Privacy policy

What the app sends with "Send device stats" on

The setup wizard shows exactly this list, including what is never sent, with a switch to turn the option on or off. The same switch is available in Settings → About. While the option is on, the app sends the following to the developer's MoLock server (and to the developer's private Telegram chat) at startup and approximately every 6 hours:

• Device name, Windows edition and version number, and system type (64-bit).
• CPU model and core count, total memory, graphics card model and screen sizes.
• Disk size and free space, system uptime, and overall processor and memory load.
• MoLock's own processor and memory use.
• The number of locks and wrong attempts in the last 24 hours (counts only, with no photos or details).
• Whether certain main features are on (Telegram, the guard service, evidence) and the name of the active theme.
• App version, language, update channel and install type.
• A one-time installation notice and, if the app crashes, a report that may include a short technical error message.

Purpose: to let the developer know how many devices run MoLock, how lightweight it is in practice, and which issues need fixing.

With "Send device stats" off

The app sends only the app version, language and update channel (plus install type), so that updates, announcements and replies to your feedback can still reach you.

In both cases, the app uses a random installation number and a private access key to communicate with our server securely, and records whether an announcement was shown, clicked or dismissed. Your approximate country is estimated by our hosting provider from the connection. The device's IP address is never stored.

What is never sent

• Your files or file names.
• Your screen contents or screenshots (unless you choose to attach one to feedback).
• Your keystrokes.
• Your password, recovery code or duress password.
• Your Windows user name.
• Photos, videos, audio or any other evidence in readable form. These go only to your own Telegram bot or stay on your PC — or, if you turn the portal on, are stored encrypted in your portal where only you can read them.
• Your device's location. Location is sent only to your own bot, as part of evidence or when you request it.

Your Telegram bot and evidence

The bot is yours. You create it with @BotFather and link it to your chat, and MoLock responds only to that chat. The connection runs directly between your PC and Telegram. The developer has no access to your bot, its messages or your evidence.

Evidence is also kept on your PC in the evidence timeline, with a retention period you set by days and storage size, and you can delete it at any time. Messages that contain secrets, such as a new password, are removed from the chat after two minutes.

Your settings are strongly encrypted on your own PC and tied to your Windows account. Your password is stored in an irreversible, encrypted form. It is never kept as plain text and never sent to us.

The personal portal (optional)

The personal portal lets you see your notes, to-dos, reminders and unlock history with photos from any browser. It stays off until you set a portal password in the app. Since 2.7 the portal becomes part of MoLock Account once you link your PC, and the same rules apply.

• What is encrypted: the text of your notes, to-dos and reminders, the details of each unlock attempt, and attempt photos. All of it is encrypted on your PC before upload and decrypted only on your PC or inside your browser after you enter your portal password. Neither we nor anyone else can read it.
• What never reaches us: your portal password itself, and your encryption key in usable form.
• What we can see (metadata): that an item exists, its type (note, to-do or reminder), when it changed and its size; for each unlock attempt, its time, the kind of result and whether there is a photo; for each portal sign-in, the time, whether it was allowed or denied, the approximate country and city, and the browser type. Your IP address is not stored as such — only a scrambled fingerprint that changes daily. The developer sees counts and sizes only.
• Alerts: every portal sign-in, allowed or denied, is reported to your own bot. Five wrong passwords lock the portal for 15 minutes, and a session lasts at most 12 hours.
• Retention: the unlock history is kept for 30 days (at most the newest 300 attempts) and then deleted automatically. You can stop uploading the history at any time, or turn the portal off entirely.
• If you forget your portal password we cannot recover it; set a new one from the app on your PC.

MoLock Account and the official bot (optional)

MoLock Account brings your PCs together in one place and is guarded by the official Telegram bot, @MoLockOfficialBot. An account is created only when you link a PC yourself, and MoLock works fully without one.

• What we store for the account: your Telegram user id (a fixed number), username and display name; your linked PCs and their names; a one-way check value derived from your password, from which the password cannot be recovered — we never store the password itself; per-PC wrapped keys that only your password can open; open sessions (time, approximate city and browser type); and the history of successful and failed sign-ins.
• What is end-to-end encrypted: notes, to-dos and reminders; sticky notes; clipboard items you sync; unlock-attempt photos; photos and screenshots you take remotely; vault keys; and share-link files. All of it is encrypted on your PC or in your browser, and we cannot read it. A share link's key lives only inside the link and never reaches us.
• Files: files you upload to your files are kept until you delete them, within your plan's storage (500 MB on Free, 20 GB on Premium by default, shared with mail and recordings). Files you send to the official bot are stored encrypted by us but not end-to-end, because Telegram already had them, and they are labelled that way in your account.
• Clipboard and share links: synced clipboard items are deleted after 24 hours by default and after 30 days at most (pinned items). Share links are deleted when the period you chose ends or after the last permitted download.
• Remote actions: every action (lock, photo, screenshot, siren, message, restart or shut down, locate, Lost mode, approve unlock) is logged in your account and reported by the official bot. Nothing in the account can lock you out of your PC.
• MoLock Remote sessions (from 2.9): the screen picture, what you type, mouse movement, clipboard, transferred files and browser recordings saved to My files are all end-to-end encrypted between your browser and your PC with fresh keys for every session; the relay passes them on sealed and does not store them. For each session we keep only: the PC, start and end time and why it ended, the browser type and whether it is a phone, the approximate country and a shortened part of the network address, the amount of data and number of frames, and whether recording was on. All of it shows in your account log, and the official bot tells you when each session starts and ends.
• Official bot messages: text only about private matters; photos stay encrypted in your account, and the message links to them.
• Unlinking and deletion: unlinking a PC from the account, the bot or the app stops its commands immediately. To delete your account entirely, contact the developer (details below).

Version 2.9 features: what each one stores

Every 2.9 feature works on your PC without the internet. If you link the PC to a MoLock Account, each feature's state, daily history and settings are sent to your dashboard end-to-end encrypted with your account key: everything is sealed on your PC before upload, the server stores data it cannot read, and neither the developer nor the admin sees more than counts (how many PCs use each feature) — never the content. Daily history is kept for up to 400 days and is deleted entirely when you unlink the PC or delete its data.

• Walk-away lock (presence): away and back times, the signals behind each decision, and your settings. Bluetooth device addresses are not stored in the dashboard. The optional camera signal checks the image in the PC's memory and discards it at once — no image is ever saved or sent.
• Focus & screen time: daily totals only — minutes per app, per website (the site's name alone) and per category, plus focus sessions and goals. No screenshots, no keystrokes, no window contents, no full page addresses.
• Privacy guard: which app used the camera or microphone and when, new startup programs and your decision about them, and the privacy score. Face detection for the shoulder-surfing guard is opt-in and runs on the PC only; camera frames are never stored and microphone audio is never recorded.
• Prayer times: calculated on your PC from the coordinates of the city you choose; no service is called to get them. Only the settings sync (method, city, reminders); no daily history is kept for this feature, and your movements are never recorded.
• Network guard: the names, makers and labels of devices on your network, usage totals per device and per app, Wi-Fi safety and speed-test results. Your router's admin password stays on your PC, encrypted and protected by your Windows account, and is never uploaded. MoLock does not inspect anyone's browsing and does not read your Wi-Fi password.
• Notification preferences: stored on the server unencrypted because it needs them to decide what the bot sends (per kind: bot on/off and minimum level; quiet hours and your time zone). Alert texts are passed to the official bot so they reach you on Telegram.
• Sign-in: for passkeys we store only the public part, the name you choose and when it was used; the secret stays on your phone or PC. For remembered browsers we keep the browser type, country and a short fingerprint that does not identify you, for 90 days. Recovery codes are stored in a form that cannot be reversed. A QR link request is kept for 3 minutes only.

Version 3.0: mail, family, plans and serials

Version 3.0 adds new services on the 7ot.app domain. All of them are optional, and MoLock works on your PC without them. This is what each one keeps:

• The 7ot.app domain: the site, the dashboard, mail and share links now live on 7ot.app. Old addresses redirect to it, and the move doesn't change your data or your keys.
• name@7ot.app mail: incoming messages are stored encrypted to a mail key that belongs to your account (the key itself is locked by your account key), so we can't read stored messages. Because email crosses the internet as normal email, a message passes through our server as it arrives — to check the sender, the size and spam — and is sealed immediately; no readable copy is kept. To run the mailbox we keep, unencrypted: size, time received, folder, flags (read/starred), how many messages you sent today and the storage you use. Messages you send reach the recipient as normal email. We never scan mail for advertising and never sell it. Your messages are deleted when you empty them from Trash or delete your account.
• Family & parental controls: we keep the family members and their roles and which PC belongs to which child profile. Each child's rules, daily totals (minutes per app, site name and category), extra-time requests with your answers and weekly reports are end-to-end encrypted to the family owner's account. No screenshots, no keystrokes, no messages or chats. A child's PC location is sent only after a consent screen on that PC, and it can be turned off at any time.
• Plans and serials: we keep your account's and PCs' plan, its features and the usage needed to apply it (storage, number of PCs, remote minutes today, emails sent today). Serials are stored in a one-way form that can't be recovered, only the last four characters are ever shown, along with activation and expiry dates and the PCs bound to each serial. We collect no payment-card data: there are no payments on the site at all.
• Converter: conversion runs entirely on your PC; neither your files nor their names are uploaded. We only know that an engine pack was downloaded and which version, and your plan when the pack is a pro one.
• Install and launch password: the launch password is checked on your PC and never sent. If you enable alerts, wrong attempts and their time — plus the intruder photo if you enabled it — reach you encrypted like the unlock history. We know which app version each PC runs so we can offer the right update.
• Notification channels: we keep your choices per channel, the push registration of each browser you allow (a delivery address issued by your browser) and the email address you confirm. Alerts are short: what happened, on which PC and a link to the details; no photos inside emails, and no mail content in notifications unless you allow previews. Optional emails include an unsubscribe link.
• Account moderation: to protect the service we may keep warnings or suspensions on an account, with their reason, under the Terms of service. Moderators can never see end-to-end encrypted content or stored mail. Suspending an account never stops local protection on your PC.

PC health and the security score

MoLock calculates your PC's health and security score on your PC. Nothing from it is sent unless "Send device stats" is on, so it can appear in your account with fix tips. Then only this is sent:

• free and total disk space, the size of temporary files, and how many apps start with Windows;
• the status of Windows Security, the firewall and drive encryption (on, off or not available), and the number of pending updates where known;
• uptime, the processor temperature where available, and the score from 0 to 100.

File names, file contents and the names of programs you use are never sent.

The camera, motion detection and tamper alerts

Camera motion detection is on by default and runs only while the PC is locked. The image is analyzed on your own PC to detect movement, and nothing from the camera is uploaded anywhere except the alert photo, which goes to your own Telegram bot. The developer never receives any image.

• The camera warms up when the screen locks so that the first photo is instant. With motion detection off, the camera switches off again after a few minutes.
• Tamper alerts (a wrong password when someone tries to close or pause MoLock or open Settings, or MoLock being ended from Task Manager) are also sent only to your own bot, with a photo.
• You can turn off motion detection or tamper alerts at any time in Settings or with /settings in your bot.

Third-party services you enable

Some optional features connect to third-party services, and only when you turn them on:

• Uploading snapshots to your own Google Drive, and WhatsApp text alerts through a free WhatsApp alert service.
• Widgets such as weather, prayer times, currency and crypto rates retrieve their data from public online services.
• If Windows Location Service is unavailable, an approximate location may be determined from the IP address through a public service.

These services are governed by their own privacy policies.

Announcements, updates and signatures

The app periodically checks our server for announcements and updates. Every announcement and every update is digitally signed by us, and the app rejects anything that does not come from us or is outdated. Announcements never appear while the PC is locked or over a full-screen app.

Automatic updates download in the background and are verified as genuine and untampered before installation, and they never install while the PC is locked. If you start an update yourself from your bot with /update while the PC is locked, you choose whether to install now and lock again immediately, or after you unlock. In every case, updates never touch your password, settings or evidence.

Feedback and complaints

When you send feedback or a complaint from the app, only what you typed and its category are sent, plus contact details and a screenshot if you choose to include them. The device name, Windows version and app version may be attached to help us understand the issue. The reply arrives on your PC.

Website analytics

The website counts visits in a simple, privacy-respecting way:

• No cookies, and no tracking identifiers stored in your browser.
• What is recorded: the page, language, screen width, download and outbound-link clicks, the name of the site you came from (the rest of its address is discarded), and the campaign name if one is present in the link.
• Approximate country and city are estimated by our hosting provider, and browser and operating system type are derived from the standard information every browser sends.
• Visits are counted with an anonymous code that changes every day, so you cannot be tracked from one day to the next. Your IP address is never stored.
• Visits from automated bots are not counted.

Fonts are loaded from Google Fonts, so Google receives your browser's request for the font files.

Retention and deletion

• To reduce what is sent, turn off "Send device stats" in Settings → About.
• When you uninstall, the app sends an uninstall notice, then stops all communication, and MoLock's data on your PC is deleted if you choose to remove it.
• To have your device record removed from our server, contact the developer (details below), and the device and all of its stats will be deleted.
• MoLock Account: your files stay until you delete them, synced clipboard items are deleted after 24 hours by default (30 days at most), share links when they expire, and the unlock history after 30 days. You can unlink any PC at any time; to delete the whole account, contact the developer.
• Evidence on your PC remains under your control: set its retention and delete it from the evidence timeline. Anything sent to your bot stays in Telegram until you delete it.

Children

MoLock is intended for device owners and is not directed at children; children do not create MoLock Accounts. Since 3.0, a parent can add a child profile under their own account with Family; what that stores is described in the 3.0 section. If children use the PC, we also recommend a separate Windows account for them. Please note that evidence features can photograph anyone who tries to unlock the PC, so use them responsibly.

Changes to this policy

If this policy changes, we will update this page and the "last updated" date shown at the top. Material changes will also be noted in the changelog or in an in-app announcement.

Contact

For any privacy question or data deletion request, please contact the developer, Mahmoud Mohamed:

• WhatsApp: https://wa.me/201066688896
• Facebook: https://fb.com/mafiaidola