Privacy Policy
Effective Date: October 8, 2026 • Last Updated: October 8, 2026
24h Auto-Purge
Every file is permanently wiped from private storage after 24 hours. Zero cold archives.
Salted PIN Protection
Passcodes are salted and hashed (PBKDF2/SHA-256). Plaintext PINs are never stored.
EXIF / GPS Stripped
Location, device camera serials, and timestamps are stripped before upload.
1. Overview & Information We Collect
Locky is an ephemeral, privacy-first media sharing platform designed to transfer photos and short videos with zero tracking and zero permanent footprint.
No Account Required: You do not need to register, provide an email address, or provide any personal information to use Locky.
Temporary Media: When you upload a file, it is assigned a random 8-character vault identifier and protected with a salted cryptographic hash of your 4-digit PIN. The raw file is stored in private cloud storage (Cloudflare R2) and is accessible only to visitors who enter the correct PIN.
2. Strict Ephemeral Data Retention (24-Hour Life Cycle)
We operate under a strict zero-retention policy:
- Automatic 24-Hour Destruction: Exactly 24 hours after upload, objects are permanently destroyed and erased from storage via both just-in-time validation upon access and automated cron background cleaners. Once purged, files cannot be recovered by anyone.
- Immediate Abuse Purge: Anyone viewing a vault may click "Report Abuse / Delete Now" to instantly and permanently wipe the media and its security metadata from storage.
- Temporary 5-Minute Access Links: Unlocked media URLs expire within 300 seconds (5 minutes) to prevent unauthorized redistribution.
3. Cookies & Third-Party Advertising (Google AdSense)
Locky uses third-party advertising services, specifically Google AdSense, to serve advertisements when you visit our website.
Mandatory Advertising Disclosures:
- Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites on the Internet.
- Google's use of advertising cookies enables it and its partners to serve ads to users based on their visit to Locky and/or other sites on the Internet.
- Users may opt out of personalized advertising by visiting Google's Ads Settings at https://adssettings.google.com.
- Alternatively, users may opt out of third-party vendors' use of cookies for personalized advertising by visiting www.aboutads.info.
Locky itself does not use tracking cookies or store user profiles. Any cookies present are deployed strictly by Google AdSense for advertising delivery or Cloudflare for security validation.
4. Security & Bot Mitigation (Cloudflare Turnstile)
To protect the service against automated abuse, denial of service, and scraping, we implement Cloudflare Turnstile. Turnstile verifies that requests originate from legitimate human visitors without displaying interactive CAPTCHA puzzles or harvesting private data. Turnstile operates under Cloudflare's Privacy Policy.
5. User Rights (GDPR, CCPA / CPRA)
Under global data privacy frameworks (including the European Union General Data Protection Regulation and the California Consumer Privacy Act):
- Right to Erasure / Deletion: Any visitor in possession of a vault link can trigger immediate, irreversible deletion using the "Report Abuse / Delete Now" button. All files are automatically deleted after 24 hours regardless.
- No Sale of Personal Data: Locky does not sell, rent, or trade personal data or uploaded media under any circumstances.
6. Contact Information
If you have any questions about this Privacy Policy or wish to submit an urgent takedown inquiry, please reach out via our project repository or contact the platform administrator at privacy@evencheng.com.