Reference

Uninstall Locke

Removing Locke is not only deleting a program. Locke arms things on your machine — a trusted certificate authority, a proxy setting, browser registrations — and an uninstall that left those behind would leave a live interception capability on a computer with nothing on it to explain why. This is what each platform reverses, in what order, and what it deliberately does not touch.

Start in the app

Locke lists every way to turn it off, with the exact command or route for your platform, under Settings › About & removal › Turning Locke off, and removing it — the same card is on the Support page. Press View shutdown and removal instructions. Closing the app is not one of the options: the app is a window onto Locke, and Locke keeps running without it.

The options the app lists
Option	Platform	What it leaves in place
Stop capture, keep Locke installed — `locke pause` (`locke resume` undoes it)	Linux	Everything: the certificate authority stays trusted, and no file, group, service unit or detection history is removed. To pause without a terminal, see Settings › Protection › Pausing capture.
Remove Locke from this machine	Windows and Linux	Your detection history, unless you say yes when asked. The rest of this page is what it does.
Remove only the certificate authority	Windows and Linux	The capture path and the certificate authority's private key. With the certificate gone but traffic still routed through Locke, secure connections fail rather than flow — so uninstall instead, unless you know why you need only this.

Windows

Settings › Apps › Installed apps › Locke › Uninstall, or Start menu › Locke › Uninstall. One “are you sure”, then one question about the data Locke kept on this computer, then it runs.

Before any program file is deleted, Locke runs its own cleanup script. The order is chosen so that no intermediate state strands you:

What the Windows uninstall reverses, in order
#	Step	Why here
1	Stops every Locke process	A running Locke re-arms what has just been disarmed — and it holds open the very files the uninstaller is about to delete. Processes are matched by their image path under the install directory, never by name.
2	Removes the capture-lock firewall rules, if any were installed	Those rules are machine state and they outlive the app. Left behind with no proxy to funnel into, your browser simply stops reaching the internet, permanently, with nothing left on the machine naming a cause. They come down before the proxy does.
3	Turns the system proxy off, and clears HTTP_PROXY / HTTPS_PROXY	Before the certificate, not after. Untrusting first leaves your traffic bent at a proxy you can no longer trust: every HTTPS request fails validation, with no working browser to look up why.
4	Untrusts the certificate authority, and clears NODE_EXTRA_CA_CERTS	Safe now — nothing is being intercepted any more.
5	Removes the browser native-messaging registrations	All eight per-user registry roots, so no browser is left resolving a manifest that names a path inside a directory that no longer exists.
6	Removes the scheduled logon task, if one was ever registered	Nothing in the desktop app registers one, but the command-line tool can.
7	Deletes the certificate authority's private key — always, no prompt	A key that can mint a trusted certificate for any hostname must not outlive the trust. It is a capability, not data, so this is never a question.
8	Deletes your detection history, audit log and profile — only if you said yes	Last, because the steps above read files out of there: the proxy backup, the installed registration script, the certificate itself.
9	Verifies, and reports what it found	See below.

If everything armed is gone, the uninstall just completes. If something is left, you get a dialog and an offer to open a report that carries the exact command for each item. If a Sonomos root certificate is still trusted, that gets its own dialog saying so first and in those words — because that leftover is a live interception capability rather than one item on a list.

Linux

Removal is a script installed into the app’s own directory, not left behind in your downloads folder — deleting the download must never orphan a trusted root certificate.

The Linux uninstall commands
Command	What it removes
`~/.local/share/sonomos/app/locke/uninstall.sh`	This install.
`~/.local/share/sonomos/app/locke/uninstall.sh --remove-shared`	This install, plus this computer's shared state.
`~/.local/share/sonomos/app/locke/uninstall.sh --remove-shared --force-shared`	The same, even while a Sonomos process is running.

That is the default location; if you set SONOMOS_PREFIX, the script lives under that instead. A removal is two decisions, and they are asked separately:

The two halves of a Linux removal, and how each is consented to
Half	What it covers	How you agree to it
This install	The install directory, the models, the locke symlink, systemd user units, runtime and cache state, and the certificate authority's private keys.	The ordinary `Proceed with removal? [y/N]`.
This computer's shared state	The `:443` redirect, the root-owned helper at `/usr/local/libexec/sonomos-redirect`, the `/etc/sudoers.d/sonomos-redirect` rule, the launcher at `/usr/local/libexec/sonomos-launch`, the `sonomos-proxy` and `sonomos-bypass` groups, certificate trust in the system store and in every browser profile, and the `NODE_EXTRA_CA_CERTS` block in your shell startup file.	A second, separate question that defaults to No and lists every item by path — or `--remove-shared` given up front.

The split is not caution for its own sake. There is one redirect helper, one sudo rule, one pair of groups and one system trust store per machine, and every Locke on that machine uses the same ones — a second install, a developer checkout, a throwaway copy under /tmp. Removing one install must not silently stop another from screening anything. What follows from that:

Declining the machine-wide half never blocks the uninstall. The install is removed either way.
Declining means no password prompt at all. Only that half needs root, so a run that touches nothing outside the install never asks for one.
A running Locke refuses the machine-wide half rather than warning about it. The failure it would otherwise cause is silent: the other install keeps running with its redirect disarmed, which does not crash anything, it just stops screening. Stop it and re-run, or override the refusal with --force-shared — which grants no consent of its own; you still answer the question.
The redirect comes down before the helper and the sudo rule that undo it. The reverse order points every outbound :443 connection at a dead port with nothing left authorised to undo it.
The certificate authority’s private key is removed unconditionally, in both halves, with no prompt — the same rule as Windows, for the same reason.
Anything left behind on purpose is printed with the exact command for it. The last step deletes the install directory, and uninstall.sh along with it, so “re-run the uninstaller” would be advice with nothing left to run.

Your detection history

On both platforms the default is keep, and the paths are printed either way — as removed, or as kept with the exact command to remove each one later.

A privacy product that silently keeps your detection history after you uninstall it is a bad look. One that silently deletes it may destroy evidence you wanted. So it is asked, plainly, once. And it defaults to keeping because deleting is irreversible, and Free has no export of the history to fall back on. On Teams, save what you need first — the detection history exports in Reports, or a full report for the period.

On Linux that covers the metrics database under ~/.local/share/Sonomos/, its backups, and the token seed beside it. The seed follows the same answer as the database and never a separate one: deleting it changes the token every value is masked to from then on, so tokens in past and future reports stop lining up with each other.

Running the cleanup by hand

On Windows the same cleanup is runnable directly, which is what to do if the uninstaller could not run it — a blocked script policy, say:

& "$env:LOCALAPPDATA\Programs\locke\resources\windows\uninstall-cleanup.ps1" -InstallDir "$env:LOCALAPPDATA\Programs\locke"

That reverses everything armed and keeps your data, matching the default the uninstaller itself offers. Add -DeleteData only if you also want the detection history, audit log and profile gone — there is no dialog on this path, so the flag is the whole of the decision.

On Linux the uninstaller runs the same way with or without its install record, and never refuses for the lack of one. Without a record it discovers what is actually on the machine instead — the helper and the sudo rule at their one fixed path each, the two groups, trust anchors in all three distribution directories, every browser certificate store, and the default install location — and prints which mode found what. Refusing to run for want of a record is exactly how an orphaned certificate authority goes unremoved.

What it cannot remove for you

Neither uninstaller elevates, because neither installer did. Anything machine-wide is therefore detected, named, and left alone with the elevated command printed beside it rather than silently skipped:

Windows: Sonomos anchors in the machine-wide certificate store (nothing Locke ships writes there, but a developer with an elevated shell can have), the WinHTTP machine proxy, and machine-scope HTTP_PROXY / HTTPS_PROXY / NODE_EXTRA_CA_CERTS. If a capture-lock firewall rule survives, the report names the exact Remove-NetFirewallRule command — a machine that cannot reach the internet is never reported as a clean uninstall.
Both platforms: the browser extension. It came from a browser store, so it is yours to remove, from your browser’s own extensions page.
Linux: another install, or a developer checkout, is reported plainly and left alone. Deleting a second install’s certificate authority out from under it is the same class of mistake this script exists to prevent, so it is told to you rather than counted as a failure.

If something is still bothering you after a removal, Support & feedback has the fastest route to a human, and Troubleshooting covers the usual suspects.