Privacy Policy

1. Information We Collect

Depending on the features you use, the system may process:

• Account information: your name, email address, and available profile information used for sign-in.
• Google sign-in information: information made available through Google authentication, such as your name, email address, and profile picture, subject to the permissions requested by the application.
• Lost and found reports: item names, descriptions, categories, dates, locations where items were lost or found, and item photographs.
• Claim information: claim descriptions, submitted evidence, claim status, and communications needed to verify ownership.
• System records: information necessary to maintain sessions, process requests, protect accounts, and troubleshoot errors, where such records are enabled.

Please do not submit passwords, government identification numbers, financial information, or other sensitive details unless a specifically authorized process requires them.

2. How We Use Your Information

Information may be used to:

• Create or identify your account during sign-in.
• Publish and manage lost or found item reports.
• Help users identify items and submit ownership claims.
• Track claim statuses and provide relevant notifications.
• Allow authorized administrators to review reports and claims.
• Maintain system security and investigate technical problems.
• Improve the system as part of its authorized development and testing.

Information should only be used for purposes related to operating, maintaining, securing, or improving the system, subject to applicable law and any required consent.

3. Google Authentication

If Google Sign-In is enabled, Google may authenticate your identity and share the profile information permitted by the sign-in configuration.

The system should use this information only for the disclosed authentication and account-related purposes. It does not need your Google password to authenticate you through the normal Google OAuth process.

Google services are subject to Google's own privacy policies and terms. Your use of Google Sign-In may involve Google's processing of information under those policies.

Do not assume that all Google account information is collected. The actual information processed depends on the OAuth scopes requested and the fields your backend stores.

4. Lost Item Photos and Public Information

Photographs and descriptions submitted in reports may help other users identify lost belongings. Information displayed to other users should be limited to what is necessary for item recovery.

Avoid including faces, identification cards, addresses, phone numbers, passwords, or other private information in uploaded images or item descriptions.

If the system makes reports visible to other users, information displayed in those reports may be seen by those users. Do not assume that every report is private unless the system explicitly restricts access.

5. Data Sharing and Disclosure

Personal information should not be sold or disclosed for unrelated commercial purposes. Information may be accessed or disclosed when reasonably necessary for the following:

• Authorized administrators reviewing reports, accounts, or claims within their assigned responsibilities.
• Google or other service providers involved in features you choose to use, subject to their respective roles and privacy policies.
• Responding to valid legal requirements or protecting the rights, safety, and security of users and the system.

Access should be limited to authorized persons and to the information required for the relevant purpose.

6. Data Storage and Security

The system uses a PHP backend and MySQL database for the information required by its implemented features. Uploaded files may also be stored in a server directory.

Appropriate safeguards should include access controls, secure session handling, input validation, protected database credentials, secure file-upload validation, and HTTPS when deployed online.

No website or storage method can guarantee absolute security. Users should report suspected unauthorized access or disclosure to the project administrator.

7. Data Retention and Deletion

Information should be retained only for as long as reasonably necessary for item recovery, claim resolution, security, legitimate project requirements, and applicable legal obligations.

When information is no longer needed, it should be deleted, anonymized, or securely disposed of when appropriate, subject to applicable retention requirements.

Deleting an account or report may not automatically remove every backup, log, or related record. Any deletion request will be handled according to the system's actual capabilities and applicable requirements.

8. Your Privacy Rights

Subject to applicable law, including the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), you may have rights to:

• Be informed about the processing of your personal data.
• Request access to personal information held about you.
• Request correction of inaccurate or incomplete information.
• Request blocking, deletion, or removal when legally applicable and subject to valid retention requirements.
• Object to certain types of processing where the law allows.
• Raise a concern or lodge a complaint with the appropriate authority when your rights have been violated.

To make a request, contact the designated project administrator using the contact method officially provided by the project team. Identity verification may be required before disclosing or changing account information.

9. Cookies and Session Data

The PHP application may use session cookies to maintain authentication status and support protected features. These cookies should be used only for necessary system functions and configured securely.

If additional analytics, tracking, or third-party services are introduced, this policy should be updated to explain what they collect and how users can manage applicable choices.

10. Third-Party Services and External Links

The system may connect to Google for authentication or other services if these integrations are implemented. External websites and services operate under their own policies. Review those policies before providing information to them.

The project team should review third-party integrations before deployment and disclose any additional data collection that they introduce.

11. Children's Privacy

The system is intended for its defined user community. It should not knowingly collect children's personal data without the appropriate legal basis, safeguards, and permissions where required by law.

12. Changes to This Policy

This policy may be revised when the system's features, data practices, or applicable legal requirements change. The latest version and its revision date should be made available on this page.

If a material change requires notice or consent, the project team should provide it as required by applicable law.

13. Contact and Privacy Concerns