Privacy

The short version

• We never know where anything is. No GPS, no Bluetooth, no last-seen, no approximate anything. finds.one knows an item was found — never where it is.
• Whoever finds your things is never asked for an account, a name, or an age. They type a message. That is all.
• Neither side ever sees the other's email address or phone number.
• We do not sell personal information, share it for advertising, or let anyone profile you with it.
• Conversations end, and so does what is in them. Messages are deleted 90 days after a conversation closes, and a conversation closes after 30 quiet days.

What we never collect

This comes second because it is most of the answer. The list of what finds.one holds is further down and is shorter than you would expect; this is why.

• Location, in any form. Not a setting: no code in this product reads, infers or stores a position, and a feature that needed one would be out of scope.
• Photographs or files. There is no upload surface anywhere, and a test fails the build if one appears.
• Your name, unless you write it in a message yourself.
• Anything about you from anywhere else. We buy no data, enrich nothing, and run no advertising tags, no third-party trackers and nothing that follows you to another site.
• Special-category data — health, beliefs, politics, biometrics — and California's "sensitive personal information". We ask for none of it and have no use for it.

Who we are

finds.one is a product of Urtti Apps Oy, a company registered in Finland. For anything in this policy — a question, a request, a complaint — write to support@finds.one and a person will answer.

Under the UK and EU General Data Protection Regulation we are the controller of the personal data described here.

If you found something and sent a message

You are not asked to sign up, and nothing about you is looked up. We keep your message and when you sent it, and a one-way hash of the key to the conversation — which is why we cannot email you your link, and why nobody else can reach that conversation either.

If you chose to leave an email address on the screen after sending, we keep that as well, to tell you when a reply arrives. The owner never sees it; they see only that a way to reach you exists. We also note that an attempt came from your network address, so that one script cannot flood a code with messages — it counts towards an hourly limit and is cleared out after.

Nothing else. Not your location, not your device, not the pages you looked at, and no cookie is set on a found page at all.

If you hold a code

An account exists to be reached, so what it holds is a way to reach you and the codes you have claimed: your email address as Apple or Google gave it to us, the identifier they use for you, the date you declared you are 18 or over, and your codes — their private labels, the message a finder reads, and whether the page is live. There is no password, so there is nothing about a password to store.

Two more, and both are there so the product can tell you when it has failed you. Your sign-in sessions, kept as one-way hashes rather than as the token in your browser, so that signing out genuinely revokes one. And a record of every message we tried to deliver to you and whether it arrived — without it, a message that silently vanished would be invisible to both of us.

If you left an address, or reported something

The waitlist keeps your address and which page you left it on, and nothing else. It buys one message, on the day finds.one opens. Write to support@finds.one and it is deleted; the whole list is deleted when the product opens.

A report is a safety record, so it has to survive the thing it describes: it keeps what you told us and a copy of the conversation and the page as they were at that moment. A snapshot rather than a link, so the person reported cannot alter it and is not told a report exists by their data suddenly freezing. Reporting takes no account and nothing to prove — we relay, we do not adjudicate, and we do not decide who owns what.

Cookies, and counting visits

Two cookies, both strictly necessary, and neither is set on a page a finder sees. A sign-in cookie, once you sign in, so that you stay signed in: It lasts 30 days and disappears when you sign out. And a short-lived one during the sign-in handshake itself, so the answer coming back from Apple or Google can be matched to the browser that started it.

We count visits, so we know whether anybody is reading. It is a privacy-first counter that sets no cookie and uses no identifier: no profile is built, nothing is stored that could point back at you, and nothing about you leaves for another site. What it produces is a number of page views, not an audience.

There is nothing to consent to beyond the two cookies above, which is the honest reason this site has no cookie banner. If that ever stops being true, the banner arrives with it.

Why we are allowed to hold it

Under the GDPR, each thing above rests on one of these:

• To do what you asked (Article 6(1)(b)) — carrying a message to the owner of a code, keeping you signed in, telling you a reply arrived.
• Our legitimate interests (Article 6(1)(f)) — keeping the service safe and working: rate limits, delivery records, and reports. We have weighed these against your interests and kept each one as small as it can be while still doing its job.
• Your consent (Article 6(1)(a)) — the address you leave on the waitlist, and the optional address a finder leaves to hear about a reply. You can withdraw it at any time and we will delete the address.
• A legal obligation (Article 6(1)(c)), where one applies to us.

When it is deleted

Everything personal here expires. The windows below are enforced by a job that runs against the database rather than by a promise, and they are the same numbers the product shows you on a closed conversation.

• A conversation closes after 30 quiet days, or when it reaches 40 messages, or when the owner closes it.
• 90 days after it closes, the messages in it and any address the finder left are deleted. What is left is a hashed key, a count and two dates — nothing about either person. The row stays so that both links can say the conversation was cleared rather than that it never existed, which a mistyped link cannot be told apart from.
• A reported conversation is held from deletion while we look at it, for at most 180 days, and is then deleted normally. A window rather than a flag on purpose: an investigation nobody gets round to must not keep a stranger's address forever. The report and its own snapshot are kept beyond that, as our safety record.
• Your account and your codes: until you ask us to delete them.

Two smaller ones, for completeness: rate-limit notes stop counting after an hour and are cleared out after that, and a sign-in session lasts 30 days or until you sign out.

Who else sees it

Nobody buys it, and nobody is given it to use for themselves. It is handled by the companies that run the machinery — our hosting provider, our database provider, and our email provider, which necessarily sees the address a message goes to — each under a contract that only lets them act on our instructions. Write to support@finds.one for the current list.

Apple and Google see a sign-in, if you use one. They tell us your email address and an identifier; we tell them nothing about what you do here, and there is no sign-in on any page a finder sees.

Some of these providers are outside the European Economic Area. Where that is so, the transfer rests on the European Commission's Standard Contractual Clauses or on an adequacy decision. We would also disclose data where the law actually requires it — a valid order, not a request — and we will tell you when we are allowed to.

Your rights

If the GDPR or the UK GDPR applies to you, you can ask us to: give you a copy of what we hold; correct it; delete it; restrict what we do with it; hand it to you or another service in a portable form; or object to us relying on a legitimate interest. Where we rely on consent, you can withdraw it at any time without affecting what came before.

Write to support@finds.one. We will answer within one month, and we do not charge for it. We may need to check that the address you are writing from is the one we hold — that is the only verification we have, because it is the only thing we know about you. There is no automated decision-making and no profiling here; nothing about you is scored.

If we get it wrong, you can complain to your national data protection authority. We would rather you told us first, but that right does not depend on it.

California

If you live in California, the CCPA as amended by the CPRA gives you specific rights, and they sit on top of everything above rather than replacing it.

In the last twelve months we have collected the categories listed in this policy: identifiers (an email address; a provider identifier if you sign in), your own content (the message you wrote, a report you filed), a minimal network record used for rate limiting, and an anonymous count of page views that is tied to no identifier and to no person. All of it comes from you, directly. We collect no commercial information, no biometric information, no precise geolocation, no sensitive personal information, and we infer nothing about you. We use it to run the service, to deliver messages, to keep the place safe, and to answer you, and we disclose it for those business purposes to the providers named above and to nobody else.

We have not sold personal information, and have not shared it for cross-context behavioural advertising, in the last twelve months — and we do not intend to. We do not use or disclose sensitive personal information for any purpose that would require offering you a right to limit it, because we do not collect any. There is nothing here to opt out of, which is why there is no "Do Not Sell or Share" link.

You can ask us to tell you what we hold and where it came from, to delete it, or to correct it; you can use an authorised agent; and we will never treat you differently for asking. Write to support@finds.one.

Children

Accounts are for adults: you declare that you are 18 or over when you create one. That rule is about who holds an account and says nothing about what a code is written on — a child's school bag is exactly the sort of thing this is for.

A person who finds something is never asked their age, because they are doing someone a favour and a wall in front of that is a thing that stays lost. We do not knowingly collect personal data from children, and if you believe a child has sent us something, write to support@finds.one and we will delete it.

How it is kept safe

Everything travels over TLS. The key to a conversation and the token in a sign-in cookie are stored only as one-way hashes, so a stolen copy of the database is not a stolen set of conversations or sessions. There are no passwords to leak, and access to the database is limited to the people running the service.

No one can promise perfect security. If a breach ever affects your data, we will tell the relevant authority and, where the law requires it, you.

Changes

When this policy changes, the date at the top changes with it. If a change materially affects what we do with data we already hold, we will say so rather than leave you to notice.

Getting in touch

Write to support@finds.one. A person reads it and answers — there is no form, no ticket number and no bot.