Last updated: October 6, 2026
This policy explains what personal data LockDoc collects and how it is used, shared, stored and deleted. It covers the LockDoc website and dashboard (lockdoc.co), the LockDoc Chrome extension for Gmail, the LockDoc Outlook add-in, and client portal (upload) pages.
The documents you send are end-to-end encrypted, so LockDoc cannot read them. Some information about each transfer (for example file names and email addresses) is not end-to-end encrypted. This page sets out exactly what that information is.
See also our Terms of Service and Security page.
Account information. When you sign in with Google or Microsoft we receive and store your name, email address and your account identifier with that provider. We also store your plan, your billing status, the Stripe customer and subscription identifiers for your account, your storage use, and your team membership and pending team invitations (including the email address of each person invited). If you set a portal password we store your public key and your private key, encrypted with a key derived from that password. LockDoc cannot decrypt it.
File and transfer information (not end-to-end encrypted). For every file you send or receive through LockDoc we store its file name, size, type, upload time, sender name and email address, recipient email address(es), expiry date, download limit and download count, and whether it is shared with your team. When a file can be reopened later we also store a copy of its one-time passphrase, encrypted to your own or your team's public key. LockDoc cannot decrypt it.
Client portal uploads. When someone uploads files to your portal, we store the name and email address they enter along with the file information above.
Product usage events. The dashboard, extension and add-in report events such as which screen was used, a send or upgrade step, file counts and sizes, error codes, app version and language, together with your account identifier and plan. These events do not contain document contents or email addresses.
Technical information. We process IP addresses to protect the service (for example rate limiting of sign-in and upload requests). When the Outlook add-in requests an email-sending token, we log your account identifier and IP address for 24 hours to limit abuse. Our servers keep short, size-limited application logs.
Payment information. Payments are handled by Stripe. LockDoc does not receive or store your card details.
Cookies and browser storage. We use a session cookie to keep you signed in. If you set a portal password, the dashboard keeps a key derived from it in your browser's local storage so you do not have to re-enter it on every visit. Our marketing pages use Google Analytics, which sets its own cookies and collects browsing information about visits to those pages.
Fax. You can fax two ways. Encrypted link (most secure): your document is encrypted in your browser like a secure email, and only a cover page with a link and QR code is faxed; the recipient opens the link and enters a passcode you give them separately, which is never on the fax. Standard fax: the actual pages are faxed. They are encrypted on their way to our fax carrier, Telnyx (United States), and delivered over the phone network like any fax, which carries them readable. Your browser uploads the PDF to a short-lived storage link that Telnyx fetches; LockDoc's servers never receive or read it, and the stored copy and Telnyx's record are deleted once the fax is delivered or fails (within about an hour at the latest). Faxes sent to your LockDoc fax number are held by Telnyx until your browser fetches them through our relay service (run on Cloudflare, which stores and logs nothing), encrypts them to your key and adds them to your encrypted inbox; Telnyx's copy is then deleted. We email you when a fax arrives; the email does not include the fax. LockDoc keeps the fax numbers, page counts, times and delivery status to show them in your dashboard and to bill pages. If you move an existing number to LockDoc, the account details, signed letter of authorization and phone bill you provide go to Telnyx to process the port; LockDoc keeps only the last four digits of the account number and, if you have set a portal password, an encrypted copy of the signed letter in your inbox.
We use the information above to:
We do not sell your personal information, and we do not use it for advertising.
We use the following providers to run LockDoc. Each one receives only the information it needs for its role:
We may also disclose information if the law requires it.
If you have any questions about this privacy policy or our data handling practices, please contact us at [email protected]
Related: Terms of Service · Security at LockDoc
We may update this privacy policy to reflect changes in our service, our providers or legal requirements. We will change the "Last updated" date above and notify users of any material changes.