Privacy Policy

1. Operator and contact

Service: FindBack (individually operated). Data controller: [operator's legal name to be confirmed]. Privacy inquiries and rights requests: 100websupport@gmail.com.

Website: findback.site. The operator's address, responsible contact and any additional contact methods must be finalized before launch.

2. Purposes and information processed

We process email, account identifiers and authentication records for account access; report titles, descriptions, categories, event dates, private countries/cities/coordinates, contacts and photos for lost-and-found reports.

We may process messages, participants, abuse reports, blocks, audit records and necessary technical request information for safe return coordination. Applicable lawful bases and detailed retention criteria remain to be finalized.

3. Public and private information

Report titles, descriptions, item types and event dates may be public. Country and city are displayed only with an express sharing choice. Public image previews require a separate review and approval.

Precise coordinates, contact details and original photos are private by default. Messages are limited to participants, except restricted audited review of reported conversations by authorized moderators.

Metadata removal does not obscure faces, identification documents or addresses visible in image pixels. Copies independently made by third parties cannot necessarily be recalled.

4. Retention and deletion

When you delete a report, we immediately delete the report, its private location and contact details, and its photo files, unless a legal hold applies.

Account deletion requires password re-confirmation. Unless a legal hold applies, we immediately delete the account, all reports and photos, conversations and messages you took part in, and abuse reports and blocks made by or about you.

For a lawful and specific reason such as a dispute or an investigation, two separate staff members (a reviewer and an approver) may pause deletion for that user and their conversation partners for 30 days, renewable through the same process. While paused, deletion requests show as under review.

Deleting an individual message replaces its text with a deletion marker; the message record is removed when the account is deleted.

Moderation and abuse-handling records are kept while the service operates, to handle disputes and protect the service. If we set a specific retention period, we will update this policy.

If deletion temporarily fails, it is shown as pending, not completed, and retried. Backups and access logs at our hosting and database providers may keep information for a period under those providers' policies.

5. Service providers and international transfers

Supabase supports authentication, databases and photo storage; Netlify provides hosting and server functions. Data may be processed outside the user's country.

Legal provider identities, processing countries, transfer categories, purposes, mechanisms, periods, subprocessors and applicable user rights are [to be confirmed]. A server region does not identify every processing location.

6. Rights and security

Subject to applicable law, individuals may request access, correction, deletion or restriction by emailing 100websupport@gmail.com. Request procedures and timelines must be finalized before launch.

We use authentication, access controls, Supabase RLS, private storage, HTTPS, moderation audits and rate limits. No technical measure guarantees complete security.

7. Cookies, children and matching

Authentication tokens and browser storage may be used for sign-in. Cookie, technical log and tracking disclosures will be verified before launch.

Minimum user age and any parental consent requirements are [to be confirmed]. Public registration intended for children remains closed pending safeguards.

Automated lost-and-found matching scores are suggestions, not conclusive decisions about ownership or identity.

8. Updates and effective date

Effective date: [to be confirmed]. Material changes will be announced where required. This document is a private pre-launch draft, not a final legal notice.