Held, by agreement.

For most of this app’s life a lock-up was a claim made from one side. The Dominant pressed a button, the record said locked, and a great deal was then computed on top of that — the goal ripening, the days counting, the milestones arriving — without anything anywhere having checked that the device was on the person it named.

Fine when you are in the same room. The whole problem when you are not. So the person wearing it confirms, in one tap, optionally with a photograph.

One tap stays the floor. Somebody who cannot take a photograph at that moment must still be able to say the device is on.

The photograph is kept exactly as long as it takes the other person to look at it, and then deleted, unless you have both chosen to keep them. Whatever is left when the lock-up ends goes then instead. A picture of somebody in a cage should not sit in storage for ninety days because nobody pressed anything.

Set a goal and the screen counts towards it. Milestones arrive on the way — a week, a fortnight, a month — and they go to both of you, because the person holding the key is the reason there is a number to count and used to be told nothing at all.

The device itself comes from a short list you keep, so it is picked rather than retyped. Where the key is comes from another — a safe, a timed box, posted to a friend. That list is the Dominant’s to write and both of yours to read: telling somebody the key is in a box with a three-day timer on it is most of what saying it is for.

A cage check is asked for and answered with a photograph — required, this time, because that is the entire content of the request. It is reviewed, and the photograph is deleted once it has been seen, unless you have both chosen to keep them. Same bargain as the confirmation, for the same reason.

The wheel is a single button with a menu: offer a spin, or open the wheel to view and edit what is on it. A spin can be offered at any point in a lock-up, and the wheel can be edited whenever no spin is waiting. The wheel is not decoration: the result applies itself. Freedom opens the lock there and then; an extension moves the goal; an orgasm is written as a permission that has already been granted, because that is where this app keeps “you may”.

The wheel can open a lock and it can never close one. Being locked again after a few days of freedom is a row on somebody’s screen when the days are up — a decision a person makes, not something the app does while you are asleep.

A device that has to come off, comes off. The app cannot prevent that and should not pretend to, so there is a control that ends a lock-up from the inside — and what it protects is the record. Without one the row keeps saying locked: the goal ripens, the statistics add up a streak that never happened, and the wheel can be offered against a lock-up that physically ended days ago.

It is loud rather than quiet. The Dominant is told immediately, with the days served and the reason given, and the entry is marked so it can never blur into an unlock that was granted. It cannot be switched off by a pause, a lapsed subscription or an argument, because a valve that can be switched off is not a valve.

A lock-up does not have to be all-or-nothing. It can be paused — with a photograph, both going off and coming back on — for a shower emergency, a flight, anything that has nothing to do with ending it. The goal and the day count wait exactly where they were; an hour off disturbs nothing about the record.

Two more things can be asked for without ending anything: a cleaning, timed and logged, and a change of device, which moves the record from one to the other in the same statement that approves it. Both are answered the same ordinary way as everything else here.

The device coming off for twenty minutes is not the same event as the lock-up ending, and the record is careful to say so.

And where the key genuinely cannot be reached — the safe is timed, the box has been posted, the Dominant is away — a combination can be written down once and handed over automatically, in the same moment the lock-up ends itself. It is never shown early, and it is never shown for nothing: seeing it is the release.

October is the chastity community’s month, and the app has it built in. Both of you have to say yes before it starts, and the keyholder can plan it in the week before. There is a thirty-one-day calendar of daily challenges, with days left open for the Dominant to choose and days that can be marked as witnessed — done together, rather than proved with a photograph afterwards.

A missed day is reported by the person who missed it and ruled on by the other, the same honest way as everything else here. The wheel gains a face of its own for the month that can hand out a task, and progress can be shared as a picture if you want to. Our guide to Locktober for couples covers planning the month together.

What is logged — the lock-ups, and what happens during them — belongs to the person, not to the relationship. Nobody should have to type their own history in twice, and a relationship ending should not delete the record of it.

So the log travels. It keeps a note of which relationship each entry happened in, which is what lets the statistics show this one or all of them, and what decides who may rule on an entry — but the entries themselves survive a partner change intact.

An entry still waiting on a ruling when a relationship ends has nobody left to rule on it. Those are moved to a state of their own rather than being marked denied: recording a judgement nobody made would be a small lie kept forever.