Privacy Policy for Lost or Found
Last updated 1 November 2026
1. Who is responsible
Lost or Found AS, organisation no. 938 439 877, Storåsveien 10, 1169 Oslo, Norway, is the controller of the personal data in the app. Questions about privacy can be sent to admin@lostorfound.app.
2. What the app does
Lost or Found helps people who have lost something and people who have found something to find each other. The app compares lost and found cases, notifies you about matches, and lets the owner and the finder chat once the owner has confirmed a match. The owner can also buy an area alert that reaches users who have chosen to follow an area.
3. What data we process
| Data | When | Why |
|---|---|---|
| E-mail address and sign-in | When you create an account. As a guest you get an anonymous sign-in without e-mail. | To give you an account and link your cases to you. |
| Cases: item, category, colours, brand, description, time, finder's reward, where the item is now | When you register something lost or found. | To find matches and show the case to the other party. |
| Location: point and search areas for the case | When you choose a place on the map. | To find nearby matches. The exact place found and the hand-in place are shown to the owner only after the owner has confirmed the match. |
| Photos | When you add photos. | To show the item. Location and other hidden data (EXIF) are removed before the photos are stored. |
| Chat messages and read status | When you write in a chat. | So the owner and finder can arrange the hand-over. |
| Observations (seen/found) with place and time | When you report an observation on an area alert. | To help the owner find the item. |
| Alert areas | When you save an area you want to follow. | To send you the area alerts you asked for. |
| Push token, device language and notification settings | When you allow notifications. | To send notifications in the right language. |
| Purchases: product, amount, time and receipt | When you buy an extension, a historic case or an area alert. | To deliver the service and meet bookkeeping obligations. |
| Reports, blocks and suspended accounts, with a copy of the latest messages in a reported chat | When someone reports or blocks. | To protect users against scams and harassment. |
| Technical error data (app version, device type, error message) | When the app or service fails. | To find and fix errors. |
| Number of cases, messages and requests per period | Continuously. | To prevent abuse. |
We do not ask for your name, phone number or address. Such details are only shared if you write them in a chat yourself.
4. Legal basis
- Contract (GDPR Art. 6(1)(b)): to deliver the service you asked for – cases, matches, chat, notifications and purchases.
- Legal obligation (Art. 6(1)(c)): keeping purchase records under bookkeeping rules.
- Legitimate interest (Art. 6(1)(f)): security, preventing scams and abuse, reporting and blocking, fixing errors.
- Consent: access to location and push notifications is given in your phone's settings and can be withdrawn there at any time.
5. Who sees what
- The other party in a match sees your case, but not your e-mail address. The exact place found and the hand-in place are shown only after the owner has confirmed the match.
- Recipients of an area alert see the item and an approximate area, not who you are.
- A person you block or report is not told. They only see that the chat is closed.
- Administrators at Lost or Found AS see reports and the copy of the messages in a reported chat in order to handle the report.
6. Processors and transfers
We use these providers to run the service. They process data on our behalf under agreement:
| Provider | Use | Location |
|---|---|---|
| Supabase | Database, sign-in and photos | EU (Ireland) |
| Render | App server | EU (Frankfurt) |
| Sentry | Error reports | EU |
| Expo (650 Industries) | Sending push notifications | USA |
| Apple and Google | Push notifications, app stores and payment | USA / EU |
| Google Maps Platform | Maps and place names | USA |
| RevenueCat (when introduced) | In-app purchases | USA |
For transfers outside the EU/EEA we rely on the European Commission's standard contractual clauses or the provider's certification under the EU–US Data Privacy Framework.
7. How long we keep data
- Lost cases are active for 7 days and can be extended or made historic for 1–3 years. Found cases are active for 30 days and can be extended to 90. Closed and expired cases stay in your history until you delete them or your account.
- When you delete a case, it is deleted at once with its matches, chats, notifications and photos. If something was bought for the case, an archived version without contact details is kept as long as bookkeeping rules require (normally five years after the end of the financial year).
- When you delete your account, all your cases, alert areas, notifications, push tokens and your sign-in are deleted. Purchase records are kept as above.
- Chat reports are deleted 12 months after they have been handled. Blocks last until they are lifted or the account is deleted.
- Technical error reports are deleted automatically by Sentry within 90 days.
8. Your rights
You can ask for access, correction, deletion, restriction and data portability, and you can object to processing based on legitimate interest. You can delete your account and all cases yourself in the app under Profile → Delete account. Other requests can be sent to admin@lostorfound.app; we reply within 30 days. You can complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).
9. Children
The app is not made for children under 13. We do not knowingly collect data from children under this age.
10. Changes
We update this policy when the service changes. We will tell you in the app about significant changes.