Privacy Policy

1. Controller

The controller of your personal data is Maxim Kucherov (FindIt Labs), Slovakia. Contact for personal data questions: [email protected].

2. In short

• We collect only what FindIt needs to return items to their owners.
• Location is recorded only at the moment you photograph a find. We do not track you in the background or store a location history.
• No ads, no advertising ID, no third-party analytics, and we do not sell data.

3. Data we process

• Account: email, display name, password (stored only as a secure hash), Google or Apple account ID, language and a push notification token.
• Finds (public): photos (EXIF metadata is removed before storage), the place where you took the photo and an approximate address, category, colour and description (from AI or edited by you), status, a public location note, a voice message and its transcript. Finds are visible on the map, also to people without an account. Your name and email are not shown with them.
• Lost items (private): description, voice transcript, search area and radius, time of loss. Only you can see them; we use them to find matches.
• Chat: messages between finder and owner and the code that confirms the handover.
• Safety and moderation: reports you submit, account age and number of finds/lost items (abuse prevention).
• Technical data: app crash reports (device model, OS and app version, error details, account ID) and server logs with IP address for security and troubleshooting.
• We do not collect: background location, location history, advertising ID, contacts or photos from your gallery.

4. Purposes and legal basis

• Providing the service — account, finds, matching, notifications, chat (performance of a contract, Art. 6(1)(b) GDPR).
• Security, abuse prevention, content moderation, crash reports and backups (legitimate interest, Art. 6(1)(f) GDPR).
• Compliance with legal obligations (Art. 6(1)(c) GDPR).
• After account deletion, messages you sent in other people’s chats are kept unlinked from your account, based on the recipient’s legitimate interest in keeping the conversation and handover context (Art. 6(1)(f) GDPR).
• You grant access to the camera, microphone, location and notifications in your phone’s system dialogs and can revoke it at any time in the phone settings.

5. Artificial intelligence

Photos, voice messages and texts are processed by OpenAI to generate item descriptions, voice transcripts, automated moderation and match suggestions. OpenAI does not use API data to train its models and may retain it for up to 30 days for abuse monitoring. Matches are suggestions only — we make no automated decisions with legal effects.

6. Recipients (processors)

• Hetzner Online GmbH (Germany) — server and database.
• Cloudflare — storage of photos and voice messages (EU region), network and website protection, email forwarding.
• OpenAI (USA) — AI descriptions, voice transcription, moderation and matching.
• Google — push notifications (Firebase Cloud Messaging), Google sign-in, maps and address lookup (Google Maps) — to look up the address, your phone sends the photo’s coordinates directly to Google.
• Apple — Sign in with Apple (with the iOS version).
• Sentry (EU data region) — crash reports.
• We do not sell data or share it for advertising.

7. Transfers outside the EU

Some processors (mainly OpenAI, Google and Cloudflare) may process data outside the EU. Such transfers are protected by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

8. How long we keep data

• Account data, finds, lost items and chats — until you delete your account.
• When you delete your account we immediately delete the account, your finds including photos and voice messages, your lost items and the chats about your finds. Messages you wrote in other people’s chats stay with them, unlinked from your account.
• Database backups: 14 days on the server and 30 days in off-site storage in the EU; after that they are overwritten.
• Crash reports: up to 90 days.

9. Your rights

• Access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interest.
• Delete your account in the app (Profile → Delete account) or by email to [email protected].
• You can lodge a complaint with the Slovak data protection authority: Úrad na ochranu osobných údajov SR, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk.

10. Age

FindIt is intended for people aged 16 and over. We do not knowingly process data of younger children.

11. Security

All communication uses HTTPS, passwords are stored only as hashes, metadata is removed from photos and access to the server and keys is restricted.

12. Cookies

The app does not use cookies. The website uses no tracking cookies — only technical ones necessary for it to work and stay protected.

13. Changes

If we materially change this policy, we will let you know in the app.