The moment you open ShowUP. Face ID is the fast path, the PIN is the fallback. Nothing behind it is visible until you're in.
Notes. Appears on cold start and when returning to the foreground after the grace timeout set in G3 · App-Lock Setup. Biometric is the fast path; the 6-digit PIN is the fallback and is the only thing checked — locally, never against the server. "Forgot PIN?" leads to sign out → sign in, never a reset code, because a reset code would be a backdoor into a device lock that is supposed to have none.