Privacy

If you scan a tag

Opening the address on a tag is recorded so that the owner can be told that the item was found.

• Stored for each scan: the tag, the time, whether the QR code or the NFC chip was used, your IP address, the browser's user-agent text, a device class derived from it (iPhone, Android, computer, other), the browser language, an approximate place derived from your IP address at that moment (country, region, city), and whether the request looked automated.
• The owner sees the time, QR/NFC, the device class, the language and the approximate place. The owner never sees your IP address or the user-agent text.
• IP address and user-agent text are erased 90 days after the scan. The remaining entry, including the approximate place, stays until the owner deletes the tag.
• The approximate place is looked up in a database kept on this server (IP geolocation by DB-IP, db-ip.com); your IP address is not passed to anyone for it. It can be off by a city or more.
• To avoid notifying the owner twice for the same visit, a cookie named "tv" with a random number is set for 10 minutes, and keyed hashes of that number and of IP address plus user agent are stored with the scan. These hashes are erased after 24 hours.
• If you send the form: your message, and if you provide them your name, your contact details and your location (latitude, longitude, accuracy). Your location is only read after you tap "Share my current location". All of this is emailed to the owner and stays visible to the owner until the tag is deleted. If the owner has chosen it for this tag, one second person the owner trusts gets the same emails - the one about the scan (time, QR/NFC, device class, approximate place) and the one with what you send - and nothing else.
• After sending, you get a private address on which the owner can answer and you can write again. What the two of you write there is stored with your message, emailed to the owner like your first message, and deleted with the tag. Only a hash of the secret part of that address is stored; whoever has the address can read the conversation, so do not pass it on.
• When the owner answers, you can be told. If you left an email address, one email goes to it for every time you wrote - it only says that there is an answer, never what the owner wrote - and one more if the owner thanks you when ending the conversation. For this, the language your page was shown in is stored with your message. If you switch on notifications on your device, the address your browser hands out for them and its keys are stored with the conversation, and the notice travels through the push service of your browser's maker (Google, Apple, Mozilla or Microsoft), encrypted for your device. All of this is deleted with the conversation. The owner can end the conversation, with or without thanking you; the time of that, and whether you were thanked, is stored with it.
• Photos, if you attach any - up to four with a message, and with every line you write afterwards: they are made smaller in your browser before they are sent and re-encoded here, which removes location data and everything else the camera wrote into the files. They are emailed to the owner with what you wrote (and to the second person, where one gets the owner's emails) and shown in the owner's dashboard; there they are deleted with the tag. The owner can send you photos in the same way: they are shown on your private page.
• If the owner shares the tag with other accounts - up to five, people who look after it as well - those accounts see what the owner sees of your visit and your message: the approximate place, your message, name, contact details, location and photo. They get the same emails and can answer you. They never see your IP address either.
• A cookie named "lang" remembers the language you picked, for one year. It contains only the code of that language, for example "en".

If you have an account

• Account: username, email address, password (only as an Argon2id hash), language, time zone, the time of your last login, and – if you enter them – a display name, a phone number, the name, phone number and email address of a second contact (the email address gets emails only after that person has confirmed it, and is removed when they stop them), a LINE ID and a Telegram username. If you save them: the settings for 3D printing (kind of printer, sticker size, module size, gap).
• Tags: name, description, category, type, status, your message to the finder, a note with an end date (it is no longer shown after that date, but stays stored until you change or remove it), lost note, reward text, what you chose to show to finders, and the picture. Uploaded pictures are re-encoded; location data and all other embedded information are removed, and the original file is not kept.
• Sharing a tag: if you share a tag with another account, that account sees the tag (name, description, category, picture, status), its scans and what finders wrote, and your display name or username; you see theirs. Which accounts share which tag, since when, and whether they want its emails is stored until one of you ends the sharing or the tag is deleted. A blank tag you made to give away stores nothing about the person who takes it in your account; you are only told that it was taken. With every answer to a finder, the account that wrote it is stored. Photos you send to a finder are re-encoded like every picture (the place they were taken and everything else the camera wrote into the files is removed), shown on the finder's private page to whoever has its address, and deleted with the tag.
• Scans of your tags and messages from finders, as described above.
• Login: each login needs a one-time code. By default it is sent by email; only a hash of the code is stored, for at most 10 minutes. If you set up an authenticator app, its secret key is stored encrypted until you switch the app off. If you add passkeys, their public keys, the names you give them and the time each was last used are stored until you remove them; the private part of a passkey never leaves your device. Password-reset links are stored as a hash for 60 minutes.
• Notifications on a device, if you switch them on there: the address your browser's notification service gave out for that device, the two keys that belong to it, the kind of device and when it last got a notification - until you switch them off, remove the device, or the service reports the address as gone.
• Session: a cookie keeps you logged in. The session record on the server contains your IP address and browser user-agent text and is removed within a day after it ends. If you tick "Stay signed in", a second cookie keeps the login for 30 days.
• An account whose email address is not confirmed is deleted after 7 days.

Emails

Emails (confirmation links, login codes, scan notifications, finder messages) are handed to the mail system of the server this application runs on, which passes them on through its mail relay provider. Emails waiting to be sent are stored encrypted and removed once sent; failed ones are removed after 7 days.

Server logs and backups

• The web server keeps an access log (IP address, time, address requested, user-agent text) for 14 days.
• The application keeps an error log for 14 days. It records technical faults, not form contents.
• A backup of the database and the pictures is made every night and kept for 14 days. Deleted data can therefore remain in backups for up to 14 days.

What leaves this server

• Nothing is sent to third parties apart from the emails described above and - for account holders who switched them on - notifications on their own devices. Those travel through the notification service of the maker of the browser (Google for Chrome, Apple for Safari, Mozilla for Firefox), encrypted so that only that device can read them. The service learns that a notification goes to the device, when, and how long it is. What the encrypted text holds: the name of the tag, the approximate place of the scan and the beginning of a finder's message.
• Map links open openstreetmap.org in your browser only when you click them. No map is embedded.
• The WhatsApp, Signal, LINE and Telegram buttons, where an owner enables them, are plain links to wa.me, signal.me, line.me and t.me that are only followed when you tap them.

Seeing and deleting your data

• Settings → "Download my data" gives you everything stored about your account, tags, scans and messages as a file.
• Deleting a tag removes its picture, its scans and all messages from finders.
• Handing a tag over to another account moves the tag itself (code, name, description, category, picture) to that account. Its scans and all messages from finders, with their photos, are deleted at that moment; they are not passed on.
• Settings → "Delete my account" removes the account with all tags, pictures, scans and messages at once.
• If you scanned a tag or sent a message and want that removed, contact the operator of this site (see the legal notice, if one is shown in the footer) or the owner of the item.