Security

The short version

Your Screen Time passcode is encrypted before storage on Google Cloud, is never written to logs, and is only decrypted by the server when the app needs to show it to your authenticated account after your countdown ends.

Your passcode is protected

Your passcode is encrypted before it is stored. The encrypted version is what remains in the database while your wait is active. When your countdown ends and you choose to reveal it, the server decrypts it for that response and sends it to your authenticated browser.

• Encrypted at rest. The app uses established authenticated encryption to protect stored passcodes and detect tampering.
• Not logged. Plaintext passcodes, encryption keys, and secrets are not written to application logs, analytics, or error messages.
• Protected throughout the flow. Complete Lockout burner-account passwords use the same encrypted storage and reveal approach.

Your account controls access

Every sensitive request is authenticated with a Google Firebase Authentication ID token, verified on the server. The app checks the signed-in user on every passcode action, so an account can access only its own stored passcode.

• Server-side data access. Your browser does not connect directly to the database. Database operations happen through authenticated app endpoints.
• Secure sign-in. Sign-in runs through Google Firebase Authentication, so the app never stores a separate WaitToUnlock password.
• Protected connections and sessions. The service uses HTTPS, protective security headers, server-side sessions, and secure cookie settings.
• Rate limits on sensitive routes. Controls are in place to slow automated abuse of authentication and passcode actions.

For Complete Lockout, you create the burner Apple Account directly with Apple. WaitToUnlock does not ask for that account's email address.

We collect only what the service needs

WaitToUnlock stores your email address, account creation date, lifetime-access status, and encrypted passcode data so the service can work. We do not sell personal data or build a tracking profile around you. You can delete your account and its associated data whenever you want.

Designed for reliable recovery

Encrypted passcode data is stored in Google Cloud Firestore, Google's managed database service, which replicates data across multiple data centers. WaitToUnlock runs on managed serverless infrastructure rather than a single server, helping keep the service available when you need to retrieve your passcode.

Running on Google Cloud means the physical and operational security of the data centers is handled by Google. The encryption key is held separately by WaitToUnlock and is never stored in the database, so the stored passcode is unreadable ciphertext to the database itself.

Questions or a security concern?

If you have a security question or think you have found a vulnerability, email hello@waittounlock.com. Please share potential vulnerabilities privately first so they can be investigated and fixed responsibly.