Privacy Policy

Last updated: November 4, 2026 · Applies to version 1.0 and later (Microsoft Store and portable editions)

In short: FolderLocker locks and hides folders on your own PC. We do not collect your personal data. There is no account, no cloud service, and no telemetry. Your files never leave your device, and the app makes no network connections on its own.

1.Who we are

FolderLocker ("the App", "we", "us") is a Windows desktop application published on the Microsoft Store by an individual developer. This policy explains exactly what the App does with information on your computer — and what it deliberately does not do.

Contact: support@zepker.com · Website: folderlocker.zepker.com

2.Information we do not collect

We do not collect, request, or have access to any of the following:

Name, email address, phone number, or any account information — the App has no account system.
The contents, names, or paths of your files and folders.
Passwords, PINs, or recovery codes in readable form (see Section 5).
Biometric data from Windows Hello.
Location, contacts, calendar, photos, camera, microphone, or clipboard contents.
Usage statistics, feature analytics, crash reports, or diagnostic telemetry.
Advertising identifiers.

The App contains no analytics SDK, no crash-reporting SDK, and no advertising SDK.

3.Information processed only on your device

The App stores the following data locally so that it can do its job. None of it is uploaded anywhere.

Data	Purpose	Where it is stored	Protection
Lock records: folder path, display name, lock mode (locked / hidden), timestamps	Remember which folders you locked and how to restore them	Index files under `%LOCALAPPDATA%\FolderLocker\` and the `$FolderLocker` vault on the same drive	Encrypted with Windows DPAPI, scoped to your Windows user account
Password for a locked folder	Verify the password when you unlock	Only a PBKDF2-SHA256 hash (600,000 iterations, random salt)	One-way hash — the original password cannot be recovered from it
Recovery code	Let you regain access if you forget a password	Only a PBKDF2 hash	One-way hash
`.flock` placeholder files	Mark a locked folder's original location so you can find and recover it even if the lock database is lost	In the folder's original parent directory	Readable JSON with folder ID, name, optional hint, lock time, and recovery-code hash. Deliberately contains no file contents and no secrets
Settings: interface language, default Windows Hello preference, custom vault location	Remember your preferences	`%LOCALAPPDATA%\FolderLocker\settings.json`	Plain text, non-sensitive
License cache: Free/Pro state and last check time	Keep your Pro status while offline	`%LOCALAPPDATA%\FolderLocker\license.json`	Plain text, non-sensitive
Custom folder icons you choose	Display the icon on locked folders	`%LOCALAPPDATA%\FolderLocker\icons\`	Plain image files

You can inspect or delete any of these files yourself at any time.

4.What happens to your files when you lock a folder

Locking is not encryption and not uploading. When you lock a folder, the App:

Records the folder's original security permissions, then applies a deny permission entry so the folder cannot be opened.
Renames or moves the folder into a hidden vault folder ($FolderLocker) on the same disk, leaving a small .flock placeholder behind.

Your files stay on your own storage device the entire time. They are never copied to a server, never scanned, and never read by us.

Important: because locking relies on file-system permissions rather than encryption, a user with administrator rights on the same PC — or someone who removes the drive and attaches it to another computer — may still be able to reach the data. If you need protection against that scenario, use disk encryption such as BitLocker in addition to this App.

5.Passwords, recovery codes, and Windows Hello

Folder passwords are converted to a salted PBKDF2-SHA256 hash. The plaintext password exists only in memory while you type it and is never written to disk.
Recovery codes are generated on your device, shown to you once, and stored only as a hash.
Windows Hello (face, fingerprint, or PIN) is verified entirely by Windows through the UserConsentVerifier API. The App receives only a yes/no result. Your biometric data is managed by Windows and is never accessible to the App.
Windows account password verification, used as a fallback, takes place in the standard Windows security dialog. The password is passed directly to the Windows LogonUser API for validation on your device. It is never stored and never transmitted.

6.Purchases and payment

Paid features are sold in two ways: as an add-on through the Microsoft Store, and — for the portable edition — as a license key purchased on folderlocker.zepker.com.

Microsoft Store purchases. License checks and purchases use the official Microsoft Store APIs (Windows.Services.Store).

Payment details, billing address, and Microsoft account information are handled entirely by Microsoft. We never see them.
The App only learns whether your account is entitled to the Pro features.
Microsoft's handling of your data is governed by the Microsoft Privacy Statement.

Purchases on this website (portable-edition license keys).

Payment is taken on a secure checkout page operated by our payment provider on our behalf. Your card or bank details go to that provider and are never received or stored by us.
We receive the email address you enter at checkout, your order details, and the status of the license key. That is what we use to deliver your key, answer support requests, and process a refund. We do not use it for marketing unless you ask us to.
License activation. When you activate a key, the App sends the license key and a generated instance name (by default your computer name) to our licensing server to register the activation and check the key's status. This is the only data sent, and it contains nothing about your files or folders.
No other data about your use of the App is collected in connection with a purchase.

7.Network activity

The App is designed to work fully offline. It initiates a network connection only in these cases:

When you click the developer or product link in the App, your default browser opens folderlocker.zepker.com (the address includes the App version so the page can show relevant information). This is an ordinary web page visit, subject to that site's own logging.
When you view pricing or make a purchase in the Store edition, the App calls the Microsoft Store, as described in Section 6.
When you activate or revalidate a portable-edition license key, the App contacts our licensing server with the key and a generated instance name, as described in Section 6. If you never enter a key, no such request is made.

No other outbound connections are made. There is no background sync, no update pinging, and no "phone home".

8.Sharing and selling of data

We do not sell, rent, trade, or share personal data, because we do not receive any. There are no third-party advertisers, data brokers, or analytics providers involved in the App.

9.Children's privacy

The App is a general-purpose file utility and is not directed to children. It collects no personal information from anyone, including children under 13.

10.Data retention and deletion

All data is retained only on your device, for as long as you keep it. We hold no copy, so there is nothing for us to retain or delete on our side.

To remove all data the App has stored:

Unlock your locked folders first — unlocking restores the original permissions and folder names. Do not skip this step: deleting the App while folders are still locked can leave them inaccessible, because the restore information is removed with the App's data.
Uninstall FolderLocker from Settings → Apps → Installed apps.
Delete the remaining folder %LOCALAPPDATA%\FolderLocker\ to remove settings, license cache, custom icons, and any offline lock index.
Optionally delete any leftover .flock placeholder files and $FolderLocker vault folders on your drives.

If you use the portable edition, deleting the extracted program folder and the same %LOCALAPPDATA%\FolderLocker\ folder removes everything.

11.Your rights

Because we do not collect or store any personal data on our systems, there is no personal data for us to export, correct, or erase on request. You keep full control of all App data locally, and the steps in Section 10 let you delete it completely without contacting us.

If you believe we hold data about you, or you have a privacy question or complaint, write to support@zepker.com and we will respond within 30 days.

12.Security

We protect the data the App stores with:

Windows DPAPI encryption of the lock database, bound to your Windows user account.
PBKDF2-SHA256 (600,000 iterations with a random salt) for all passwords and recovery codes.
Windows file-system permissions (ACLs) for the locked folders themselves.
No network listeners, no remote services, and no elevation of privileges beyond what locking requires.

No method of storage is perfectly secure. You are responsible for keeping your Windows account password, your folder passwords, and your recovery codes safe. Keep a copy of your recovery codes somewhere outside the computer — if you lose your Windows account, your folder password, and your recovery code at the same time, the data cannot be recovered.

13.Changes to this policy

If a future version of the App begins to collect or transmit data, this policy will be updated before that version is released, and the "Last updated" date will change. Material changes will also be noted in the App's release notes on the Microsoft Store.

14.Contact

Questions about this policy or about privacy in FolderLocker:

Email: support@zepker.com
Website: folderlocker.zepker.com