Privacy

Someone who scans your Hii tag sees the item type, the name you gave it, your description and photo if you added one, and whether you have marked it lost. That is the complete list.

They do not see your name, phone number, email address, home address, or any internal identifier. This is enforced in the database: the function that resolves a public tag returns a fixed set of columns and none of them are yours.

Their messages, any photo they chose to attach, and an approximate area if they chose to share one. Nothing else. Hii never asks a finder for a name, a number or an email.

• A finder’s name, number or email. There is no field for any of them.
• Your IP address. We store a salted one-way hash to count unique scans, which cannot be reversed into an address.
• Precise location. When a finder shares their area, their browser gives coordinates and we round them to about a hundred metres before anything is written down.
• Card details. Razorpay handles payment; the card never reaches us.
• Anything for advertising. There are no third-party trackers, no ad pixels and no analytics SDKs on this site — the visitor numbers below are counted by Hii itself and never leave it.

An item appears on the public board only if you chose to publish it when you marked it lost. Marking it returned takes it off again.

A listing shows the item, your message, any reward and a city — never the free-text “last seen” area you can add for people who scan the tag itself, and never anything about you. Items tied to an address, like a home or an office tag, are never listed at all.

Someone who can see your number plate but not your tag can reach you by typing the plate. It gives them exactly what scanning the tag gives them — a way to send a message — and nothing about you. You can turn it off for any vehicle from its page in the app.

None of them is allowed to use your data for anything other than the service they provide to us. We do not sell data, and we have never shared it for marketing.

These are categories rather than company names because the providers behind them change. If you want to know exactly who holds your data today, write to privacy@hii.cx and we will tell you.

We disclose data to law enforcement only against a valid legal order, and only what that order covers.

Conversations close automatically 24 hours after they start unless you extend them. A finder’s session expires at the same time and its credential is scrubbed shortly after.

Everything else stays while your account does. After you delete it, only this remains:

You can delete everything at any time, from the app or the web, with no form and nobody to ask. It is immediate and cannot be undone. In full:

• Your profile: name, email address and phone number
• Every item you added, with its description and photos
• Every Hii tag you activated — they stop resolving and cannot be reused
• Every conversation and message, on both sides
• Scan history for your items
• Notification settings and any registered devices
• Your referral code and who you referred

How to delete your account has the details, including what to do if you cannot sign in.

Under the Digital Personal Data Protection Act, 2023 you can ask for a copy of what we hold, ask us to correct it, ask who we shared it with, withdraw consent, or have it deleted. Write to privacy@hii.cx and we answer within 30 days, at no charge.

If you are not satisfied, our Grievance Officer is named at the bottom of this page and answers within 15 days. You can also complain to the Data Protection Board of India.

Hii is not for children under 18. We do not knowingly collect anything from a child, and if we learn that we have, we delete it. If you believe a child has an account, tell us at privacy@hii.cx.

Every table has row-level security, so the database itself refuses a query for someone else’s data rather than relying on the application to remember. Session credentials are stored hashed, so a leaked database row does not yield a usable session. Everything is served over HTTPS.

No system is perfect. If you find something wrong, please tell us at privacy@hii.cx before telling anyone else, and we will fix it and credit you if you want.

Two, both necessary: one that keeps you signed in, and one that lets a finder come back to a conversation they started. There are no advertising or analytics cookies, which is why this site has no cookie banner asking you to accept any.

Knowing how many people come to the site, and which of them go on to buy something, is how a small company decides what to build next. Most sites answer that with a script from an advertising company. This one does not, and these are the details of what it does instead.

• The page you looked at, without the query string. Anything after the “?” — which can carry a code or an address somebody was sent — is dropped before the page is recorded.
• The website you arrived from, reduced to its name. “instagram.com”, never the post or the search you typed.
• The campaign name in a link, if there was one.
• Whether the screen is a phone, a tablet or a desktop.
• A number that stands for “one visitor today”. It is made by hashing your address together with today’s date, and it changes at midnight — so two visits on two days cannot be connected to each other, and none of them can be traced back to you.

All of it is deleted after ninety days. None of it is joined to your account, and none of it leaves Hii — there is no analytics company receiving any of this, which is also why there is nothing here to ask your permission for.

The one thing kept for longer is a single word on your account saying how you arrived — “instagram”, or the name of a campaign — recorded once when you register and never updated. It is what tells us which things we do are worth doing. It is deleted with your account.

The finder pages are not counted at all. Somebody who scans a stranger’s lost keys did not come here to be measured. The scan itself is recorded for the owner — that is the point of the tag — and it carries nothing about who did the scanning.

On servers in India where our providers offer it, and otherwise in the region closest to you. Some of our providers are outside India; where data crosses a border it is under contracts that require the same protection described here.

If we change something that matters, we will email you before it takes effect rather than quietly editing this page. The date at the top says when the current wording started.