Privacy by design
A finder does not see the owner's personal information when a label is scanned.
Security & privacy
Helping people return items without exposing personal details.
SQRL is designed so a finder can report a lost item while the owner's personal contact information stays private.
Controlled access
Access levels are defined for parents and organization administrators.
Private communication
The system supports contact without exposing personal details to the finder.
Protection in practice
How SQRL approaches security.
Our approach covers the product experience, data handling, infrastructure, and the day-to-day practices used to operate the service.
01
Application security
Data privacy by design
When someone scans an item's QR code, they don't see any personal information about the owner. Instead, they're shown a secure interface to report the found item and its location.
Secure authentication
We use industry-standard authentication protocols, including OAuth integration with Google, to verify user identities. Our password policies enforce strong password requirements, and all authentication credentials are encrypted.
Role-based access control
Different user types—parents and organization administrators—have defined access levels, so users can access the information they need and are authorized to view.
02
Data protection
Encryption
All data in our system is encrypted both in transit and at rest. We use TLS/SSL encryption for data transmitted between your browser and our servers, and industry-standard AES-256 encryption for data stored in our databases.
Minimal data collection
We follow the principle of data minimization, collecting only the information necessary to provide our service. Contact information is used exclusively for lost item notifications and is never shared with third parties for marketing purposes.
Secure communication
When an item is found, our system facilitates secure communication between the finder and the owner without exposing personal contact details.
Technical and operational practices Infrastructure, backups, testing, and team practices
Infrastructure security
Cloud security
Our application is hosted on secure cloud infrastructure with built-in protection against DDoS attacks, intrusion detection, and continuous monitoring for suspicious activities.
Regular backups
We perform regular automated backups of all data, ensuring that information can be recovered in case of system failures without compromising security.
Network security
Our infrastructure employs multiple layers of network security, including firewalls and network segmentation, to prevent unauthorized access to our systems and your data.
Operational security
Security testing
We conduct regular security testing, including vulnerability scanning and penetration testing, to identify and address potential security issues.
Security updates
Our systems are kept up to date with security patches and updates to protect against emerging threats and vulnerabilities.
Employee training
SQRL team members undergo regular security awareness training and follow secure handling procedures for customer data.
In your hands
Controls for families and organizations.
For parents
- Control over what information is shared when an item is found
- Ability to manage notification preferences
- Option to remove items from the system at any time
For organizations
- Administrative dashboard with appropriate access controls
- Bulk management capabilities with security safeguards
- Detailed audit logs of system activities
Standards
Responsible data handling
Data privacy regulations. Our practices are designed to comply with relevant data privacy regulations, so information is handled responsibly and legally.
Security best practices. We follow industry-recognized security practices and frameworks to support standard security expectations.
Good to know
Common security questions.
Clear answers about scans, location, organization access, and account data.
Who can see my child's information when a QR code is scanned?
When someone scans your child's QR code, they don't see any personal information. They only see a secure interface to report the item as found, which then sends you a notification through our system. Personal contact information is never revealed to the finder.
How is location information handled when an item is found?
Location information is only collected at the moment an item is reported found, and only with the finder's permission. This information is used solely to help you locate your lost item and is not used for any other purposes.
Can organizations access all parent and student information?
Organization administrators only have access to the information necessary to manage the lost and found system. They cannot access personal communications between parents and finders or contact information beyond what parents have explicitly shared with the organization.
How long do you keep data about lost and found items?
Data about lost and found items is retained as long as your account is active or as needed to provide our services. You can request deletion of specific lost and found records or your account data through your account settings.
Still have a question?
Talk with the SQRL team.
Ask us about security, privacy, or how lost-item reporting works.