Privacy Policy

• Account: your email address, used for passwordless sign-in. We don't collect a name or password.
• Reports: the item details, photos, and incident information you submit. Approved reports are publicly visible.
• Contact-relay messages: if you message a reporter about a search result, we collect your name, email, and message to deliver it to them.
• Abuse prevention: your IP address is processed briefly in-memory to enforce rate limits and verify you're not a bot (Cloudflare Turnstile). It is not permanently stored.

To operate the service: sending sign-in links, moderating and displaying reports, relaying contact messages, and sending you status updates about reports you've filed (approved, rejected, recovered).

• If you use the contact-relay feature, your name and email are shared with the reporter so they can respond to you. A reporter's email address is never shown to searchers — messages go through us.
• We use third-party infrastructure to run the service: Cloudflare (bot verification, network routing), Google Workspace (sending email via SMTP), and a self-hosted instance of Umami for analytics — Umami doesn't use cookies or track you across other sites.
• We don't sell your data, and we don't share it for advertising.

Reports are kept indefinitely, including recovered ones — that's intentional, so a previously-stolen item's history stays visible to future searchers. Account and report data is deleted on request (see below).

Under South Africa's Protection of Personal Information Act (POPIA), you can ask us to access, correct, or delete your personal information. Email [email protected] to make a request.

StolenOrNot isn't directed at children, and we don't knowingly collect data from anyone under 18.

We may update this policy from time to time; the “last updated” date above will change when we do.