Privacy Policy
Effective date: August 17, 2026 Last updated: August 17, 2026
The short version
We built qrakr so that a stranger who finds your lost item can reach you without ever seeing your phone number or email address. Protecting that information is the entire point of the product, not an afterthought.
This policy explains what we collect, why, who we share it with, and what you can ask us to do about it. If anything here is unclear, email us at [email protected] and we will answer in plain language.
Who we are
qrakr is operated by Qrakr Inc., a corporation incorporated federally in Canada and based in Nova Scotia.
Privacy contact: Kshitij Patel, Director Email: [email protected] Postal address: available on request by email
This person is accountable for our compliance with Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Law 25. Write to them with any question, complaint, or request about your data.
What we collect
We collect three different sets of information from three different kinds of people.
If you own a qrakr account
| What | Why we need it | Required? |
|---|---|---|
| Email address | To sign you in and send you alerts when your item is found | Yes |
| Phone number | To send SMS alerts and run the masked SMS/voice relay | Only if you use those features |
| Your tags and items — nickname, description, photo, message to the finder | This is the product | You choose what to enter |
| Payment details | Handled entirely by Stripe. We never see or store your card number. | Only for paid plans |
| Basic usage information — pages visited, actions taken, device and browser type | To find bugs and understand what to improve | Automatic |
If you scanned a tag and are trying to return something
You do not need an account, and we do not ask for your name.
| What | Why | Required? |
|---|---|---|
| A temporary session identifier stored in your browser | So we can keep your conversation with the owner going | Yes |
| Your message to the owner | To pass it on | You choose what to write |
| Your approximate location | Only if you tap to share it — it helps the owner find their item | No. Entirely optional. |
| Your phone number | Only if you choose to text or call through our relay | No. |
| Technical scan information — date, time, rough region, device type | Security, abuse prevention, and so the owner knows their item was seen | Automatic |
If you just visit our website
Standard web analytics: pages viewed, rough region, device and browser type, and how you found us. None of this uses cookies. Vercel Analytics is cookieless by design, and we run PostHog in a mode that keeps everything in memory for the length of your visit and writes nothing to your device. The trade is that we cannot recognise you when you come back — we decided we would rather not be able to.
What we never do
- We never show the owner's phone number or email address to a finder.
- We never show the finder's phone number to the owner. All contact runs through our relay.
- We do not record or transcribe relay phone calls. Ever.
- We do not sell your personal information to anyone. Not for advertising, not in aggregate, not at all.
- We do not use your item photos or messages to train AI models.
How long we keep things
| Data | How long we keep it |
|---|---|
| A finder's browser session | 30 minutes |
| A sign-in code sent to your email | 10 minutes |
| A conversation between a finder and an owner | The conversation closes 7 days after it starts and cannot be reopened. The messages themselves stay on the owner's account as their record of what happened, and are deleted when the account is deleted. |
| A tag you delete | Recoverable by you for 7 days, then gone |
| Your account and everything attached to it | Until you ask us to delete it |
| Billing records | 6 years from the end of the tax year they relate to, as Canadian tax law requires |
| Breach records | 2 years minimum, as required by PIPEDA |
We are being precise here on purpose. Some products claim messages "disappear" when they only become unreadable. Ours close after 7 days so nobody can reopen an old conversation about your property — but the owner keeps the transcript until they delete their account. We would rather tell you that plainly than imply something tidier.
Who else touches your data
We use other companies to run qrakr. Each one only gets what it needs, and each is bound by contract. Most are located in the United States, which means your information may be stored or processed outside Canada and may be accessible to foreign courts and law enforcement under the laws of those countries.
| Company | What it does for us | Where |
|---|---|---|
| Supabase | Database and sign-in | United States |
| Vercel | Website and application hosting | United States |
| Stripe | Payments — they hold your card details, we do not | United States |
| Telnyx | SMS messages and masked phone calls | United States |
| Resend | Email delivery | United States |
| Upstash | Temporary caching for fast tag scans | United States |
| Sentry | Error reporting so we can fix crashes | United States |
| PostHog | Product analytics | United States |
This list changes as the product changes. We will update this page when it does.
One thing we want to be upfront about
Our analytics providers record the web address of each page you look at. For a found page, that address contains the tag's code — the same code printed inside the QR sticker.
We strip that code out before it reaches any of them. A tag code opens a stranger's found page, so it is treated as a key, not as an analytics field, and it does not leave your browser.
Your rights
Whoever you are and wherever you are, you can ask us to:
- Show you everything we hold about you.
- Correct anything that is wrong.
- Delete your account and everything attached to it. Email us and we will do it within 30 days. (This is a manual process today — we are building a self-serve button.)
- Send you a copy of your data in a portable format.
- Withdraw consent for anything optional — location sharing, SMS, marketing email.
- Stop marketing emails. Every one has an unsubscribe link, and we honour it within 10 business days as Canadian anti-spam law requires. Service messages — a found alert, a receipt, a security notice — are not marketing and will keep coming while you have an account.
Email [email protected]. We will respond within 30 days.
If you are in Quebec, Law 25 also gives you the right to ask us to stop a search engine from indexing information about you, and the right to know if a decision about you was made automatically.
If you are in California, Virginia, Colorado, Connecticut, Delaware, Vermont, Texas or another US state with a privacy law, you may have additional rights. We extend the rights listed above to everyone regardless of where you live, so ask and we will help.
Security
- Everything travels over encrypted connections (TLS).
- Database access is enforced per-user at the database level, not just in the app.
- Payment card details never reach our servers.
- Relay identities are kept separate by design — the system does not join a finder to an owner's real contact details.
No system is perfectly secure. If a breach happens that creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as soon as we can, as the law requires.
Children
qrakr is not for children. You must be at least 16 to hold an account. We do not knowingly collect information from anyone younger.
Parents often tag their children's belongings. If you do, please do not put your child's full name on the public found page. Use a nickname or just describe the item.
Changes to this policy
If we change something that matters, we will email account holders and update the date at the top. Continuing to use qrakr after that means you accept the change.
Complaints
Write to us first at [email protected] — most things are a misunderstanding we can fix quickly.
If you are not satisfied, you can complain to:
- Office of the Privacy Commissioner of Canada — priv.gc.ca
- Commission d'accès à l'information du Québec, if you are in Quebec — cai.gouv.qc.ca