A commitment tool you cannot inspect is a commitment tool you should not trust. This page states exactly what KairoLock does to your machine, exactly what it reads, and exactly how a lock ends — including the things it does not do.
Pre-release status. KairoLock has not launched; the Windows release is still being prepared and verified. Descriptions below are the mechanism as built, not performance claims.
1. Blocking is a Windows Firewall rule
When a lock starts, a Windows service creates one outbound block rule per program you selected, using the Windows Firewall interface that Windows itself provides for this purpose (the documented INetFwPolicy2 COM API — the same mechanism behind the Windows Firewall control panel). Each rule names the program’s executable, is outbound-only, and its action is Block.
The rules are tagged in a KairoLock group and named so you can see which lock created them. They are ordinary Windows Firewall rules: you can view them in Windows Firewall settings, and an administrator can remove them there.
2. A blocked program still opens
Blocking is at the network layer. A blocked program still launches and still runs — it simply cannot reach the internet. KairoLock does not prevent a program from starting, does not close running programs, and does not stop you using your computer.
Per-website blocking is not implemented. KairoLock blocks a program, not individual addresses within it. Blocking a browser blocks that browser’s network access entirely, not one site inside it.
3. No driver, no hooks, no injection
KairoLock installs no kernel driver, injects nothing into other programs, hooks no system calls, and ships no browser extension. It does not read or alter the traffic of the programs it blocks — a firewall rule either permits a connection or refuses it, and KairoLock never sees the contents of either.
The blocking component runs as a Windows service because creating a firewall rule requires system privilege. That is the only reason it is a service.
What it reads
What KairoLock looks at on your PC
The short answer: it does not search your disk, and it never opens your files.
It does not scan your drive
KairoLock performs no disk scan. It does not enumerate Program Files, does not index your drives, and does not look at your documents, photos, music, video or any other personal media. It reads no file you did not point it at.
It does not inspect running processes, does not read browser history, bookmarks, profiles or cookies, does not log keystrokes, and takes no screenshots. There is no monitoring component, because the product is a commitment tool rather than a surveillance tool.
How a program gets on your list
You choose it. The list of things to block is built from what you select or type in the app — KairoLock does not go looking for installed software on its own.
Where the app offers to help you name a program, it uses only the display information Windows keeps for its own “Installed apps” list — the display name, publisher and version. That reader is deliberately narrow: it does not read install locations, executable paths, uninstall commands, account identifiers or install dates, and it never writes to the registry.
What leaves your device
The app contacts three of our services, and only when you use the feature that needs one: signing in (an authorisation code, then the token refresh and sign-out that follow); your subscription (reading whether your entitlement is active, opening a checkout for the plan you chose, opening the billing portal); and the trusted clock, which asks our time service to sign the current time so a lock cannot be ended early by changing your computer’s clock.
The checkout request carries the plan, the billing period and the email address on your account. The clock request carries a random number generated on your device and how long the signature should be valid for — nothing else. The app has no analytics or usage-tracking integration, sends no diagnostic bundle and no crash report, and the Windows service that does the enforcing has no way to make a network request at all.
Your blocklist never leaves your machine. We do not receive the names of the programs you block, when you block them, or anything about how you use your PC. Payment details are entered only in Paddle’s checkout and are never handled by the app. See the privacy notice for the full detail.
Ending a lock
How you unlock
There is no password and no fingerprint. You choose how a lock can end before it starts, and you see that choice on the confirmation screen.
It runs out
The ordinary case. You set a duration; when the time has elapsed, the lock ends by itself and the firewall rules it created are removed. No action is needed from you.
A one-time code you kept
Optionally, you can generate a single-use code at setup time and store it somewhere you have chosen — printed, with a friend, in a safe. Entering it ends the lock once.
We cannot recover it for you, and we could not if we wanted to: only a salted SHA-256 hash of the code is kept on your device. The code itself is shown once, at creation, and is never stored or transmitted.
A delayed unlock
Optionally, a cooling-off period: you ask to unlock now, and the lock ends after the wait you set in advance. The wait is counted from elapsed time rather than the system clock, so moving the clock forward does not shorten it.
Honest limits. KairoLock is designed to make impulsive self-bypass harder, not to be impossible to undo. It is your computer: an administrator can remove the firewall rules from Windows Firewall settings, and we say so rather than implying otherwise. A fingerprint or biometric unlock is not offered, so no biometric data is collected or stored. Second-party (“ask a friend”) approval is designed but not yet implemented, and is not offered as a recovery method.