Lockedin.me is a free page for your links. This page says exactly what we store to make it work, what we never store, and how to have it all removed. It is written to be read, not skimmed past.
What we store
- Your account e-mail. It is how you sign in (we send a one-time code to it) and how we reach you about your account.
- Your birthday. Asked once, kept private, used only to check your age band (see "Age, teens and your birthday" below).
- Your page's content. The address you claimed, your name, your picture, your links and the look you chose. You put it there to be public, and it is.
- View and tap counts. How many times your page was opened and each link was tapped, as totals. A visit is recognized by a one-way code that changes every day and is deleted after two days, so one person counts once a day without being identified. The counts hold no IP address, no name and no e-mail address, and you, the page owner, see only these totals.
- A few plain facts about each visit. For the same counted views, taps and shares we record the visitor's country, the kind of device (phone, tablet or desktop), the app or browser family (such as Instagram or Safari), the name of the site they came from and the hour. They are never tied to a name, an e-mail address or a cookie.
- Visitor IP addresses, in security and request logs. Like any web service, we process the IP address of everyone who opens a page or uses the site. Cloudflare, which sits in front of lockedin.me, and Microsoft Azure Application Insights, which logs the requests our servers answer, record it. We keep these logs only as long as we need them for security, fraud prevention and keeping the service running. Cloudflare keeps its own logs under its own retention settings.
- E-mail sign-ups left on your page. If you add a sign-up box, the addresses people leave belong to you, the page owner. We hold them for you and show them in your dashboard; we do not use them ourselves.
- Mobile numbers left on your page. If you add a text sign-up box, the numbers people leave belong to you, the page owner. For each number we keep the exact wording the person agreed to, the time, a one-way code of their network address and the page it came from, so you can show consent. We hold them for you and show them in your dashboard (masked, with a download for you); we do not use them ourselves and we do not send any texts yet.
- Tracking ids you add. If you paste your own Google Analytics 4 or Meta Pixel id into your page, we store the id and load that tool on your page. What it collects is between you and that provider, under their terms.
Cookies and local storage
The dashboard keeps a sign-in token in your browser's local storage so you stay signed in on that device. That is the only thing we put in your browser. We set no advertising cookies and run no advertising trackers of our own on lockedin.me pages.
Visitor IP addresses: why, and what we do not do
We process visitor IP addresses to keep the service secure and running: to spot and block abuse, fraud, scanners and hacking attempts, to limit how often one address can call the service, and to find and fix faults. Our lawful basis is our legitimate interest in the security of the service and its users.
- We do not use IP addresses for advertising or profiling, and we do not sell them.
- We do not show them to page owners. Owners see totals only.
- We do not use them to follow a person from one site to another, and we use no fingerprinting.
- We share them only with the providers below, who process them for us.
Age, teens and your birthday
Lockedin.me is for people 13 and older. We do not knowingly collect personal information from anyone under 13.
- Your birthday. When you sign up we ask for your date of birth. We use it for one thing: to work out whether you are under 13, 13 to 17, or 18 and older, so the right rules apply. We keep it private. It is never shown on your page, never sent to advertisers, never put in analytics, and it is not part of anything a page visitor can see. We keep it only while your account exists and delete it with your account.
- Under 13. If your birthday shows you are under 13, we do not keep an account. The account, any page, your e-mail address and your birthday are deleted immediately, and we do not e-mail you. A page cannot be created or published. If we learn that a child under 13 has an account, we close it and delete the data. A parent or guardian who thinks this has happened can write to legal@lockedin.me and we will delete it.
- Ages 13 to 17. A teen may use Lockedin.me with extra limits to protect privacy: the page is not listed in search engines or in our directory (people with the link can still open it), the e-mail sign-up, text sign-up, call or text, booking, address and opening-hours items are turned off, AI pictures of a person and photo uploads for the AI picture maker are turned off, and paid add-ons are not available. The limits lift automatically at 18. A parent or guardian can ask us to review or delete a teen's page and account at any time by writing to legal@lockedin.me.
- Confirming your age. We ask you to enter your birthday ourselves and rely on it. We do not ask for ID or a photo. If we have reason to doubt a birthday we may ask you to correct it or may close the account.
We follow the U.S. Children's Online Privacy Protection Act (COPPA) by not collecting personal information from children under 13, and we apply the same data-minimizing approach that the EU and UK rules ask for teens.
Text sign-ups: what visitors agree to, and who is responsible
If you leave your number on someone's page. You are only added if you type a US mobile number and tick the box, which starts unticked. The words next to the box say who will text you, that the texts are recurring marketing messages, how often, that message and data rates may apply, that agreeing is not a condition of any purchase, and that you can reply STOP to cancel or HELP for help. The page's owner, not Lockedin.me, decides what to send you. We keep your number, the wording you agreed to, the time and a one-way code of your network address as proof, and we never share the number with anyone for their own marketing. Texting is not switched on yet: nothing is sent today. The box also has an optional e-mail field: if you fill it in we send you one e-mail from Lockedin.me saying what you signed up for, with a link that removes your number in one click. We use that address for that one message only and do not keep it. To be removed, use that link, ask the page's owner, or write to legal@lockedin.mewith the number and the page and we will remove it. A number that asks to stop is kept on a do-not-text list (a one-way code only) so it cannot be added again by mistake.
If you collect numbers on your page. The numbers are yours, and you are responsible for how you use them: only text people who agreed, honor STOP at once, keep to the frequency you stated, and follow the laws and carrier rules that apply to you (in the United States, the Telephone Consumer Protection Act and the CTIA messaging guidelines). The text sign-up is for people 18 or older and for US numbers only; it is not available on a page of someone under 18, and it is never shown on a private page.
Who else sees it
Your published page is public by design. Behind it, your data sits in our hosted service. We use a few providers to run the service; they process data on our behalf and not for their own purposes:
- Cloudflare delivers and protects lockedin.me. It sees each request, including the visitor's IP address.
- Microsoft Azure hosts the service, stores your data and runs Application Insights, our request and visit log.
- E-mail delivery (Azure Communication Services) sends your sign-in codes and sign-up confirmations.
- Stripe takes donations on its own secure page. It collects the card and the e-mail address you enter there; we never see the card number. We keep the amount, the date and the e-mail address you gave Stripe, to send your receipt and keep our records.
We do not sell your data and we do not share it with advertisers. If you add your own Google Analytics or Meta Pixel id, that provider receives what its tool normally collects, as described above.
How to delete
E-mail legal@lockedin.me from the address on your account and say what you want gone: a page, or the whole account. We remove the page, its counts, any sign-ups it collected and your account record. Backups age out on their own shortly after. The same address handles any other request about your data, such as asking what we hold, asking us to correct it, or objecting to how we use it. Security logs that hold an IP address age out on their own after the periods above.
Changes
If this page changes in a way that matters, we say so on the site and update the date at the top.
What changed on 25 October 2026: pages can now have a text sign-up box that collects US mobile numbers with consent. We added what we keep for each number, what visitors agree to, and who is responsible, in "Text sign-ups". Nothing is sent yet.
What changed on 24 October 2026: Lockedin.me is now for people 13 and older. We ask for your birthday when you sign up, keep it private, apply extra limits to pages of people aged 13 to 17, and do not keep accounts of people under 13. The section "Children" is replaced by "Age, teens and your birthday".
What changed on 20 October 2026: we now say plainly that visitor IP addresses are processed and kept in security and request logs (Cloudflare and Microsoft Azure Application Insights) for security, fraud and abuse prevention. The view and tap counts themselves still hold no IP address, and nothing is used for advertising or profiling. We also added the providers and our legitimate-interest basis.
Contact
Questions about this page: legal@lockedin.me.