Privacy Policy
Effective 4 August 2026 · Version 2026-08-04
1. What This Covers
This policy explains what HeyFound.it collects, why, and what control you have. It covers the website, the recovery portal, and the finder pages your tags link to.
2. What We Collect From Owners
Your email address and password (stored only as a salted scrypt hash, never in readable form), or your Google account identifier if you sign in with Google. Optionally: your name, a contact email, a phone number for SMS alerts, a public bio, and item details you choose to add. For orders: your shipping address and order history. Payment card details are handled entirely by Stripe and never reach our servers.
3. What We Collect From Finders
When someone scans your tag we record that a scan happened, the approximate device type (for example "iPhone"), and the time — so you can see activity on your item. We do not record a finder’s location, and we do not require them to have an account. If a finder sends you a message, we store the message, the name and contact detail they chose to give, and any photo or location text they typed.
4. What Finders Can See
A finder sees only what you choose to publish: your item name and description if you set one, a reward if you offer one, and your public bio. Your email address, phone number, shipping address, and full name are never shown on a finder page. Messages are relayed, so neither side sees the other’s address unless you choose to share it in a message.
5. Why We Use It
To operate your vault and relay messages to you; to fulfil and ship your orders; to send transactional email and SMS you have enabled (scan alerts, finder messages, order updates); and to keep the service secure, including rate limiting that uses your IP address. We never sell your data. We do not send marketing email unless you explicitly asked for it — see “Marketing email” below.
6. Who We Share It With
Only the processors needed to run the service: Supabase (database and file storage), Google Cloud (hosting), Stripe (payments), Resend (email), and Twilio (SMS, where enabled). Each receives only what its function requires. We may disclose data where legally required.
7. Cookies
We use a single essential cookie to keep you signed in, plus a short-lived cookie during Google sign-in to prevent request forgery. We use no advertising or third-party tracking cookies.
8. Retention
Vault, tag, message, and scan data is kept while your account is open, so your recovery history stays available to you. Order records are kept as long as required for tax and accounting. Expired sign-in sessions and used password-reset tokens are purged automatically.
9. Your Rights
You can export everything we hold about you as a JSON file from your dashboard at any time. You can delete your account from the same page: this removes your profile, messages, scan history and uploaded photos, and unclaims your tags so they can be reused. Because a printed code exists physically, the tag record itself is retained in an unclaimed state with no link to you. Depending on where you live you may also have rights to correct or restrict processing — email us and we will action it.
10. Marketing Email
We treat two groups differently, because the reason we may write to you differs. FINDERS: if you contacted an owner as a finder, there was an unticked box offering occasional updates — we record your address for marketing only if you ticked it, along with when you agreed and to which policy version. Ticking it changes nothing about the message you sent. CUSTOMERS: if you have bought from us, we may occasionally tell you about new products and changes to the ones you own, on the basis of that purchase rather than a tick. Either way, every marketing email carries a one-click unsubscribe that needs no account, unsubscribing stops BOTH kinds, and it never affects messages about an item you found or reported. We keep a record of your opt-out so a later form submission cannot re-subscribe you by accident. Creating an account alone does not put you on any marketing list. We never sell or share these addresses.
11. Children
HeyFound.it is not directed at children under 13 and we do not knowingly collect their data.
12. Changes
We may update this policy. Material changes will be announced on this page with a revised effective date.
13. Contact
Privacy questions, data requests, or complaints: support@heyfoundit.com.