Privacy Policy

Who we are

La2eeto (لاقيته) is a service available at https://la2eeto.app. For any privacy question write to support@la2eeto.app.

What we collect

• Account: your email address, your password (stored only as a salted hash), your language, an optional first name, and whether your email is confirmed. If you sign in with Google we receive your Google email, first name and a Google identifier. We never receive your Google password.
• Profiles: for pets, belongings, people and (parents and guardians only) children, the name or nickname and the fields you choose to fill in, such as breed, colour, instructions, a description, or medical and emergency notes. Each field has a visibility you choose. Pets can have an optional photo, and you can add phone numbers for finders.
• Pet health card: vaccines, vet name and phone, microchip number, notes, birthday and next vaccine date. Only you and the family members you invite can see it.
• Family and trusted contacts: the email addresses you invite, their role and the invitation status.
• Photos: re-encoded on our server, which removes location and other hidden metadata.
• Messages: messages from finders (the text, any contact details the finder chooses to type, and a location only if the finder agrees to share it), your replies, and conversations between account holders about lost-and-found reports.
• Lost-and-found reports: a title, description, colour, the general area you type and the date. We do not ask for a precise location.
• Alert areas: up to three area names you type for nearby alerts. We never read your phone's location for this.
• Notification settings and, if you turn on push, your browser's push address.
• Support messages you send us: name (optional), email, topic and message.
• Technical: IP addresses are used briefly in server memory for rate limiting and abuse prevention. Our server and hosting provider keep ordinary technical logs (errors, restarts). The app does not write message text, passwords or reset tokens to them. Error reports contain the type of error, an anonymised page address, browser details and an internal random account number, and never message text, profile contents, emails or IP addresses.
• Visit counts: for a few days after launch only, we count page views anonymously: the page address (never a query string) and a visitor code that changes every day and is not your address. They are not linked to your account, no buttons or clicks are recorded, and the counting stops by itself on a set date. We honour Do Not Track and Global Privacy Control. The counts are kept for 180 days.
• Scan history: the time each QR page is opened and which profile it belongs to, kept for the period you choose (7 days to 1 year, 90 by default). No IP address and no location is stored with it. Link previews and bots can also open the page and be counted.

What is public

• Only the profile fields you set to be visible to anyone, plus the pet photo if you enable it.
• Distinguishing features, the health card and anything you set to private or trusted are never public.
• Phone numbers you add appear on the public page only while Lost Mode is on. Anyone who has the QR code or its link can see them during that time.
• A child's page can show only a nickname and up to four fields the guardian chooses (age range, critical alerts, communication needs, emergency instructions). It never shows a photo, a phone number, an address or a school.
• Lost-and-found reports are public: title, description, colour, general area and date. Your name, email and phone number are not shown.
• The QR code contains only a link, never personal data.

How we use data

To run the service: send account emails (confirmation, password reset and security notices), deliver finder messages to you, and prevent abuse. When a finder writes, we email you and, if you turned push on, notify your devices. The email can include the finder's message; push notifications never contain names or message text.

Other emails are optional and each has a switch in Settings: lost-report messages and suggested matches, nearby alerts, the note when a tag is scanned for the first time, and, when we switch them on, a reminder after a lost report has been open for a week and pet birthday or vaccine reminders. Security emails cannot be switched off.

When you mark a suggested match as "not a match" we keep the reason you chose (a fixed list, no free text) so the suggestions improve. We use the anonymous visit counts only to see how much traffic the launch brings. We also send one welcome reminder to an account that has not made a profile a day after signing up (a push notification to your devices, or an email only when scheduled emails are on; you can turn reminders off in Settings). We do not use outside analytics or advertising trackers and we do not sell personal data.

Location

A finder's location is requested in their browser only after they tick a box and grant permission. If shared, it is stored with that message and shown to the owner as unverified information, and the Where it was seen page plots only places shared this way. We never infer location from a QR scan. Nearby alerts use only the area names you type.

Sharing and providers

We use these providers to run La2eeto. Each receives only what it needs for its job.

Hosting: Amazon Web Services (Lightsail), Frankfurt, Germany. Our servers and database run there.

Email delivery: Resend, which processes the recipient address and the email text to send our emails.

Domain and DNS: Cloudflare. Email sent to support@la2eeto.app is forwarded by Cloudflare Email Routing.

Error monitoring: Sentry, EU data region, limited to the error details described above.

Sign in with Google (only if you choose it): Google.

Push notifications (only if you turn them on): your browser's push service (Google, Apple or Mozilla) delivers them.

These providers are located outside Egypt. We transfer data to them only as needed to run La2eeto. We do not sell personal data or share it for advertising, and we may disclose data if the law requires it.

Retention and deletion

Deleting a profile removes its QR codes, photo, phone numbers, messages, health card and scan history. Deleting your account removes your profiles and everything above, plus your settings, alert areas and sessions, and frees the email address. Finder messages are kept until you delete the profile or account. Support messages you sent us and a minimal audit log without personal details are kept while we need them to run and protect the service.

Nightly backups of the database are kept for 14 days, so deleted data can remain in a backup for up to 14 days. A fixed deletion period for support messages and audit logs is still to be set.

Your rights

You can see and download a copy of your data (Settings, Download my data), correct it by editing your profiles and account, delete a profile or your whole account, turn notifications off, and sign out every other device. You can refuse to share location at any time.

For anything else, including questions, objections or complaints, write to support@la2eeto.app. Egypt's Personal Data Protection Law (Law No. 151 of 2020) may give you further rights, and a lawyer still has to confirm how it applies to La2eeto.

Children

La2eeto accounts are for adults (18 or older). A child never has an account. A parent or guardian can create a profile for a child from their own account and confirms they are the responsible adult.

A child's profile is minimal: a first name or nickname, and up to four optional fields the guardian chooses to show. It has no photo, no phone number, no address and no school, and a child's health details are never public. Our team reviews every new child profile before its QR code works, and for that review sees the nickname and the guardian's account email.

The guardian can delete a child's profile at any time, which erases it. We cannot verify that someone is a child's legal guardian. La2eeto does not guarantee a child's safety and does not replace the police or emergency services.

Security

We use measures such as encrypted connections, hashed passwords, secure session cookies, rate limiting, access checks on every private action, private-by-default profiles and audited staff actions. No system is perfectly secure.

Changes and contact

When we change this policy we post the new version here with a new date, and for material changes we also tell account holders by email. Questions: support@la2eeto.app.