Privacy policy

Lockstep is a shared, versioned record of project decisions that you use from AI apps like Claude, ChatGPT, Codex, Grok, Cursor and others. This page explains what Lockstep stores, why, who it is shared with, and how to remove it. Lockstep is an independent personal project.

What Lockstep stores

• Your account: your name and email from Google sign-in.
• What you record: the decisions, facts, preferences and open questions you or your AI save to a project, with every earlier version, the time, which app it came from and who made it.
• Work you save: titles, locations and, when provided, the text of pieces of work (pages, emails, docs, files) so Lockstep can flag and rewrite them when a decision changes.
• Activity: a log of changes in each project, so you and your collaborators can see what changed.
• Connections you set up: if you connect Google, Notion or GitHub, the access tokens or installation IDs needed to read and update the specific files you chose. If you add an agent, a hashed copy of its key.

Lockstep does not store your chats. Conversations stay in the AI app you used. Lockstep only receives what is recorded through it. When you pull decisions from a meeting, your AI reads the meeting with its own connection and sends Lockstep the decisions it found and the short line each came from, not the transcript.

How Lockstep uses it

Only to provide Lockstep: showing your projects and their history, flagging work that depends on a changed decision, drafting rewrites for you to approve, updating linked files when you approve them, sharing what you choose to share, and keeping the service secure and working. Lockstep does not sell your data, show ads, or use your content to train AI models.

Google user data

If you connect Google Docs, Slides or Sheets, Lockstep asks only for access to the files you pick yourself in Google's file picker (the drive.file permission). It cannot see the rest of your Drive. Lockstep reads a linked file's text to draft rewrites, and writes the new version back to that file only when you approve the update: a doc gets the new text, a deck gets only the changed words, and a sheet gets only the changed typed cells, never its formulas. Lockstep's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used for advertising, is not sold, and is not used to train AI models. You can remove Lockstep's access at any time at myaccount.google.com/permissions.

Notion

If you connect Notion, you choose on Notion's own screen which pages Lockstep can use, and it cannot open any others. Lockstep reads a linked page's text to draft rewrites, and when you approve an update it edits only the words that changed in that page's existing blocks. It never adds, moves or deletes blocks. You can remove Lockstep's access in Notion under Settings → Connections at any time.

GitHub

If you install Lockstep's GitHub app, it can read and open pull requests only on the repositories you choose. Changes are proposed as pull requests and never merged by Lockstep. You can uninstall it from your GitHub settings at any time.

Who else processes your data

• Supabase hosts Lockstep's database and servers. Netlify hosts Lockstep's website.
• AI model providers (such as Anthropic, OpenAI and xAI, reached through OpenRouter) receive a piece of work's text and the project's current decisions when Lockstep drafts a rewrite, only to produce that rewrite.
• Google, Notion and GitHub, when you connect them, to read and update the files you chose.
• People you share with: anyone you send a share link to sees that project's or decision's current state (never private items). People you invite to edit, and agents you add, see the project they were given. Items you mark private are visible only to you.

Keeping and deleting your data

Lockstep keeps your data while your account is active. You can turn off share links and remove collaborators and agents at any time from your AI. To delete your account and everything in it, or to get a copy of your data, email the address below and it will be done within 30 days.

Security

Data is encrypted in transit. Each account's projects are walled off from others, access tokens are stored only on Lockstep's servers, and agent keys are stored as one-way hashes. No system is perfectly secure; if something goes wrong that affects your data, you will be told.

Changes and contact

If this policy changes, this page will show the new date. Questions or requests: hello@golockstep.com.