Privacy Policy

1. Introduction

Lost.ca is a volunteer-run Canadian pet lost-and-found community. This policy explains what personal information we collect, how we use it, who we share it with, and your rights. We collect only what we need to help reunite lost pets with their families.

2. Information We Collect

Information you give us:

• Account details: email, password (stored only as a hash), and optional display name.
• Phone number and contact email when you add them to a lost-pet listing. Contact info you put on a listing is publicly visible on that listing.
• Pet listing details: photos, descriptions, last-seen locations, microchip numbers, reward offers.
• Found-pet sighting reports: photos, descriptions, location, optional contact information.
• Community sighting tips you post on other owners' listings.
• Reports, messages, and support requests you send us.

Information collected automatically:

• Approximate location (city, region, country) derived from request headers set by our hosting provider. Used to show local content. Not precise geolocation.
• Browser type, device type, operating system, and IP address.
• Pages visited, referrer, and session timing for analytics.
• Cookies used for sign-in sessions and anti-abuse (login throttling).

3. How We Use Your Information

• To run the service: display your listings and sightings, notify you of matches, let finders contact you.
• To prevent abuse: rate limits, CAPTCHA verification, login lockout after repeated failures.
• To improve the service: aggregated analytics about usage patterns.
• To communicate with you: account emails, password resets, service announcements.
• To comply with applicable laws.

4. Sharing Your Information

We do not sell your personal information. We share specific categories of data with service providers needed to run Lost.ca:

• Supabase — authentication, database, and file storage.
• Vercel — hosting, Web Analytics, and Speed Insights.
• Google Analytics — aggregated page-view and usage data.
• Postmark — transactional email (password resets, sighting notifications), when enabled.
• Cloudflare Turnstile — bot-protection CAPTCHA, when enabled.

Information you place on a public listing (your phone number, email, contact name, pet photos, last-seen location) is visible to anyone browsing the site. Do not include anything you do not want to be public.

We may disclose information if required by law, court order, lawful subpoena, or to protect the rights, property, or safety of Lost.ca, our users, or the public.

5. Cookies and Tracking

Lost.ca uses cookies for sign-in sessions and analytics. Most browsers let you control cookies through their settings. Disabling cookies may prevent you from signing in.

6. Your Rights

Under Canadian privacy law (PIPEDA) and similar laws elsewhere, you have the right to:

• Access — request a copy of the personal information we hold about you.
• Correct — ask us to fix inaccurate information. You can edit your own listings directly.
• Delete — close your account and have your personal listings removed.
• Withdraw consent — stop using Lost.ca and request deletion.
• Complain — to the Office of the Privacy Commissioner of Canada.

To exercise any of these rights, email us using the contact at the bottom of this page. We respond within 30 days.

7. Data Retention

• Active listings and sightings remain until you remove them or mark them reunited.
• Removed content may persist in backups for up to 90 days.
• Account profile data is retained while your account is active. When you close your account, we delete your profile within 30 days.
• Rate-limit and login-attempt records are kept for 48 hours, then deleted.
• Analytics data is aggregated and retained per the provider's policy (typically 14 months for Google Analytics).

8. Security

We use industry-standard protections:

• All traffic is encrypted in transit with HTTPS.
• Passwords are never stored as plain text; they are hashed (managed by Supabase Auth).
• Authentication attempts are rate-limited to prevent brute-force attacks.
• Uploaded photos are restricted to common image formats and a maximum file size.

No method of storage or transmission is completely secure. We cannot guarantee absolute security.

9. International Data Transfers

Our database is hosted on Amazon Web Services infrastructure in the Western United States. Some of our service providers operate globally. By using Lost.ca, you consent to your information being transferred to and processed in the United States and other countries where our providers operate.

10. Children's Privacy

Lost.ca is not directed at children under 13. If we learn we have collected personal information from a child under 13, we will delete it.

11. Changes to This Policy

We may update this policy. The "Last updated" date at the top will change when we do. For material changes, we will post a notice on the site. Continued use after changes means you accept the updated policy.

12. Contact

Questions or requests about your data? Email support@lost.ca.