AppLocker – Privacy Policy

Last updated: October 2026

Overview

AppLocker ("the App") is developed by DevCodeApps. This Privacy Policy explains how we collect, use, and protect your information when you use AppLocker.

Data We Collect

• Installed app list: We query the list of installed applications on your device solely to display them in the app list so you can choose which apps to lock. This data never leaves your device.
• Camera (Intruder Selfie): If you enable the Intruder Selfie feature (paid: AppLocker Pro or Lifetime Premium) and allow camera access, the front camera captures a photo when someone enters the wrong PIN. Photos are stored locally on your device. They only leave it if you separately turn on Email Break-in Alerts (see below).
• Break-in history: When a wrong PIN, pattern or fingerprint is entered on a locked app, AppLocker records which app it was and when, on your device. With AppLocker Pro or Lifetime Premium it also keeps the intruder photo and the code that was tried. This history stays on your device unless you turn on Email Break-in Alerts.
• Usage Stats: We use Android's UsageStatsManager to detect when a locked app is launched. This data is processed locally in real time and is never stored or transmitted.
• Biometric data: Fingerprint/biometric authentication is handled entirely by the Android OS (BiometricPrompt). We do not access or store any biometric data.
• Notifications: The app shows local notifications, for example break-in alerts and the prompt to lock a newly installed app. They are not sent to external servers.
• Notification access (optional, AppLocker Pro): If you turn on Hide notification content, AppLocker uses Android's notification access to remove notifications from the apps you have locked and shows a neutral placeholder instead. It does not read, store, or send the content of any notification.
• Email address (optional, AppLocker Pro): Only if you turn on Email Break-in Alerts. We email a 6-digit code to the address to confirm it belongs to you, and then use it to deliver your alerts. You can change it or switch the feature off at any time.
• Break-in evidence (optional, AppLocker Pro): While Email Break-in Alerts is on, each failed unlock sends the intruder photo (if one was taken), the locked app's name and package name, the code that was tried, the time of the attempt, your device model and your device's Android ID (an identifier used only to match the verification code to your device and to limit abuse) over an encrypted connection to our server, for the sole purpose of emailing them to your verified address. Requests for a verification code also send the Android ID.
• Usage analytics: Via Google Analytics for Firebase we collect anonymous product events — for example which onboarding step you reached, which features you open, whether a purchase screen was shown, and that a break-in attempt was recorded (never which app, the code that was tried or the photo) — together with app version, device model, OS version, coarse region, and a randomly generated app-instance identifier. In the European Economic Area, the UK and Switzerland, collection stays off unless you agree in the privacy message the app shows when you first open it, and you can change your choice at any time under Settings → Privacy settings in the app. Elsewhere, usage analytics is on by default.
• Crash diagnostics: Via Firebase Crashlytics, if the app crashes we collect the crash report (stack trace), device model, OS version, and app version so we can fix the fault.

Data We Do NOT Collect

• We do not collect your name, phone number, or location.
• We collect an email address only if you turn on Email Break-in Alerts. No email address is needed to use the app.
• Your PIN, pattern and recovery code never leave your device.
• Intruder photos stay on your device unless you turn on Email Break-in Alerts.
• We never collect the contents of your locked apps, your messages, or your files.
• Analytics and crash data never include your PIN, your photos, or the list of apps you have locked.
• We do not sell your data.

Third-Party Services

• Google AdMob: The free version displays ads served by Google AdMob. AdMob may collect an advertising ID (GAID) for ad personalization. In the European Economic Area, the UK and Switzerland, ads are personalized only if you agree in the privacy message. See Google's Privacy Policy.
• Google Play Billing: Purchases and the AppLocker Pro subscription are processed by Google Play. We do not handle or store payment information directly.
• Google Play in-app updates and reviews: Update prompts and the optional rating prompt are shown by Google Play.
• Google Analytics for Firebase: Anonymous usage analytics (in the European Economic Area, the UK and Switzerland only with your consent). See Google's Privacy Policy.
• Firebase Crashlytics: Crash and stability reporting. See Google's Privacy Policy.
• Firebase Remote Config: Lets us change app settings, such as the free-plan app limit, without an app update. See Google's Privacy Policy.
• Oracle Cloud (server and Email Delivery): Hosts our alert server and sends the verification code and the break-in alert emails, only if you turn on Email Break-in Alerts. See Oracle's Privacy Policy.

Permissions Explained

• QUERY_ALL_PACKAGES: Required to list all installed apps for the app-locking interface.
• FOREGROUND_SERVICE / FOREGROUND_SERVICE_SPECIAL_USE: Keeps the app monitor running to intercept locked app launches.
• SYSTEM_ALERT_WINDOW: Required to display the lock screen over other apps.
• PACKAGE_USAGE_STATS: Detects which app is currently in the foreground.
• CAMERA: Used only for the Intruder Selfie feature (AppLocker Pro or Lifetime Premium), and only after you allow it.
• USE_BIOMETRIC: Allows fingerprint unlock (AppLocker Pro or Lifetime Premium).
• RECEIVE_BOOT_COMPLETED: Restarts the lock service automatically on device reboot.
• POST_NOTIFICATIONS: Shows the local notifications described above (Android 13 and later ask first).
• REQUEST_IGNORE_BATTERY_OPTIMIZATIONS: Asks to run without battery restrictions, because some phones stop background apps and that would switch your locks off.
• Notification access (BIND_NOTIFICATION_LISTENER_SERVICE): Only if you turn on Hide notification content (AppLocker Pro), as described above.
• Device administrator (BIND_DEVICE_ADMIN): Only if you turn on Uninstall Protection, to stop others from uninstalling AppLocker. It uses no device-administrator policies.
• INTERNET / ACCESS_NETWORK_STATE / AD_ID: Used by the ad, purchase, analytics, crash-reporting and configuration services listed above, and by Email Break-in Alerts if you turn them on.

Data Security

Your PIN, pattern and recovery code are stored locally on your device in a hashed format (SHA-256) and never leave it. Apart from the usage analytics, the crash diagnostics, the ad, purchase and configuration services and, if you turn them on, Email Break-in Alerts, all described above, no data is sent off your device.

If you turn on Email Break-in Alerts, the evidence is sent over an encrypted (HTTPS/TLS) connection to a server we operate at api.devcode.cloud (Oracle Cloud, Frankfurt, Germany). The server shrinks the photo in memory, attaches it to the email it sends to your verified address and never writes the photo to disk. Your email address and your device's Android ID are held only briefly, to check the verification code and to limit abuse (at most 2 days), and are not kept as a permanent record; the server's logs don't contain your email address. Like most web servers, ours keeps standard access logs (IP address, time and request) for up to 14 days for security. Alerts can only be sent to an address you have verified with a code.

Data Retention and Deletion

Everything AppLocker stores on your device (the hashed PIN or pattern, your settings, the list of locked apps, intruder photos and the break-in history) stays there. You can delete intruder photos and the break-in history in the app at any time, and uninstalling the app or clearing its data deletes all of it. If you use Email Break-in Alerts, the alert emails are in your own mailbox; our server keeps no copy of them, and your address and Android ID are deleted from it within 2 days. Analytics and crash data are kept by Google under its retention settings. To ask about them or to request deletion, contact us at the address below.

Children's Privacy

AppLocker is not directed at children under 13. We do not knowingly collect data from children.

Changes to This Policy

We may update this Privacy Policy. Updates will be reflected with a new "Last updated" date. Continued use of the App after changes constitutes acceptance of the revised policy.

Contact Us

If you have questions about this Privacy Policy, contact us at:
info@devcode.cloud

More about AppLocker

Website: applocker.web.app

• How to see who tried to open your apps on Android
• How to hand your phone to a child without them opening your apps
• App lock without an Accessibility service
• All AppLocker guides