diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..24f9f8d
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+.env
+data/
diff --git a/docker-compose.yml b/docker-compose.yml
index ed6f792..a8e2df7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -4,11 +4,8 @@ services:
     ports:
       - "8765:8765"
     volumes:
-      - pinvault-data:/data
+      - ./data:/data
       - /mnt/aidata:/mnt/aidata
     environment:
       - PINVAULT_MASTER_HASH=${PINVAULT_MASTER_HASH}
     restart: unless-stopped
-
-volumes:
-  pinvault-data:
\ No newline at end of file
diff --git a/static/app.js b/static/app.js
index 78bc5bb..8470576 100644
--- a/static/app.js
+++ b/static/app.js
@@ -133,51 +133,84 @@ document.getElementById("add-form").addEventListener("submit", async (e) => {
   }
 });
 
-function accessPin(id) {
+async function accessPin(id) {
   const title = document.getElementById("modal-title");
   const body = document.getElementById("modal-body");
   title.textContent = `Access PIN #${id}`;
-  body.innerHTML = `
-    <p class="muted" style="margin-bottom:1rem;font-size:0.85rem">
-      Enter a recovery code to bypass the lock:
-    </p>
-    <form id="access-form">
-      <div class="form-group">
-        <textarea id="bypass-input" placeholder="Type 64-character recovery code here..." rows="2" required onpaste="return false"></textarea>
-      </div>
-      <div id="access-error" class="error-msg" style="margin-bottom:0.5rem"></div>
-      <button type="submit" class="btn btn-primary" style="width:100%">Unlock PIN</button>
-    </form>`;
-  document.getElementById("modal-overlay").classList.remove("hidden");
 
-  const bypassInput = document.getElementById("bypass-input");
-  bypassInput.addEventListener("paste", (e) => { e.preventDefault(); });
-  bypassInput.addEventListener("drop", (e) => { e.preventDefault(); });
+  const pins = await api("/api/pins");
+  const pin = pins.find(p => p.id === id);
 
-  document.getElementById("access-form").addEventListener("submit", async (e) => {
-    e.preventDefault();
-    const code = bypassInput.value.trim();
-    const errEl = document.getElementById("access-error");
-    errEl.textContent = "";
+  if (pin && !pin.locked) {
+    body.innerHTML = `
+      <p class="muted" style="margin-bottom:1rem;font-size:0.85rem">
+        This PIN is unlocked and ready to view.
+      </p>
+      <button id="reveal-btn" class="btn btn-primary" style="width:100%">Reveal PIN</button>`;
+    document.getElementById("modal-overlay").classList.remove("hidden");
 
-    try {
-      const result = await api(`/api/pins/${id}/access`, {
-        method: "POST",
-        body: JSON.stringify({ bypass_code: code }),
-      });
-      body.innerHTML = `
-        <div class="text-center">
-          <p class="muted" style="margin-bottom:0.3rem">Your PIN</p>
-          <div class="pin-display">${result.pin}</div>
-          <button class="btn btn-sm" onclick="copyTextDirect('${result.pin}')" style="margin-top:0.5rem">
-            Copy PIN &#x1f4cb;
-          </button>
-        </div>`;
-      loadPins();
-    } catch (err) {
-      errEl.textContent = err.message;
-    }
-  });
+    document.getElementById("reveal-btn").addEventListener("click", async () => {
+      try {
+        const result = await api(`/api/pins/${id}/access`, {
+          method: "POST",
+          body: JSON.stringify({}),
+        });
+        body.innerHTML = `
+          <div class="text-center">
+            <p class="muted" style="margin-bottom:0.3rem">Your PIN</p>
+            <div class="pin-display">${result.pin}</div>
+            <button class="btn btn-sm" onclick="copyTextDirect('${result.pin}')" style="margin-top:0.5rem">
+              Copy PIN &#x1f4cb;
+            </button>
+          </div>`;
+        loadPins();
+      } catch (err) {
+        body.innerHTML = `<p class="error-msg">${esc(err.message)}</p>`;
+      }
+    });
+  } else {
+    body.innerHTML = `
+      <p class="muted" style="margin-bottom:1rem;font-size:0.85rem">
+        Enter a recovery code to bypass the lock:
+      </p>
+      <form id="access-form">
+        <div class="form-group">
+          <textarea id="bypass-input" placeholder="Type 64-character recovery code here..." rows="2" required onpaste="return false"></textarea>
+        </div>
+        <div id="access-error" class="error-msg" style="margin-bottom:0.5rem"></div>
+        <button type="submit" class="btn btn-primary" style="width:100%">Unlock PIN</button>
+      </form>`;
+    document.getElementById("modal-overlay").classList.remove("hidden");
+
+    const bypassInput = document.getElementById("bypass-input");
+    bypassInput.addEventListener("paste", (e) => { e.preventDefault(); });
+    bypassInput.addEventListener("drop", (e) => { e.preventDefault(); });
+
+    document.getElementById("access-form").addEventListener("submit", async (e) => {
+      e.preventDefault();
+      const code = bypassInput.value.trim();
+      const errEl = document.getElementById("access-error");
+      errEl.textContent = "";
+
+      try {
+        const result = await api(`/api/pins/${id}/access`, {
+          method: "POST",
+          body: JSON.stringify({ bypass_code: code }),
+        });
+        body.innerHTML = `
+          <div class="text-center">
+            <p class="muted" style="margin-bottom:0.3rem">Your PIN</p>
+            <div class="pin-display">${result.pin}</div>
+            <button class="btn btn-sm" onclick="copyTextDirect('${result.pin}')" style="margin-top:0.5rem">
+              Copy PIN &#x1f4cb;
+            </button>
+          </div>`;
+        loadPins();
+      } catch (err) {
+        errEl.textContent = err.message;
+      }
+    });
+  }
 }
 
 async function deletePin(id, label) {