Privacy policy

Last updated 29 October 2026

Guard Lock is made by BlueDreams666, which is me. This covers both the Guard Lock Mac app and the Guard Lock iPhone app.

I don't collect anything. There's no Guard Lock server, no account, no analytics, no ads and no tracking. Alerts and photos are encrypted on your Mac and can only be opened on your iPhone, and on the way they pass through your own private iCloud storage, which I can't see. The details are below.

What the apps do

The Mac app notices when your Mac is unlocked, woken, logged in to or shut down, or when someone types a wrong password, and sends an alert to your iPhone. If you turn the option on, the alert can include a photo from the Mac's camera. From the iPhone you can send a "Lock Mac" command back to the Mac.

What stays on each device

Encryption keys. When you pair, the Mac and the iPhone each create their own keys. The private keys stay in that device's Keychain. On the iPhone they're stored as "this device only", which means they don't sync to iCloud Keychain and aren't part of backups.

Alert history and photos. Alerts you've opened, and their photos, are kept only on your iPhone, in the app's own protected storage. Unpairing deletes them.

The iPhone camera is only used to scan the pairing code on your Mac's screen. Nothing it sees is recorded, kept or sent.

What goes through iCloud

Alerts, photos, pairing replies and Lock Mac commands travel through the private CloudKit database in your own iCloud account, the one your Mac and iPhone are both signed in to. I have no access to it.

Alerts, photos and commands are encrypted end to end with Apple's CryptoKit before they leave the device. Apple stores and delivers them but can't read them.

As soon as your iPhone has received an alert, it deletes it from iCloud. Commands are deleted once the Mac has read them.

During pairing, the iPhone writes a pairing reply to the same database. It contains the iPhone's public keys and its device name, signed so the Mac can verify it.

Apple can see that these records exist, how big they are and when they were created. Apple also delivers a push notification to your iPhone whose visible text is just "New alert from your Mac"; on your iPhone the app swaps that for the decrypted alert. iCloud and Apple push notifications are provided by Apple under Apple's Privacy Policy.

The ntfy.sh "doorbell"

When you tap Lock Mac, the iPhone also sends one empty request to ntfy.sh, a public notification service, so the Mac checks iCloud immediately instead of waiting. The request has no title, no text and no data, and it goes to a random address that only your paired devices can work out. All ntfy.sh learns is that a ping happened, when, and (as with any website) the IP address it came from. The command itself never passes through ntfy.sh. ntfy.sh is run by a third party under its own privacy policy.

The Mac app can also be set up to send alerts through ntfy.sh instead of the iPhone app. That's off while the iPhone app is paired, unless you turn on "Also send through ntfy". Alerts sent that way are not end-to-end encrypted.

Buying a license (Lemon Squeezy)

The Mac app is sold through Lemon Squeezy, which handles payment, tax and license keys as the merchant of record. When you buy, Lemon Squeezy receives your name, email address and payment details under its own privacy policy. I see your order (name, email, country) but not your card.

To check your license, the Mac app sends your license key and your Mac's name to Lemon Squeezy when you activate it and roughly once a week after that. Nothing else is sent: no alerts and no usage data.

Checking for updates (GitHub)

About once a day the Mac app asks GitHub, where the downloads live, what the newest version is. The request carries nothing about you or your Mac. GitHub only sees that someone asked and (as with any website) the IP address it came from, under GitHub's own privacy statement. If there's a newer version, the app shows a link to it. Nothing downloads or installs on its own.

What I collect

Other than the order details above, nothing. I don't run any servers that receive your data, and neither app contains analytics, crash reporting, advertising or tracking code. If you've chosen to share crash reports with developers in your iPhone's settings, Apple may pass anonymous crash logs to me through App Store Connect, the same as it does for every app.

Children

Guard Lock isn't aimed at children, and it collects no data from anyone, children included.

Deleting your data

In the iPhone app, go to Settings › Unpair This iPhone. That deletes the keys, the alert history and the photos on the iPhone, along with everything Guard Lock stored in your iCloud. Then unpair on the Mac as well. Deleting the iPhone app also deletes its history and photos.

Changes

If this policy changes, I'll post the new version here with a new date.

Contact

Privacy questions: barmaor.co@gmail.com