Privacy Policy

LockedIn Technologies, LLC ("LockedIn," "we," "us," or "our") provides a mobile application and administrative platform that enables K–12 schools to enforce phone-free instructional hours on campus. This Privacy Policy describes how we collect, use, store, protect, and dispose of information when you use the LockedIn application, the LockedIn administrative dashboard, or visit our website at lockedinapp.co.

Our guiding principle is simple: we collect only what is strictly necessary to make phone-free school hours work — nothing more.

This policy covers two separate things, and we keep them clearly distinct: (1) the LockedIn Product — our student app and school admin dashboard, addressed in Sections 1–12; and (2) our marketing website at lockedinapp.co, addressed in Section 13. Our strict "only what is necessary" standard governs the Product and all student data. The marketing website is a different context, and we say so plainly where it differs — but even there, we run no advertising profiles, we sell nothing, and the one website tool that shares visitor data (Section 13) switches off when your browser sends a privacy signal. None of it ever touches student data.

1. Information We Collect

Information You Provide

• Contact information: Name and email address submitted through our contact form or during onboarding.
• School information: School name, district, and role provided during onboarding.
• Communications: Messages and inquiries you send to us.

Information Collected by the Student App

The LockedIn student application collects only the minimum data necessary to provide the phone-free enforcement service. We collect:

• Account information: Student name and email address for account creation, authentication, and identification within the school's admin dashboard.
• Device information: Basic device identifiers and configuration details used for compatibility verification, device registration, and technical troubleshooting.
• Compliance signals: Signals indicating whether the device is being used in compliance with the school's phone-free policy during school hours, including connectivity and app status indicators.
• Push notification token: A device-level token used exclusively to deliver lock-in reminders and compliance status notifications.
• Location data: The app uses location services for exactly one purpose: to work out whether the student's device is inside the school campus boundary. We do not store where a student is. Since August 2026 no coordinates are kept at all — what we retain is whether the device was on or off campus, how reliable that reading was, and how far inside or outside the boundary it fell, with the outside figure capped at 500 meters so it can never describe where a student went. This is not continuous tracking. Arrivals and departures are reported to the app by the phone's operating system, which watches the boundary on its behalf. When it reports an arrival during the school day, the app takes one quick reading to confirm it, and that reading stays on the phone. While the app is open during the school day it also confirms campus state directly, unless the phone has already established that it is away from campus. After the school day, and on days with no school, the app is silent about location: it takes no reading and sends nothing location-derived, and a boundary crossing the operating system reports at those hours stays on the phone. That is the rule at day schools on the standard settings. Boarding schools, and a school that asks LockedIn to keep after-hours reporting, still receive on-campus or off-campus status after hours, but never a position. Location event records are deleted after 90 days. We do not sell, share, or use location data for advertising, analytics, or any purpose other than school campus compliance enforcement.
• Device integrity signals: The app collects signals to verify the device is a genuine, active phone and to detect circumvention attempts — ensuring the integrity of the compliance enforcement service.
• Screen Time / enforcement signals (shield-based schools only): At schools that enforce their policy by shielding apps on the device, LockedIn uses the phone's built-in restriction frameworks (Apple Screen Time on iOS; on Android, an Accessibility setting (and, at schools with daily allowances, usage access)) to apply the shield while the student is on campus. From those frameworks we receive, and store, only coarse enforcement state: whether the permission is granted, whether the shield is currently applied, a four-level "how much of today's allowance remains" tier for each category the school has given a daily allowance (fresh / half / low / exhausted), and the blocked-app tripwire's readings, which name at most the category (social, games or entertainment) and the minutes its meter counted — on iPhone from app version 43.9 as a timeline of two-minute marks during the school's lock. A reading counts against a student only after the school day ends, and only when it shows steady, real-time use under strict rules; the timeline itself is shown to neither the school nor the student. Where app-by-app locking is in use, we receive only whether each blocked category is covered. We do not receive the identity of apps a student opens or has installed, or any record of what the student did inside an app. The per-app selections a student makes on the device (Apple's app tokens) never leave the phone.

Optional Features (Only When Your School Enables Them)

• Emergency Mode: Disabled by default, and activated by a school only during a declared emergency (for example, a lockdown or evacuation). While active, the app collects higher-frequency location signals from students who are on campus — which, for this single life-safety purpose, may be collected outside school hours during a real emergency (a drill outside school hours locates no one) — solely to help locate them during the emergency. A student who is away from campus is not located, drills included; a student who arrives during the session begins reporting then, and one who leaves stops. The one exception is a student who affirmatively requests help, whose position accompanies that request wherever they are, because locating them is its purpose. During the session a student can also send school staff a short message, with an optional photo or video. Collection stops when the school closes the emergency session — our servers accept no location after it, and a phone that misses the all-clear stops on its own within 15 minutes — every position collected during it is erased at that moment, and every access is recorded in an immutable audit log.
• On-device Voice Memos & Camera: Optional tools a student can use to record a quick personal audio note or take a photo. These stay only in the app on the student's own device — voice memos and photos are never uploaded to LockedIn, to school administrators, or to anyone else. The microphone is never used by Emergency Mode.

In-app messaging has been withdrawn. LockedIn retired its optional in-app messaging feature on September 2, 2026, and no new messages are collected. Messages sent before then are deleted on the 90-day schedule in Section 9, and none remain after December 1, 2026.

Information Provided by Schools

School administrators may optionally provide supplemental student information (e.g., grade level) to support filtering and organization within the admin dashboard. This data originates from the school's student information system and is not collected from student devices.

2. What We Do NOT Collect

LockedIn operates within the standard application sandbox enforced by iOS and Android. We affirm that we do not collect, process, store, or transmit any of the following, and for most of them the app has no technical capability to do so:

• Text messages, phone calls, or call logs
• Microphone audio or your photo library — the optional on-device Voice Memos and Camera tools never upload anything to us (see Section 1)
• Browsing history, search queries, or bookmarks
• Social media accounts, profiles, or activity
• App install lists, or per-app usage detail. At shield-based schools we receive only the coarse enforcement signals described in Section 1 — whether the shield is applied, a four-level allowance tier per category, and the blocked-app tripwire's per-category readings — never which apps were opened or installed, or what was done in them. The one exception is on Android: the app's tamper reports name installed apps in five classes that can be used to defeat the lock (apps that can draw over the screen, apps known to fake GPS, and third-party accessibility services, notification listeners and device-administrator apps). Nothing else about a student's apps is reported, and no such report exists on iPhone
• Contacts, calendars, reminders, notes, or files
• Continuous GPS tracking or movement history
• Location outside of school hours, at day schools on the standard settings — with the single narrow exception of an active Emergency Mode session, which locates students on campus, plus any student who affirmatively requests help during one (see Section 1). Boarding schools, and a school that asks LockedIn to keep after-hours reporting, receive on-campus or off-campus status at any hour, never a position
• Biometric data (fingerprints, face scans, voice prints)
• Health or fitness data. LockedIn does not ask for the Motion & Fitness permission and collects no motion-sensor or barometer readings
• Keyboard input, clipboard content, or keystroke logs. The only text a student types that LockedIn receives is what they choose to submit in LockedIn's own forms: the sign-in form, the help assistant, an Emergency Mode message, or, where the school enables it, the Report a Concern form
• Network traffic or browsing data
• Any personal content on the student's device

Camera access is optional and school-controlled. If a school enables the Camera app, students must grant camera permission on their own device before use. Photos taken are saved locally to the student's Photos/Gallery and are not uploaded to LockedIn.

In normal day-to-day use, LockedIn knows two things about a student: is the device on campus, and is the device locked — plus, at shield-based schools, the coarse enforcement signals described in Section 1. The optional features above do more only when your school deliberately turns them on.

3. How We Use Information

We use the information we collect exclusively for the following purposes:

• Enforcing phone-free policies during school hours
• Determining campus presence using device location data (geofencing) to activate and deactivate enforcement only while the student is on campus during school hours
• Providing real-time compliance monitoring to authorized school administrators
• Generating compliance reports for schools and districts
• Creating and authenticating student accounts and managing device registration workflows
• Delivering push notifications for lock-in reminders, compliance alerts, and service-critical messages
• Detecting and alerting administrators to circumvention attempts
• Diagnosing and resolving technical issues
• Responding to inquiries and providing customer support
• Improving and maintaining the reliability of our services

4. Advertising and Commercialization Prohibitions

LockedIn maintains absolute, unconditional prohibitions on the following:

• Using, disclosing, or selling student data to inform, influence, or enable targeted advertising
• Developing a profile of any student, family member, or guardian for any purpose other than providing the contracted service
• Selling, renting, leasing, trading, or otherwise commercially distributing student data to any third party — including data brokers, advertisers, or marketing firms
• Using student data to build or contribute to commercial products or databases unrelated to the contracted service
• Training general-purpose machine learning models on student data

These prohibitions are absolute and without exception.

5. Data Ownership

All student data is and remains the property of the school. LockedIn acts as a data processor and School Official under the school's direct control and supervision with respect to student data.

• All copies, modifications, and derivatives of student data are subject to this policy
• All intellectual property rights in student data remain the exclusive property of the school
• LockedIn acquires no ownership interest in student data through the provision of services
• School administrators can delete all student data for their school directly from the admin dashboard at any time

6. Data Sharing and Third-Party Subprocessors

We do not sell, rent, or trade personal information to third parties. We share information only in the following limited circumstances:

Sharing with Schools

Compliance data and reports — including location-derived on-campus or off-campus status — are shared with authorized school administrators as part of the service. Raw GPS coordinates are never exposed to school administrators; only campus presence status is shared.

Third-Party Subprocessors

LockedIn engages a limited number of subprocessors to provide core services: cloud hosting and storage, push notification delivery, transactional email, error monitoring, device integrity checks, roster sync, and the optional assistants. Each subprocessor receives only the minimum data necessary to perform its specific function. Where we deliver a violation notice by email or push notification, the notice itself carries the student's name and the nature of the issue — that is the content of the message being delivered, not a separate transfer of data, and it reaches only the delivery provider and the intended recipient. Apart from our hosting providers, which hold all student data in encrypted form, no subprocessor receives location history, heartbeat data, or voice memo audio, or LockedIn's compliance records in bulk. Beyond the content of a notice, the one subprocessor that receives compliance data is Anthropic, for the optional dashboard assistant, and only under pseudonyms: never a student's name or email address (see the table below). All data is hosted within the United States.

Our current subprocessors are:

This list is also provided to partner schools as part of our data sharing agreements. All data is hosted within the United States.

All subprocessors are bound by written agreements requiring them to protect student data in a manner no less stringent than this policy, use data solely for their designated function, and refrain from selling, sharing, or re-disclosing student data. LockedIn will notify partner schools in writing at least thirty (30) days before engaging any new subprocessor that will process student data. Where one of our existing providers engages a sub-processor of its own, we pass that notice through promptly on receipt — within whatever notice period our provider gives us, which may be shorter than thirty days.

Legal Requirements

We may disclose information if required by law, court order, or governmental regulation. If LockedIn receives a request for student data from law enforcement or another government entity, we will notify the affected school in advance of any compelled disclosure, unless lawfully directed not to do so.

7. Data Security

LockedIn's security program is aligned with the NIST Cybersecurity Framework (CSF) Version 2 and incorporates controls from the CIS Critical Security Controls (v8). Our infrastructure runs on Render, in its US-Oregon region. Render's own infrastructure providers are Amazon Web Services, Google Cloud Platform, Cloudflare, and ClickHouse — all located in the United States. Render holds SOC 2 Type II and ISO 27001, and its major cloud providers additionally hold FedRAMP authorization — to be clear, those are our hosting providers' certifications, not LockedIn's own. LockedIn's independent SOC 2 Type II attestation is in progress.

Encryption

• In transit: TLS 1.2 or higher on all connections
• At rest: AES-256 encryption for all student data stored in databases and backups
• On device: Authentication credentials stored using platform-native secure storage
• Passwords: Cryptographically hashed — never stored in plaintext

Infrastructure and Network

• All data stored within the United States — data never leaves the country
• All endpoints served exclusively over HTTPS
• Databases reside within private networks with no public access
• Firewall rules, origin allowlisting, rate limiting, and HTTP security headers enforced across all services

Access Controls

• Role-based access controls (RBAC) enforcing the principle of least privilege across all systems
• Multi-factor authentication (MFA) required for all administrative and infrastructure access
• All access to student data is logged in a persistent audit trail — queryable and exportable for compliance audits
• Confidentiality agreements executed by all personnel with access to student data
• Access revoked immediately upon termination of employment or contract

Mobile App Integrity

The LockedIn mobile application implements multiple layers of device integrity verification to detect and prevent circumvention attempts, including tamper detection, environment verification, and location spoofing prevention.

Ongoing Security Practices

• Automated daily encrypted backups with the same encryption and access controls as primary data
• Automated vulnerability scanning of application code and infrastructure dependencies
• Critical security patches applied within 72 hours
• Secure software development lifecycle (SDLC) practices including code review and dependency auditing
• Security policies and procedures documented, reviewed, and updated at least annually
• Privacy and security training conducted for all personnel at onboarding and annually thereafter

8. Data Breach Notification

In the event of a confirmed data breach involving student data, LockedIn will:

• Notify the affected school immediately, and no later than seventy-two (72) hours after confirmation of the incident
• Provide a detailed description of the incident, the types of data affected, containment and remediation actions taken, measures to prevent recurrence, and guidance for affected individuals
• Conduct a forensic investigation and provide a copy of the forensic report to the affected school
• Cooperate with the school to notify affected parents, legal guardians, or eligible students as required by applicable law
• Bear full responsibility and liability for the breach as specified in the applicable data sharing agreement

9. Data Retention

LockedIn retains student data only for as long as necessary to provide the contracted service. Specific retention periods are:

Disposition Upon Termination

When a school discontinues service, LockedIn deletes its student data on a fixed schedule — the school does not have to ask:

• LockedIn retains the school's data for no less than sixty (60) days following termination, so the school has time to request and retrieve a comprehensive export via the administrative dashboard
• LockedIn deletes student data from its production systems within ninety (90) days of termination or expiration, whether or not the school directs it, except for archival backups and records retained for legal, audit, security, or dispute-resolution purposes
• Separately, upon the school's written direction to delete at any time, LockedIn will delete the affected data within a reasonable time — typically within thirty (30) days of receiving the direction
• Backup-resident copies are removed as backups roll over within the backup-retention window
• Upon completion of a school-directed deletion, LockedIn will confirm by email that the requested deletion has been performed
• If the school has executed a state-standard or district-specific Data Sharing Agreement (for example, HI-DSA or SDPC NDPA) with stricter destruction obligations, those contractual terms govern

On-Demand Deletion

School administrators can delete individual student accounts and all associated data directly from the LockedIn admin dashboard at any time. Schools may also submit a written directive for partial or complete data disposition at any time during the service term — LockedIn will complete such requests within a reasonable time, typically within thirty (30) days of receiving the direction.

10. Student Privacy and Regulatory Compliance

LockedIn is purpose-built for K–12 education and designed with student privacy at its foundation. We maintain compliance with applicable federal and state student data privacy laws.

Federal Compliance

State Compliance

Student online privacy laws are written at the state level, and they apply to LockedIn directly as an "operator" in every state where we serve students. We comply with them.

• Michigan — Student Online Personal Protection Act (Act 368 of 2016, MCL 388.1291–388.1295): no targeted advertising, no student profiling beyond K-12 school purposes, no sale or rental of covered information, reasonable security, and deletion of student data at the school's request. We also meet the Revised School Code § 380.1136 requirement that vendor contracts carry express privacy provisions and express penalties for non-compliance, and the Identity Theft Protection Act's breach-notification standard.
• California — SOPIPA (Bus. & Prof. Code §§ 22584–22584.5): no targeted advertising, no sale of student data, no unauthorized profiling. Also CalOPPA and CCPA/CPRA as applicable to minors — see Section 14.
• Hawai'i — Chapter 487N HRS, Chapter 487G HRS, and Chapter 8-34 HAR.

Other states impose their own vendor-contracting requirements — New York Education Law § 2-d, Illinois SOPPA, the Colorado Student Data Transparency and Security Act, and Connecticut Public Act 16-189 among them. We address those at the point we engage a district in that state, and we do not claim compliance with regimes we are not yet operating under.

Industry Standards and Programs

How we word these. We say "compliant" only for laws that place obligations on LockedIn directly, and that we follow. We say "aligned" when we have assessed ourselves against a published framework and implemented the corresponding controls — that is our own assessment, not certification by the issuing body. LockedIn does not currently hold any third-party privacy certification or seal, and we will not claim one we have not earned.

Data Sharing Agreements

LockedIn is prepared to execute state-standard data sharing agreements, including the SDPC National Data Privacy Agreement (NDPA) with Exhibit G — Michigan State-Specific Terms, the Hawaii Standard Data Sharing Agreement (HI-DSA), and state-specific or district-specific agreements as required.

Additional Protections

• No MDM required: LockedIn does not require Mobile Device Management enrollment or device ownership by the school
• Minimal data collection: We collect only the data necessary to provide our compliance enforcement service — nothing more
• Application sandbox: The app operates within the standard OS-level sandbox and has no technical capability to access personal content on the device

11. De-Identified and Aggregate Data

When LockedIn de-identifies student data, we remove or obscure all direct and indirect identifiers such that the remaining data cannot reasonably identify a specific individual. We apply the FERPA de-identification standard.

• De-identified data may be used to assist schools in conducting research, demonstrate aggregate service effectiveness (e.g., compliance rates), and improve our educational services
• LockedIn will never attempt to re-identify de-identified data
• De-identified data will not be transferred to any third party unless that party agrees in writing not to attempt re-identification and the school has provided prior written consent

12. Your Rights

LockedIn supports the following rights for students, parents, and legal guardians, as required by FERPA and applicable state law:

• Right of access: Request to review the student data we hold. LockedIn will respond within forty-five (45) days, or within the timeframe required by applicable state law, whichever is sooner.
• Right of correction: Request correction of inaccurate information
• Right of deletion: Request deletion of student data at any time. School administrators can also delete accounts directly from the LockedIn dashboard.
• Right to data portability: Upon request, LockedIn will provide student data in a structured, commonly used, machine-readable format to facilitate transfer
• Right to refuse further collection: A parent or legal guardian may refuse to permit LockedIn's further collection or use of their child's information, and may direct us to delete what we already hold. Because LockedIn works by verifying that a student's device is on campus during school hours, a student whose parent exercises this right cannot continue in the program — the school will withdraw the student from LockedIn and manage their device under its own phone policy instead. Exercising this right never affects the student's enrollment, grades, or standing at the school.
• Right to opt out: Opt out of certain data processing activities

To exercise any of these rights, contact your school administrator or email us at privacy@lockedinapp.co.

13. Our Marketing Website (lockedinapp.co)

First, the point that matters most: no third-party analytics, advertising, or tracking tools run inside the LockedIn student app or the school admin dashboard. Student data is never sent to any analytics or advertising provider — full stop.

This section is about our public marketing website, which is a different context from the Product and is kept completely separate from student data. Nothing described here is ever combined with data from the LockedIn app or admin dashboard.

What the website collects

• Usage data: IP address, browser and device type, pages visited, referring links, time on page, and how far a page was scrolled — to understand how visitors find and use the site.
• Contact details you choose to share: if you submit a form or book a meeting, the name, work email, phone, and message you provide — used only to respond to you and follow up about LockedIn.

Analytics and advertising — and the limits we put on it

Like most company websites, we measure which pages and campaigns are working using Google Analytics and Google Ads conversion measurement, plus a privacy-preserving, cookieless analytics tool. We have deliberately constrained these so they work for us as service providers, not as advertising partners:

• We do not sell personal information (as defined under California's CCPA/CPRA), and have not done so in the past twelve (12) months. The only website data we may "share" is the visitor identification described below.
• We do not use personal information for targeted, behavioral, or cross-context behavioral advertising, and we do not build retargeting or "customer match" audiences from our visitors.
• We enable Google's Restricted Data Processing, so Google may process this data only on our behalf for measurement — not for its own purposes.
• We honor the Global Privacy Control signal automatically: if your browser sends it, advertising cookies and identifiers are switched off and visitor identification does not run.
• When you submit a form on the website, Google's conversion measurement may receive a hashed (scrambled) copy of the email address or phone number you entered, so the conversion can be counted. It is used only for that measurement, under Restricted Data Processing.

Visitor identification for sales follow-up

We use Vector, a third-party service, to learn which schools and people visit our website so our team can follow up with those interested in LockedIn. Vector's script is loaded through Artisan, the sales platform we use, which also receives the address of each page you view, how long you are active on it, and how far you scroll, so our team can see which pages a visitor read. For U.S. visitors, Vector matches the visit against its own business-contact data and against identity data from its partners, including LiveIntent (Vector's script also carries code from ID5, another identity provider). These partners may set cookies to recognize a returning browser. Vector may then tell us the visitor's name, work email, job title, and organization, along with the pages they viewed. If a U.S. visitor types an email address or name into a form on our website, Vector may also use it to identify them. For visitors elsewhere, it identifies the organization only. We use this only to follow up about LockedIn: not for advertising, and we build no ad audiences from it. Because Vector draws on its own and its partners' data to identify visitors, this may count as "sharing" under the CCPA/CPRA, so we limit it:

• Artisan's loader, and with it Vector, does not run if your browser sends a Global Privacy Control signal, if you are in the UK or EEA, or if you declined cookies on our banner.
• Neither runs on pages written for students and parents: For Parents and the Parent FAQ, the app download pages, the Help Center, Student Feedback, and the anonymous Report a Concern form.
• Neither Artisan nor Vector receives anything from the LockedIn app or admin dashboard, and nothing they tell us is ever added to student records.
• You can opt out at any time; see "Opting out of sharing" in Section 14.

Cookies and your choices

The website uses cookies and similar technologies for the measurement described above. Because U.S. privacy laws are opt-out (not opt-in), U.S. visitors see no consent pop-up — but you stay in control: send a Global Privacy Control signal, use your browser's cookie controls, or email privacy@lockedinapp.co to exercise any of the rights in Section 14.

Visitors in the UK and EEA are asked first. Until you accept, we set no analytics cookies, and accepting allows analytics cookies only: no advertising cookies, and Google Ads does not run for you. You can change your choice at any time with Cookie settings in the site footer.

When we checked from a U.S. time zone on October 22, 2026, a visit to the website stored the following. Those marked "U.S. visitors only" are not set for visitors in the UK or EEA, or when your browser sends a Global Privacy Control signal. The names can change when these providers update their code.

• Set on lockedinapp.co (first-party): _ga and _ga_* (Google Analytics, to count visits; in the UK and EEA only after you accept); _gcl_au and _gcl_ls (Google Ads conversion measurement, U.S. visitors only); and _lc2_fpi, _lc2_fpi_js, _li_dcdm_c, _li_duid and browser-storage keys beginning vector_pixel_ (Vector and Artisan visitor identification, described above, U.S. visitors only).
• Set by another site (third-party): tuid, on a.usbrowserspeed.com, set by Vector’s identity sync (U.S. visitors only).

Global Privacy Control and Do Not Track

We treat a Global Privacy Control ("GPC") signal received from a browser as a valid request to opt out of sale and sharing. When your browser sends it, Artisan's loader and Vector visitor identification do not run, and Google's advertising cookies and identifiers are switched off for your visit. When your browser sends a "Do Not Track" ("DNT") signal, we switch off Google's advertising cookies and identifiers for your visit in the same way. DNT does not, on its own, stop Vector visitor identification, because no industry or legal consensus has emerged on how DNT should be interpreted; to stop it, send a GPC signal or use the opt-out in Section 14. If that changes, we will update this section and the "Last updated" date above. This disclosure is provided under California Business & Professions Code § 22575(b)(5).

14. California and U.S. State Privacy Rights

This section provides additional disclosures for residents of California (under the CCPA/CPRA) and other U.S. states with comprehensive privacy laws. For student data, LockedIn acts as a service provider to the school and a FERPA "School Official," so these requests are generally handled together with your school; requests from website visitors we handle directly.

Categories of personal information we collect

• Identifiers: name, email, school-issued identifiers, device identifiers
• Geolocation: campus-presence location during school hours (Product); emergency-mode location when a school activates it
• Internet / network activity: IP address, app version, pages visited, heartbeat and device-integrity signals
• Professional information: an administrator's role and assigned school; for website visitors identified by Vector (Section 13), job title and organization
• Inferences: compliance status and related attention flags

We do not collect biometric identifiers, financial-account numbers, government-ID numbers, precise location outside school hours (except on campus during an active Emergency Mode session, or from a student who affirmatively requests help during one), or the contents of personal communications.

Sensitive personal information

Precise geolocation — collected during school hours and during Emergency Mode — is "sensitive personal information." We use it only for the limited purpose of providing the service, never to profile a student, for advertising, or for any other purpose. Because our use is already limited to what is strictly necessary, the right to limit the use of sensitive personal information does not change how we process it.

Sale, sharing, and targeted advertising

We do not sell personal information (as defined under the CCPA/CPRA), and we have not done so in the preceding twelve (12) months. On our marketing website only, the Vector visitor identification described in Section 13 may count as "sharing." We never sell or share student data or any data from the LockedIn app or admin dashboard. We do not use personal information for targeted or cross-context behavioral advertising.

Opting out of sharing ("Do Not Sell or Share My Personal Information")

Turn on Global Privacy Control in your browser and neither Artisan's loader nor Vector will run on our website. To also stop use of anything already collected, email privacy@lockedinapp.co with the subject "Do Not Sell or Share" and the email address to exclude. We will stop using Vector data about you, delete what we received, and ask Vector to suppress your contact within fifteen (15) business days. No account or identity verification is needed to opt out.

Your rights

• Know / access the personal information we hold and its sources
• Delete personal information
• Correct inaccurate personal information
• Portability — a copy in a structured, commonly used, machine-readable format
• Limit the use of sensitive personal information (see above)
• Opt out of the sale or sharing of personal information (see "Opting out of sharing" above)
• Non-discrimination for exercising these rights, and the right to appeal our decision where your state provides one

To exercise these rights, contact your school administrator or email privacy@lockedinapp.co. We respond within forty-five (45) days and may extend once by another 45 days with notice. You may use an authorized agent (with written authorization and identity verification). We honor the Global Privacy Control browser signal, and under California's "Shine the Light" law we make no disclosures of personal information to third parties for their own direct marketing.

15. Governance and Accountability

• LockedIn maintains a designated privacy representative responsible for overseeing compliance with this policy and applicable privacy laws, serving as the primary point of contact for school privacy inquiries, and coordinating breach notification and response
• All personnel with access to student data execute confidentiality agreements, complete privacy and security training at onboarding and annually, and are required to report suspected incidents or policy violations immediately
• This policy is reviewed and updated at least annually. Material changes are communicated to partner schools in writing at least thirty (30) days before they take effect.
• We respond to all privacy-related inquiries within five (5) business days

16. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify affected schools in writing at least thirty (30) days before the changes take effect and update the "Last updated" date at the top of this page. We encourage you to review this page periodically.

17. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

• Privacy inquiries: privacy@lockedinapp.co
• Security incidents: security@lockedinapp.co
• General inquiries: hello@lockedinapp.co
• Or use our contact form

The operator collecting and maintaining personal information through our services, including from students under 13, is identified below as required by the Children's Online Privacy Protection Rule (16 C.F.R. § 312.4(d)(1)):

Parents and guardians of students under 13 may also request our COPPA direct notice from their school, or from us at the address above. It describes what we collect from students, how it is used, who receives it, how long it is kept, and how to refuse.