Nearby visibility starts off. Only after you confirm sharing, we store location rounded to 0.01 degrees and your chosen area, call sign and radio details. Verified opted-in members can see your chosen name, approximate distance and those details for 24 hours. Stop sharing clears them. Radio details are not verified. Direct Android connections use user-confirmed encrypted device sessions; messages and ephemeral keys are not saved by the app. Google Nearby uses Google Play services, and device radios may expose discovery names.
Safety contacts must be accepted friends. You choose automatic conditions, session duration and location sharing; each recipient chooses which alert types, location and sound to accept. Safety coordinates are stored only when you explicitly enable device monitoring and select location sharing or area checks. Only current accepted location contacts can see fresh coordinates during an active session. Ending the session clears them; stale readings clear after five minutes. Alert records remain for up to seven days, with current consent required to view receipts. Removing or blocking a friendship revokes access. This service does not contact emergency services or guarantee delivery.
Private audio and video
Live sessions invite only selected accepted friends. Camera, microphone and incoming media choices start off and require Join or Record. Live audio/video uses encrypted WebRTC connections, Google STUN connection discovery and an optional configured relay; participants and connection services may see network addresses. Leaving or moving the app/page to the background stops capture. Recorded uploads are limited to 2 MB, require recipient acceptance and expire after 24 hours. Ending sharing removes the active clip; hosting backups have separate retention. Uploaded files may contain location metadata. Recipients can save copies. Signaling is retained briefly for connecting participants and removed after two minutes. Account deletion removes your active sharing and safety data.
Contact admin messages
When you contact admin, we store your supplied name, contact email, category, subject, message, submission time and signed-in account ID if available. Only full administrators and administrators with Contact admin inbox permission can view these records and internal notes. Contact details are supplied by the sender and are not proof of identity. No email is automatically sent. If an administrator chooses to reply, the supplied contact email and reply are transmitted through our configured transactional email provider, Resend. The reply subject, text, recipient, sending administrator, timestamps and send status are saved privately for inbox administrators before delivery is attempted. Provider delivery acceptance does not guarantee inbox delivery. Messages and reply history are retained as private support records; Trash is recoverable and does not erase the record. Support records and hosting backups may remain after account deletion. Do not include passwords, financial credentials or identity documents.
Security traffic monitoring
Security administrators can see server-observed IP addresses, UTC request time, normalized route categories, HTTP status, elapsed response time and security signals. Query strings, raw request bodies, passwords, emails and private-message contents are not recorded in this monitor. Its rotating logs are capped at 7 days or 2 MiB, whichever is shorter; cleanup runs during requests and maintenance. Request-rate counters retain at most one minute of active IP entries. Security rules and audit records have separate retention.
Approximate city, region and country lookup uses a local copy of DB-IP Lite data. Visitor IPs are not sent to a geolocation service. Security administrators may group recorded requests by these estimated locations and view aggregate counts on a self-hosted map; this does not identify a street address or device GPS position. VPNs, proxies and shared networks make location and visitor counts unreliable. Administrators may temporarily block or throttle exact addresses/ranges and designate dashboard alerts. Provider access logs and backups have separate policies.
Friends-only sharing and account controls
Accepted friends can see friends-only posts, pictures and map pins after signing in. Links do not grant access. Removing or blocking a friend revokes future access but cannot remove copies they already saved. New friends can see existing friends-only posts. Authorized administrators and Galaxy moderators retain moderation access. Matching alerts use public posts only. Account deactivation or suspension blocks access and hides posts; reactivation restores eligible posts, not individually held or trashed items. Administrators can permanently delete and anonymize an account, with limited records retained as described below.
Friend chat is available only between active, verified, accepted friends. It is stored on LostaFound, not end-to-end encrypted. Friend-request notifications are sent through Resend to eligible verified existing members when enabled; emails contain a sign-in link, not account addresses or an automatic acceptance action. Chat emails are not sent. Private delivery records retain account IDs and retry status for up to 30 days; hosting backups and provider logs have separate retention. Removing or blocking a friend stops access; if both people reconnect, previous messages become available again. Deleting an account removes that person’s message text.
City-name checks and nearest-city suggestions run on LostaFound using a local GeoNames directory, adapted under CC BY 4.0. We normalized names and selected city/region fields. Typed city queries and optional search-center coordinates go to our server, not a third-party geocoder, and may appear in hosting access logs. Nearby cities use only a center you have chosen; no automatic phone-location request occurs. The directory covers cities/towns over 1,000 people and selected administrative seats, not every village, landmark or address. A city match does not verify an exact street address or where an item was lost/found. Data can be incomplete or inaccurate; custom public places remain supported.
Remembered search filters
Apply filters remembers your selected dates, keywords, location text, map center, distance, types, categories and display options in an encrypted, authenticated cookie on this browser or app for up to 180 days. It is separate from your account and does not sync between devices. Someone using the same browser or app may see the saved filters. Reset filters deletes this cookie and restores the defaults, including all dates. Saved dates remain the dates you selected; they do not automatically advance each day. Search-center coordinates still appear in filter URLs and may remain in history or hosting logs.
Pictures, claims and private messages
Uploaded pictures are resized and re-encoded to remove embedded location metadata. Visible faces, labels and addresses are not removed automatically. Photos follow the report’s Public or Friends-only audience; hidden, pending and expired report photos are restricted to the author and authorized administrators.
Claim details, identifying references and private messages are stored on our hosting database. Conversation participants and authorized administrators can read messages; claimants cannot read the finder’s private ownership reference. This is not end-to-end encrypted messaging. Email matching alerts are off unless you choose them; you can unsubscribe or disable alerts.
Use Account to block users, close or renew reports, or delete your account. Account deletion removes active access, photos, your message text, subscriptions and personal report details. Minimal abuse, security and financial records may remain for safety, legal and accounting purposes; hosting backups have separate retention.
Privacy & visitor logs
We keep account email addresses and report contact details private. Authorized moderators can access report contacts. Friend requests and accepted friendships share chosen display names, login IDs and avatars, not account emails. Avatars are normalized images with metadata removed. Login IDs can be used instead of email at sign-in; verified email remains necessary for recovery. Administrators can review profiles. Site IP blocks and a bounded settings audit are kept privately for security.
Visitor counting
We record the IP address seen by our server, UTC visit date, first and latest visit times, and page-view count. Each IP address counts as one visit per UTC day. Shared networks may count as one visitor; these are approximate traffic statistics, not a count of people.
Identifiable visitor logs are retained for 30 days and expired records are removed on the next site request. Only authorized moderators can retrieve these logs. Visitor and app-download totals are visible only to administrators and admin-group members, not to the public. Access to totals does not grant access to individual IP logs. The cumulative visitor map is restricted to the same admin group. It preserves aggregate approximate city/region counts after IP logs expire, using our local geolocation database. Older visits without retained location records remain in the total but are not placed on the map. Short-lived keyed daily identifiers prevent duplicate map counts; the map stores no raw IP addresses. We do not store visited URLs, verification tokens, browser fingerprints, or location lookups in this visitor log.
App downloads
The download counter records requests to our app-download link, not completed downloads or installations. If the link opens an app store or another download provider, that service has its own privacy practices.
Essential services
We use session cookies for sign-in and security. Verification, password-reset, opt-in matching and eligible friend-request notification emails are sent through Resend. Hosting-provider access logs and backups may have separate retention periods.