Photo proof, honor mode, and why we don't try to make Locked In cheat-proof

A few months into building Locked In, a friend testing an early build texted me a photo of his running shoes by the door. It was 6:14am. The challenge was a 5k, three times a week, with a $20 forfeit if he skipped. He'd been on it for eleven days.

"Do I actually have to take the photo after the run?" he asked. "Or is the shoes-by-the-door photo enough?"

I stared at that message for a long time. Because the honest answer was: it depends what we think this app is for.

The polygraph version

The instinct, when you're building accountability software, is to engineer the trust out of it. GPS verification. Heart-rate confirmation. Live video. Make the app a polygraph so nobody can ever fudge a check-in. We sketched all of it. We had a whole document called "verified mode" with location radii and pedometer thresholds.

Then I went back to my friend's text. He'd run nine of the last eleven days. He was about to run the tenth. He was asking a sincere question about what the photo meant. And I realized that if our answer was "the photo is evidence we use against you," we'd already lost.

What we shipped instead

Locked In has two check-in modes, and a deliberate refusal to add a third.

Honor mode is one tap. Read for 20 minutes. Took your meds. Called your mom. Nobody invents an elaborate fiction to fake a meditation session — the only person it hurts is them, and they already know. The check-in takes under three seconds, because if logging the habit costs more than doing the habit, the habit dies. Not because users are lazy. Because friction compounds. Day 1 you tolerate it. Day 12 you skip "just today." Day 20 the app is uninstalled.

Photo mode is for the challenges where someone else has skin in the game — a social challenge with a friend, or a solo challenge with a real forfeit. A gym selfie. The page you're on. The plate before you eat it. The photo isn't evidence. It's a small ritual that says I'm choosing to show up for this. The friend on the other end doesn't forensically analyze it. They glance, react, move on.

That's it. Those are the two modes.

Why we didn't build the third one

We almost built verified mode. The arguments against it didn't land all at once — they accumulated.

The first was that it punished the wrong people. The 95% of users who weren't going to cheat would now have to grant location access and wait for a GPS lock to log a run. The 5% who wanted to cheat would just spoof it, or run on a treadmill, or send a photo from last Tuesday. The arms race wasn't winnable, and it wasn't worth winning.

The second was subtler. A habit app that doesn't trust you teaches you, gradually, that the app is the adversary. Beating the app becomes the game. The habit becomes incidental. That's the opposite of what we're trying to do.

The third was the one that actually settled it. The whole point of cost + witness is that the social contract does the work — not the software. If your friend doesn't trust your check-ins, that's not a product problem we can solve. And if they do trust you, the verification was never the load-bearing piece.

What I told my friend

I told him the shoes-by-the-door photo was fine. He laughed and sent me a sweaty post-run selfie an hour later anyway. He's on day forty-something now.

The lesson, if there is one: accountability software works best when it's the lightest possible layer over a relationship that was already going to hold. We're not trying to catch you. We're trying to give you and the person who cares about you a place to meet, briefly, every day, around the thing you said you'd do.

If you want to try it, join the waitlist — iOS and Android rolling out now.