Privacy

• Account — your email address, display name, timezone, and a hash of your password. Passwords are hashed with argon2id and are never stored or logged in a readable form.
• Activity — your focus sessions, which problems were assigned, the code you submitted, its runtime, and whether it passed.
• Lock audit trail — one row each time a lock ends, recording the session, the problem, the outcome (solved, skipped, abandoned, or swept up after being left open), how long it was locked, and for a solve the runtime and the speed gate it had to beat. This is what makes it possible to answer whether a machine ever unlocked without a passing submission. It is append-only and is deleted with your account.
• Server logs — each request produces a log line with a request id, the route, and the status. Authorization headers, passwords, and submitted source code are stripped before anything is written.
• Connected accounts — if you connect GitHub, an access token encrypted at rest with AES-256-GCM and the repository you nominated. If you link LeetCode, your public username and a cached copy of your public stats.

CodeLock does not sell data or use it for advertising. It is sent to:

• The code execution sandbox — your submitted code, so it can be run and graded. Submissions run with no network access.
• GitHub, only if you connect it, and only to commit accepted solutions to the repository you chose. CodeLock requests the public_repo scope and never asks for access to private repositories.
• LeetCode, only if you link a username, and only to read your public profile. Nothing is sent to LeetCode about your CodeLock activity.
• An error tracker (Sentry), only if the operator has configured one. It is off by default and a self-hosted install sends nothing at all. When enabled it receives exception details, the request id, and the route — request bodies are discarded before sending, so your code never leaves with them.
• OpenAI, only if the operator has enabled hybrid problem selection. In that case problem titles and tags are sent — never your code, email, or submissions.

CodeLock does not take payments. No card details are collected, stored, logged, or passed through its servers.

Data is kept while your account exists. Deleting your account removes your sessions, submissions, progress, and connected-account tokens; problems remain because they are shared and not yours. Disconnecting GitHub deletes the stored token immediately. Commits already pushed to your repository belong to you and are not touched.

Server logs are not stored in the database and live only as long as whoever runs this instance keeps them. Database backups are taken nightly and kept for fourteen days by default, so deleted data can survive in a backup until it ages out.

CodeLock sets no cookies and runs no analytics or third-party trackers. Your session is held in your browser's local storage and is sent only to the CodeLock API.

This deployment has not published a contact address. Whoever operates this instance is the party to contact about your data.