Privacy policy
Last updated
LostMe sells plaster-shaped QR stickers. When someone finds a sticker they can scan it and tell the owner where it is. This page explains what personal data that involves, why we use it, and your rights. We try to collect as little as we can.
Who we are. LostMe is the trading name of , a sole trader, 33 Herons Court, Durham, DH1 2HD. Email dev@nirr.uk.
What we collect, and why
| Who | What | Why | How long |
|---|---|---|---|
| Customers | Name, email, delivery address, order details, the design you made | To take payment, print and post your order, and send receipts (contract) | 6 years after the order, for tax and accounting records |
| Account holders (owners) | Email address; the name and message you give each sticker; reports finders send you | To sign you in, link stickers to you and email you when a sticker is found (contract) | Until you remove the sticker or delete your account |
| Finders | Optional: a message, a contact detail, the place you type or drop on a map, or your phone’s location if you allow it | To tell the owner where their item is (legitimate interests: returning lost property, and what the finder chooses to send) | Location, place and contact are deleted 30 days after the report. The message stays on the owner’s list until they remove the sticker or their account |
| Waitlist | First name (optional) and email address | To email you once when the shop opens (your consent) | Until we have emailed you at launch plus 3 months, or until you ask us to delete it |
| Everyone | A scrambled (hashed) version of your IP address used only to count requests and block spam. It cannot be turned back into your IP address | Security and abuse prevention (legitimate interests) | 2 days |
Finders are never asked to give a name or sign in. The owner never sees a finder’s IP address. We never sell personal data and we do not use it for advertising.
Your location: one moment only
If you find a sticker, your location is only used at the moment you choose to send it. We cannot and do not track you.
- Scanning does not share your location. Opening the page from a QR code tells us nothing about where you are. The page only asks your phone for its location after you tap the button to tell the owner.
- One reading, once. When you tap, your phone gives us its position once, at that moment, and sends it with your report. We do not keep watching, we do not ask again later, and nothing keeps running after you close the page. There is no app and no background tracking.
- It is your choice. Your phone asks you first, and you can refuse. You can send the report without a location, or type roughly where the item is instead.
- Who sees it. Only the sticker’s owner, in the email we send them. To show a street address we send the coordinates to OpenStreetMap, as listed below. We do not use your IP address to work out where you are.
- How long we keep it. The location is deleted automatically 30 days after the report. If you open the map to drop a pin, it may centre on you if you have already allowed location for this site; that stays on your phone unless you send the pin.
Cookies and similar storage
We do not use advertising or analytics cookies. Your browser stores a few things on your device that the site needs in order to work: your sign-in session, your design while you work on it, and your pack and tool choices. These are strictly necessary, so there is no cookie banner. Our payment provider and bot check may set their own technical cookies on their own pages.
Who else handles your data
We use these providers to run the service. Each only receives what it needs:
- Supabase: our database, sign-in and server functions.
- Vercel: hosts the website.
- Resend: sends our emails (sign-in codes, find alerts, receipts).
- Stripe: takes card payments on its own secure page. We never see or store your card number.
- Cloudflare Turnstile: a bot check on forms, to stop spam.
- OpenStreetMap: map images for the “drop a pin” map, and turning a finder’s coordinates into a street address (the coordinates are sent to its address service).
- Google Maps: owners can open a find in Google Maps by tapping a link. Nothing is sent to Google unless the owner taps it.
Some of these providers are based in, or process data in, countries outside the UK such as the United States. They use recognised safeguards such as the UK International Data Transfer Addendum.
Your rights
You can ask us to see, correct, delete or export your personal data, and to stop using it for something you object to. Account holders can delete their account at any time from the My stickers page: your stickers become unclaimed again and their finds are deleted. For anything else email dev@nirr.uk. We reply within one month.
If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).
Changes
If we change what we collect we will update this page and the date at the top.