 45 days, extendable as allowed by law).

Shine the Light: we do not disclose personal information to third parties for their own direct marketing purposes.

16. Other U.S. State Privacy Rights

Residents of certain other U.S. states (including, where applicable, Virginia, Colorado, Connecticut, Utah, Oregon, Texas, and others with comprehensive privacy laws) may have similar rights to access, delete, correct, obtain a portable copy of personal data, or opt out of targeted advertising, sale, or certain profiling.

Because we do not sell personal information or engage in cross-context targeted advertising, the primary practical rights for most users are access, correction, deletion, and appeal. To exercise these rights, contact [email protected]. If we deny a request, you may appeal by replying to our decision email with “Privacy Appeal” in the subject line.

17. EEA, UK, and Swiss Rights

If the GDPR, UK GDPR, or Swiss law applies, you may have the right to access, rectify, erase, restrict, or object to certain processing; the right to data portability; the right to withdraw consent where consent is the basis; and the right to lodge a complaint with your local supervisory authority.

To exercise these rights, contact [email protected]. We will respond within one month, subject to permitted extensions for complex requests.

18. Canadian Privacy Rights

If you are in Canada, you may have rights under PIPEDA and, if you are in Québec, additional rights under Law 25, including access, correction, and (where applicable) portability. Contact our privacy contact above to exercise these rights or to reach the person responsible for personal-information protection.

19. Children's Privacy

The Service is strictly for users who are at least 18 years old and the age of majority where they live. We do not knowingly collect personal information from anyone under 18.

If we learn that we have collected personal information from a minor, we will delete it promptly. Contact [email protected] if you believe a minor has used the Service.

20. Automated Decision-Making

We do not currently use automated decision-making that produces legal or similarly significant effects about you within the meaning of GDPR Article 22. Security and abuse-prevention systems operated by us or our providers may automatically flag or rate-limit traffic, and Crowd Key may automatically apply vote deltas within Service limits. If access is restricted and you believe this was in error, contact us for human review.

21. Do Not Track and Global Privacy Control

Some browsers offer a “Do Not Track” signal. There is no consistent industry standard for responding to such signals. Our practices are described in this Policy regardless of Do Not Track settings. We do not use cross-site advertising trackers.

Some browsers also send a Global Privacy Control (GPC) signal. We do not sell personal information or share it for cross-context behavioral advertising, so we do not currently treat GPC as an opt-out of sale or sharing.

22. Third-Party Links and Services

The Service may link to third-party sites or load third-party software (including PostHog analytics, front-end CDNs, and similar infrastructure). Those companies’ privacy practices are governed by their own policies. Information they collect as independent services is their processing, not ours, except where applicable law provides otherwise. We are not responsible for third-party practices outside our control.

23. Changes to This Policy

We may update this Privacy Policy from time to time.

If we make a material change, we will provide notice in a manner reasonably designed to bring the change to your attention, such as by updating the effective date on this page, posting a notice on the Service, or sending an email where appropriate. The effective date at the top indicates when the current version became effective.

Continued use of the Service after a material change constitutes acknowledgment of the updated Policy to the maximum extent permitted by law.

24. Contact

Privacy questions and requests:

Security matters: [email protected]

General legal contact: [email protected]