Held, by agreement.

For most of this app’s life a lock-up was a claim made from one side. The Dominant pressed a button, the record said locked, and a great deal was then computed on top of that — the goal ripening, the days counting, the milestones arriving — without anything anywhere having checked that the device was on the person it named.

Fine when you are in the same room. The whole problem when you are not. So the person wearing it confirms, in one tap, optionally with a photograph.

One tap stays the floor. Somebody who cannot take a photograph at that moment must still be able to say the device is on.

The photograph is kept exactly as long as it takes the other person to look at it, and then deleted. Whatever is left when the lock-up ends goes then instead. A picture of somebody in a cage should not sit in storage for ninety days because nobody pressed anything.

Set a goal and the screen counts towards it. Milestones arrive on the way — a week, a fortnight, a month — and they go to both of you, because the person holding the key is the reason there is a number to count and used to be told nothing at all.

The device itself comes from a short list you keep, so it is picked rather than retyped. Where the key is comes from another — a safe, a timed box, posted to a friend. That list is the Dominant’s to write and both of yours to read: telling somebody the key is in a box with a three-day timer on it is most of what saying it is for.

A cage check is asked for and answered with a photograph — required, this time, because that is the entire content of the request. It is reviewed, and the photograph is deleted once it has been seen. Same bargain as the confirmation, for the same reason.

Once a goal has been served the Dominant can offer a spin. The wheel is not decoration: the result applies itself. Freedom opens the lock there and then; an extension moves the goal; an orgasm is written as a permission that has already been granted, because that is where this app keeps “you may”.

The wheel can open a lock and it can never close one. Being locked again after a few days of freedom is a row on somebody’s screen when the days are up — a decision a person makes, not something the app does while you are asleep.

A device that has to come off, comes off. The app cannot prevent that and should not pretend to, so there is a control that ends a lock-up from the inside — and what it protects is the record. Without one the row keeps saying locked: the goal ripens, the statistics add up a streak that never happened, and the wheel can be offered against a lock-up that physically ended days ago.

It is loud rather than quiet. The Dominant is told immediately, with the days served and the reason given, and the entry is marked so it can never blur into an unlock that was granted. It cannot be switched off by a pause, a lapsed subscription or an argument, because a valve that can be switched off is not a valve.

What is logged — the lock-ups, and what happens during them — belongs to the person, not to the relationship. Nobody should have to type their own history in twice, and a relationship ending should not delete the record of it.

So the log travels. It keeps a note of which relationship each entry happened in, which is what lets the statistics show this one or all of them, and what decides who may rule on an entry — but the entries themselves survive a partner change intact.

An entry still waiting on a ruling when a relationship ends has nobody left to rule on it. Those are moved to a state of their own rather than being marked denied: recording a judgement nobody made would be a small lie kept forever.