Lockstep (“we”, “our”, “us”) respects your privacy and is committed to handling personal data responsibly and transparently. This Privacy Policy explains what information we collect, how it is used, and the choices available to you concerning our practices. Lockstep is a UK-based digital platform designed to help people manage their gambling behaviour through practical tools, community access, and real-world alternatives. It is not a gambling service, advertising platform, or therapeutic provider.
Lockstep is operated by Lockstep Ltd, a company registered in England and Wales (company number 17328022), whose registered office is at Lingcroft, Pyrford Road, West Byfleet, KT14 6QS. Lockstep Ltd is the data controller for the personal data described in this policy.
Agreement & Consent
By accessing or using the Lockstep website, mobile application, or any related platform or service (together, the “Service”), you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and handling of information in accordance with it. This applies regardless of how Lockstep is accessed, including via mobile devices, web browsers, or future platforms. If you do not agree with this Privacy Policy, you should not access or use the Service.
Data we collect
Lockstep collects only the information necessary to operate the service and to understand how it is used.
Account and Identification Data
If you choose to create an account or contact us, we may collect basic identifying information such as your name and email address. When you create an account in the app, you also choose a public name that other users see, confirm that you are 18 or over, and may tell us your age range, the part of the UK you live in (or that you’d prefer not to say), goals, interests and meeting preferences. You can add a profile photo if you wish. Where authentication or analytics tools assign unique identifiers (for example, device or session identifiers), these may be collected to support functionality and security. If you sign in with Apple or Google, we receive your name and email address from them. If you sign in with Apple, Apple may give us a private relay address instead of your own email address.
Usage and Interaction Data
We may collect limited information about how the platform is used, such as interactions with tools, features, or daily activities logged by the user. This information is used to operate the service and to improve relevance and usability over time. Lockstep does not collect usage data for advertising or behavioural profiling.
Information About Your Gambling
To provide the service, the app stores information you give it about your gambling. This includes your current relationship with gambling (your “stage”), daily check-ins (such as your urge level, mood, triggers and a short journal note), your answers to the self-check and its result, figures you enter into money calculators, and the personal reminders you save, such as images, videos and links. Information about gambling can be health information, which UK data protection law treats as special category data. We therefore only store it with your explicit consent, which you give when you create your account. This consent is needed to use the app. You can withdraw it at any time by deleting your account in the app’s Settings, which permanently deletes your account and the information you have shared.
Communications and Feedback
If you contact us directly with questions, feedback, or support requests, we may collect the information you choose to provide. Participation in surveys, questionnaires, or research requests is entirely optional, and responses are used only to understand user needs and improve the service.
Pilot Evaluation
If you choose to opt in when you create your account, we use your data, without your name, to evaluate the Welsh pilot of Lockstep. This is optional, and you can change your choice at any time in the app’s Settings.
Social Media Interactions
Lockstep may maintain a presence on social media platforms such as Instagram, LinkedIn, or similar services. If you choose to interact with Lockstep through these platforms, we may receive personal information that you elect to share publicly or directly with us. The companies that operate these social media platforms may also provide us with aggregated or anonymised analytics relating to engagement with our pages. Lockstep does not control how third-party social media platforms collect or process data.
Website Forms
If you suggest an article through the form on the Lockstep website, we collect the article title and link, your email address, and any note you choose to add. Your suggestion is sent to the Lockstep team by email using Resend, an email delivery service, so that we can review it and reply to you. The website itself does not store your suggestion. We keep the email only for as long as we need it to consider your suggestion and respond.
Location and Event Searches
When you search for events or real-world alternatives in the app, such as through Swap the Night, you may enter a postcode or place name. This is converted into approximate map coordinates using postcodes.io or Mapbox. The coordinates, together with your chosen search radius, dates, and type of event, are then sent to Skiddle and Ticketmaster to find events near you. Your name, email address, and account details are not sent to these services. If you choose to follow a link to buy tickets, your purchase is handled by that provider under its own terms and privacy policy. Links to buy tickets from Skiddle are affiliate links, and Lockstep may earn a commission on purchases, as explained in our Affiliate Disclosure.
Group Meetings
Video and audio for Lockstep meetings are provided by Daily, a video calling service. When you join a meeting, your display name, an account identifier, and the audio and video you choose to share are processed by Daily so that other participants can see and hear you. Lockstep does not record meetings. If you are invited to a meeting, we may send you an email invitation using Resend, in line with your contact preferences.
Cookies & Analytics
The Lockstep website does not use cookies, analytics, or tracking technologies of any kind. The Lockstep app uses only cookies and similar browser storage that are strictly necessary for the operation and security of the service, such as keeping you signed in and remembering your language choice. These essential technologies enable core functionality and are not used for advertising, marketing, or cross-site tracking. The app loads its fonts from Google Fonts, so Google receives your device’s IP address when the app opens. Lockstep does not currently use analytics tools. If this changes, we will update this policy and ask for your consent where the law requires it.
For more information about cookies, please visit https://allaboutcookies.org/ .
How we use information
Lockstep uses information in a limited and intentional way to operate the service, improve its usefulness, and ensure that facets of the service remain relevant to each user. We process personal data on the basis of user consent, performance of the service, and legitimate interests where appropriate. Information about your gambling is processed only with your explicit consent, as described above. Information provided by users, such as stated interests, preferences, and interactions with tools, may be used to tailor how content, real-world alternatives, and available meetings are ordered and presented within the Service. This may include the use of relevance scores to surface meetings that are more likely to be more suitable, based on shared characteristics or interests. A meeting’s relevance score is worked out by comparing your age range, nationality, stage, interests and goals with those the meeting is aimed at. The score is shown only to you, and it changes the order in which meetings are listed, not whether you can join them. This personalisation is designed to improve relevance and usability within Lockstep and is not used for advertising, cross-site tracking, or third-party profiling. Lockstep may also use information in aggregated and anonymised form to understand how the platform is used overall, to assess the effectiveness of features, and to guide future improvements. Aggregated data does not identify individual users and may be shared at a high level with partners or stakeholders, for example as general usage statistics.
If you contact Lockstep directly, information you provide may be used to respond to enquiries, provide support, or communicate important service-related updates. If you opt in, we may also send occasional non-promotional updates about Lockstep, such as changes to the service or new features. You can opt out of non-essential communications at any time, including in the app’s Settings. Where outbound links are shown within the Service, some may be affiliate links. These do not affect the price paid by the user. Recommendations are prioritised based on relevance and suitability rather than commercial relationships. Lockstep does not sell personal data and does not share personal data with advertisers for behavioural or cross-site targeting.
Emails and Notifications
When another member invites you to a private meeting, we email you to let you know. The email names the host and the time of the meeting, and never includes the meeting’s title or anything about gambling. These are service messages about your account, so they are sent by default, on the basis of our legitimate interests in providing the service to you. You can turn them off at any time in Edit Profile, using “Email me meeting invites”.
Occasional update emails about Lockstep are separate from these service messages. We only send them if you choose to receive them by ticking the box when you create your account, which is unticked by default.
If you use the Lockstep iPhone app, we send push notifications only if you allow them on your phone. To send them, we store a device token linked to your account, and we delete it when you log out or the app is removed. We send push notifications for meeting invites, when someone joins your meeting, for connection requests and when someone accepts yours, and as a reminder 15 minutes before a meeting you are going to. Notifications never mention gambling or meeting titles. You can turn them off at any time in your phone’s settings.
Affiliate & outbound links
Lockstep may include outbound links to third-party products, services, experiences, or resources that are intended to support healthier, real-world alternatives to gambling. Some of these outbound links may be affiliate links, meaning Lockstep may receive a commission if a user chooses to follow the link and completes an action, at no additional cost to the user. Affiliate relationships do not influence how recommendations are prioritised or presented. Alternatives and suggestions are ranked based on relevance, suitability, and alignment with user interests and context, rather than commercial arrangements. Lockstep does not sell personal data and does not share personal data with advertisers or affiliate partners for behavioural advertising, profiling, or cross-site tracking. Any interaction with a third-party website or service is governed by that third party’s own terms and privacy practices.
Sharing and disclosure of personal data
Lockstep does not sell personal data. We share personal data only in limited circumstances and only where necessary to operate, maintain, or protect the Service.
Service Providers and Vendors
We may share personal data with trusted third-party service providers who perform services on our behalf and under our instructions. These may include providers of cloud hosting and infrastructure, database and storage services, email delivery or messaging services, and security or monitoring services. Service providers are authorised to access, process, or store personal data only as necessary to perform their services for Lockstep and are required to maintain appropriate safeguards to protect personal data.
The service providers we currently use are:
- Supabase: account sign-in, database storage, and the server functions that run the app.
- Vercel: hosting for the Lockstep website.
- Cloudflare: hosting for the Lockstep app.
- Resend: delivery of emails, such as meeting invitations and article suggestions sent through the website.
- Daily: video and audio for group meetings.
- Mapbox and postcodes.io: converting a postcode or place name into approximate map coordinates for event searches.
- Skiddle and Ticketmaster: finding events near a location you search for. These services receive search details only, not your account details.
- Google Fonts: the fonts used in the app. Google receives your device’s IP address when the app loads them.
- Apple Push Notification service: delivering notifications to iPhones. Apple receives the device token and the notification text.
- Sentry: error and crash reporting for the app. When something goes wrong, Sentry receives a technical report of the error, and it also receives performance timings from a sample of page loads. Reports identify you only by your account ID. They leave out your IP address, cookies, the content of requests and anything shown in the app’s console, and Sentry does not record your screen.
Community and Other Users
Certain information may be visible to other users where this is necessary to support participation in meetings, community features, or shared spaces within the Service. This may include a display name, limited profile information, or content that a user chooses to share with others. Users control what information they choose to share within the community. Any content or information that a user voluntarily makes visible to others may be accessed, collected, or used by those users.
In the community, the app stores the posts you share, your connections with other users, and anyone you block. If you report a post or another user, we store your report and the reason you give. Reports are reviewed by Lockstep’s moderators, who may record the outcome, any warnings, and internal notes against the accounts involved, as explained in our Community Guidelines. These notes are not visible to other users. If you invite a sponsor, we store the email address you give us for them.
Business Transfers
If Lockstep is involved in a merger, acquisition, financing, reorganisation, sale of assets, or similar transaction, personal data may be shared as part of due diligence or transferred as part of that transaction. Any such transfer would be subject to appropriate confidentiality and data protection safeguards.
Legal and Safety Requirements
We may disclose personal data where required to do so by law or where we reasonably believe disclosure is necessary to comply with a legal obligation, protect our rights or property, prevent fraud or misuse of the Service, respond to lawful requests from public authorities, or protect the safety of users or others. We may share aggregated or anonymised information that does not identify individuals, such as high-level usage statistics or trends, for business, research, or reporting purposes.
Data storage and security
Lockstep takes reasonable steps to protect personal data against unauthorised access, loss, misuse, or alteration. Data is stored and processed using reputable third-party infrastructure providers that apply industry-standard security measures. App data, including account details, is stored by Supabase, which provides the database, sign-in, and server infrastructure for the Lockstep app. The website is hosted by Vercel, and the app by Cloudflare. These providers are responsible for maintaining the underlying technical, physical, and network security of their platforms.
Lockstep is responsible for how personal data is used within the application, including access controls, configuration, and internal handling. Access to administrative systems is restricted to authorised individuals only, and reasonable measures are taken to ensure that personal data is accessed solely where necessary for legitimate operational purposes. Personal data is retained only for as long as necessary to provide the Service and to meet legitimate operational, legal, or compliance requirements. Retention periods vary depending on the type of data and the purpose for which it is used. Data may be deleted or anonymised when it is no longer required, or upon user request, subject to applicable obligations.
No method of transmission or storage is completely secure. While Lockstep works to protect personal data, absolute security cannot be guaranteed. Users are encouraged to take appropriate steps to protect their own devices and account credentials.
Some of our service providers are based in, or process data in, countries outside the UK, including the United States. Where personal data is transferred outside the UK, we rely on appropriate safeguards recognised under UK data protection law, such as the UK International Data Transfer Addendum or the UK Extension to the EU-US Data Privacy Framework. Vercel, Cloudflare, Resend, Mapbox and Google are certified under the UK Extension to the EU-US Data Privacy Framework. Supabase’s data processing terms include the UK International Data Transfer Addendum to the EU standard contractual clauses.
Your rights
Under applicable data protection laws, including UK GDPR, you have certain rights in relation to your personal data. These include the right to request access to the personal data we hold about you, to request correction of inaccurate or incomplete information, and to request deletion of your personal data where appropriate. You may also have the right to restrict or object to certain types of processing. Where processing is based on your consent, you may withdraw that consent at any time. Exercising your rights will not affect the lawfulness of processing carried out before the withdrawal.
You can delete your account at any time in the app’s Settings. This permanently deletes your account and the information you have shared, and cannot be undone. Other requests can be made by contacting Lockstep using the contact details provided in this policy. We may need to verify your identity before responding. We will respond to requests in accordance with applicable legal requirements.
If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at https://ico.org.uk/make-a-complaint/. We would appreciate the chance to address your concerns first, so please contact us before approaching the ICO.
Age
The Lockstep app is for people aged 18 and over, and you must confirm that you are 18 or over to create an account. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has created an account, please contact us so that we can delete it.
Changes to the privacy policy
This policy may be updated as the platform evolves. Any material changes will be reflected on this page.
Contact
For privacy-related enquiries, contact: legal@lockstep.uk
Lockstep Chrome Extension
Last updated: 27th August, 2026
This section describes the data practices of the Lockstep: Gambling Content Blocker Chrome extension, available on the Chrome Web Store.
What the extension does
Lockstep blocks gambling-related content on YouTube, Google Search, Ecosia, Instagram, and known gambling websites, using on-device keyword and domain matching.
Data we collect
The extension stores two small values locally, using Chrome’s built-in storage API:
- A count of how many items have been blocked
- Your display preference (whether blocked content is replaced with a placeholder card or hidden completely)
These values are synced only through your own Google account across your own Chrome installations (via Chrome’s native sync), the same way your browser bookmarks or settings sync. They are never sent to Lockstep’s servers or any third party - Lockstep does not operate a backend server for this extension, and the extension makes no network requests of any kind.
What we don’t collect
Lockstep does not collect, transmit, or sell any of the following:
- Your browsing history or page content
- Personally identifiable information
- Analytics or usage tracking data
- Any data to third parties or advertisers
Why the extension requests broad site access
Lockstep requests permission to read and modify pages on YouTube, Google Search, Ecosia, Instagram, and a list of known gambling domains. This access is used exclusively to scan page content locally in your browser for gambling-related material and block or replace it. No content from these pages is read, stored, or transmitted anywhere outside your device.
Data Retention & Feedback
The two stored values (blocked count and display preference) remain on your device (and in your Chrome sync, if enabled) until you reset the counter in the extension popup or uninstall the extension, at which point Chrome removes the stored data automatically.
Changes to the privacy policy
This policy may be updated as the platform evolves. Any material changes will be reflected on this page.
Contact
Questions about this extension’s privacy practices can be sent to: legal@lockstep.uk