Privacy notice
LostLink is intended for a single school's or college's lost-and-found community. The site's visitors can open the public website, but a confirmed, signed-in campus account is required to view reports, publish a report, or send a response.
Who operates LostLink?
The deploying school/college or project owner operates the service and determines the applicable privacy contact, retention schedule, and response process. For project questions, use sohailali828545@gmail.com or call 8285458063. The institution should confirm the official privacy contact before launch.
Information the service processes
- Account information: name and email address, plus authentication details handled by Supabase Auth. If Google sign-in is enabled, Google processes the sign-in and shares permitted account/profile data.
- Lost/Found reports: item title, category, item date, location, description, optional photo, owner account ID, status and timestamps. Do not post student IDs, phone numbers, home addresses, passwords or other sensitive identifiers.
- Responses: messages sent to a report owner. These responses are stored in the database and are readable only by the owner of that report through the app's database policies.
- Admin access requests: college name, college-issued email, name, designation/staff authorization details, request decision and reviewer note. Only the requester and authorized same-institution Admins should be able to read the request.
- Moderation and abuse-prevention metadata: approved Admin moderation actions and notes are recorded in an audit trail. Rate-limit records contain account ID, event type, report reference and time, and records older than seven days are pruned during later submissions.
- Technical data: Supabase and the hosting provider may process connection/security logs as described in their own terms. Supabase Auth keeps a sign-in session in the browser so users can stay signed in.
Who can see reports?
Report details and item photos are available to authenticated accounts in the same configured campus project. This release is designed for one institution per Supabase project; it does not isolate multiple institutions sharing one project. Item photos use a private bucket and time-limited signed URLs, but a recipient could copy a signed link while it remains valid. Only post content that is appropriate for other signed-in campus members to see.
Service providers
Supabase provides authentication, database and item-photo storage. Google is used only if Google sign-in is enabled. Vercel or another selected hosting provider serves the website when deployed. Their handling of data is governed by their respective policies and your institution's service settings.
Retention and deletion
A report remains until its owner deletes it or an authorized Admin removes it. Deleting a report also removes its responses; report-photo cleanup is attempted by the app after deletion. Moderation audit entries are retained separately for accountability. The college/project owner must define a retention period and process for account deletion, backups, and support requests before launch, and must explain those rules here.
Safe use
Do not use public report text to reveal sensitive details. Arrange item returns in a safe public place or through an official campus office. LostLink does not independently verify ownership of every item or guarantee recovery.
Contact and policy review
For project/privacy queries, contact sohailali828545@gmail.com or 8285458063. The college must review this page against actual settings, applicable law, retention requirements and internal policies before the site is made available to its community.