Security

The short version

Your Screen Time passcode is encrypted before storage, is never written to logs, and is only decrypted by the server when the app needs to show it to your authenticated account after your countdown ends.

Your passcode is protected

Your passcode is encrypted before it is stored. The encrypted version is what remains in the database while your wait is active. When your countdown ends and you choose to reveal it, the server decrypts it for that response and sends it to your authenticated browser.

• Encrypted at rest. The app uses established authenticated encryption to protect stored passcodes and detect tampering.
• Not logged. Plaintext passcodes, encryption keys, and secrets are not written to application logs, analytics, or error messages.
• Protected throughout the flow. Complete Lockout burner-account passwords use the same encrypted storage and reveal approach.

Your account controls access

Every sensitive request is authenticated with a Firebase ID token verified on the server. The app checks the signed-in user on every passcode action, so an account can access only its own stored passcode.

• Server-side data access. Your browser does not connect directly to the database. Database operations happen through authenticated app endpoints.
• Secure sign-in. WaitToUnlock uses Google sign-in, so the app does not store a separate WaitToUnlock password.
• Protected connections and sessions. The service uses HTTPS, protective security headers, server-side sessions, and secure cookie settings.
• Rate limits on sensitive routes. Controls are in place to slow automated abuse of authentication and passcode actions.

For Complete Lockout, you create the burner Apple Account directly with Apple. WaitToUnlock does not ask for that account's email address.

We collect only what the service needs

WaitToUnlock stores your email address, account creation date, lifetime-access status, and encrypted passcode data so the service can work. We do not sell personal data or build a tracking profile around you. You can delete your account and its associated data whenever you want.

Designed for reliable recovery

Encrypted passcode data is stored in Google Firestore, a managed database designed to replicate data across multiple data centers. WaitToUnlock runs on managed serverless infrastructure rather than a single server, helping keep the service available when you need to retrieve your passcode.

Questions or a security concern?

If you have a security question or think you have found a vulnerability, email hello@waittounlock.com. Please share potential vulnerabilities privately first so they can be investigated and fixed responsibly.