Legal

Privacy Policy

Last updated: 21 August 2026 · Version 1.3

This Privacy Policy explains what personal data lostblip collects, why we collect it, how long we keep it, and what rights you have over it. It is written to comply with the EU General Data Protection Regulation (GDPR). We collect as little as we can: there is no advertising, no tracking, no profiling, and no sale of data to anyone.

1. What data we collect

We only collect what the platform needs to work:

• Your email address: required to create an account, sign in, and recover access. Your password is never stored in readable form; it is stored only as a cryptographic hash by our authentication provider
• A display name: optional. You may also choose to appear anonymously to other users
• Journey details you enter: the type of journey, its number, date, and depending on the journey its route, time, seat or carriage. Some of these are required to publish an announcement and others are optional; the form indicates which as you fill it in
• The text of your announcements: written by you, reviewed by us before publication. Once approved, an announcement can be found without an account: on that journey's board by searching for that exact journey, and if you choose the public board it is also listed for anyone browsing the site. You make this choice each time, and you can delete an announcement at any point
• The content of your private replies: see Section 3
• A phone number or social handle: only if you choose to share one after a mutual match confirmation. See Section 3
• Your email notification preference: whether you want to be told by email when someone replies
• Reports you submit: if you choose to report a conversation, we store your report and any note you write
• Bot protection data: when you sign up, sign in or reset your password, a Cloudflare Turnstile check runs to confirm you are not an automated script. It does not set tracking cookies and does not profile you or follow you across other websites
• Text you choose to translate: every announcement carries a Translate button. If you press it, that announcement's text opens in an external translation service in a new tab. Nothing is sent unless you press it, and lostblip never translates anything on its own
• Technical and security data: our infrastructure providers process IP addresses and connection data to keep the service available and to block abuse. We also record the time of your last interaction so we can sign you out automatically after a period of inactivity

2. Why we use it, and our legal basis

• To create and operate your account and deliver the service – legal basis: performance of a contract (GDPR Art. 6(1)(b)). Without an email address and password we cannot give you an account
• To publish and display your announcements: performance of a contract (Art. 6(1)(b)), at your own initiative and under your control, including on the public board if you choose that option
• To review announcements before publication and act on reports: our legitimate interest in keeping the platform safe and lawful (Art. 6(1)(f))
• To protect the platform from spam, abuse and unauthorised access: legitimate interest (Art. 6(1)(f))
• To send you an email when someone replies to you, or shares their contact with you: performance of a contract (Art. 6(1)(b)). The email never contains the content of the message or the contact itself, only that something is waiting for you. You can switch these off at any time in your account settings
• To comply with legal obligations where these apply (Art. 6(1)(c))

We do not use your data for advertising, for building profiles about you, or to train any automated or machine learning system.

3. Private replies and shared contacts

Private replies and shared contacts are stored in encrypted form, and access is technically restricted to the two participants of that conversation.

• We do not read or monitor private replies. This is a binding commitment: their content is not used for moderation, analytics, profiling, advertising, automated processing, or any other purpose, and is never shared with third parties
• If a conversation is reported to us, we assess the report on the basis of the reporting user's own statement and non-content signals – such as repeated independent reports about the same account – and not on the content of the conversation
• A contact you share is automatically deleted 7 days after the other person copies it, or within 30 days of being shared if it is never copied

4. Who else processes your data

We do not sell your data and we do not share it with advertisers. We use the following providers, each acting as a processor on our behalf under a data processing agreement:

Transfers outside the EU. Where a provider processes data outside the European Economic Area, that transfer relies on the safeguards permitted by GDPR Chapter V – typically the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. You have the right to ask for information about these safeguards by writing to us at the address in the Contact section below.

5. How long we keep your data

• Account data: until you delete your account
• Announcements: until you remove them or delete your account
• Private replies: until you delete your account, at which point the content of your own messages is removed and no longer linked to you
• Shared contacts: 7 days after being copied, or a maximum of 30 days after being shared
• Reports: up to 24 months, so that repeated patterns of behaviour can be identified, then deleted
• Technical and security logs: held by our infrastructure providers for short periods in line with their own retention policies

6. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you, and receive a copy of it
• Have inaccurate data corrected
• Have your data erased – you can do this yourself at any time by deleting your account in your settings
• Restrict or object to processing based on our legitimate interests
• Receive the data you provided to us in a portable format
• Withdraw consent, where processing is based on consent
• Lodge a complaint with a supervisory authority

To exercise any of these rights, write to privacy@lostblip.com. We will respond within one month, as required by the GDPR. If you are not satisfied with our response, you may complain to the Italian supervisory authority – the Garante per la protezione dei dati personali (garanteprivacy.it) – or to the authority in your own country of residence.

7. Security

Access to your data is restricted at database level, so that private conversations and shared contacts are reachable only by the two participants involved. Passwords are stored only as cryptographic hashes. Connections to the platform are encrypted in transit. No system can be guaranteed absolutely secure, but we design for the least data held for the shortest useful time.

8. Automated decisions

We do not make decisions about you by purely automated means with legal or similarly significant effects, and we do not profile you. Announcements pass through an automated check for prohibited content, but every announcement is also reviewed by a person before publication, and a rejection can be queried by writing to us.

9. Age

lostblip is for adults. You must be 18 or older to create an account. We do not knowingly collect data from anyone under 18; if we become aware that we have, the account and its data will be deleted.

10. Changes to this policy

We may update this Privacy Policy. The "last updated" date at the top of this page always reflects the current version. If we make a change that materially affects how we use your data, we will make that clear on the platform.

11. Contact

The data controller for lostblip is Giuseppe Occhionero, Italy. For any question about this policy, or to exercise any of the rights described above, write to privacy@lostblip.com.

lostblip is not required to appoint a Data Protection Officer, as it does not carry out large-scale or high-risk processing.

See also our Cookie Policy and Terms of Service.