PRIVACY POLICY

1. Introduction and Scope

This Privacy Policy explains how FindFlash ("FindFlash," "we," "us," or "our") collects, uses, discloses, stores, and deletes information when you use the FindFlash Android application, the FindFlash website at https://myfindflash.com, and related support, alert, search, messaging, payment, and physical poster services (collectively, the "Service").

FindFlash is a community safety, lost-and-found, missing-person, blood-request, and emergency alert platform operated from Kandirpar, Cumilla-3500, Bangladesh. This Policy applies to information processed by FindFlash. A third-party provider may also process information under its own privacy terms when you use that provider's service.

2. Privacy Choices at a Glance

• Automatic Nearby Alerts are optional and OFF by default. We request location only after you choose to enable the feature and see a prominent disclosure.
• Regular nearby alerts use a current Area ID. We periodically determine the current area, approximately every 30 minutes, and overwrite the previous Area ID instead of building a route history.
• SOS uses precise live location only while SOS is active. It can continue when the app is closed or not in use, ends when you stop it or when it expires, and is separate from regular nearby alerts.
• You can use manually selected areas. Declining background location does not prevent you from browsing or receiving alerts for manually selected areas.
• You can report and block. Reports may preserve a snapshot of reported content so moderators can review it even if the original is later edited or deleted.
• You can delete your account. In-app and web deletion paths are available, subject to limited legal, payment, fraud-prevention, and safety retention described below.

3. Information We Collect

3.1 Account and verification information

Depending on the account options you use, we collect your full name, phone number, email address, date of birth or age confirmation, gender, blood group, profile photo, area or address, account identifiers, authentication status, Terms acceptance version, and acceptance time. Phone or email OTP information is used to verify the account. FindFlash does not need access to the full contents of your SMS inbox or device contact list for OTP verification.

3.2 Posts and public activity

When you create a Lost Item, Found Item, Missing Person, Blood, Emergency, or other supported post, we collect the text, category, photos, selected target areas, return or contact details you choose to provide, timestamps, status, comments, replies, and related search or notification data. Information intentionally included in a post or public comment may be visible to other users.

3.3 Private messages and communication metadata

FindFlash processes message content and communication metadata, including sender, recipient, timestamps, delivery status, reply relationships, and deletion status, to deliver and secure private messaging. Messages are processed through FindFlash servers or Firebase and are not described as end-to-end encrypted unless the app expressly implements and states otherwise. If a message is reported, the relevant message and context may be made available to authorized moderators.

3.4 Reports, blocks, moderation, and appeals

When you report a post, comment, message, SOS, or user, we collect the report reason, description, reporter and reported identifiers, relevant content ID, a content snapshot, date and time, status, moderator notes, action taken, and any appeal. Block lists are stored so the Service can prevent blocked interactions. The reported user is not told the reporter's identity except where disclosure is legally required.

3.5 Manually selected alert areas

You may select one or more areas on the map to receive or send relevant alerts. We store the selected Area IDs and related preferences until you remove them, change them, or delete the account. Turning Automatic Nearby Alerts OFF does not automatically delete manually selected areas.

3.6 Automatic Nearby Alerts and background location

Automatic Nearby Alerts are optional and OFF by default. If you turn the feature ON and grant the necessary foreground, background, and notification permissions, FindFlash periodically checks your device location, approximately every 30 minutes, to determine your current area and deliver relevant alerts even when the app is closed or not in use. Android may delay an update, and force-stopping the app may stop background operation.

For regular nearby alerts, FindFlash is designed to send the server only the current Area ID or coarse area value, the last update time, and whether nearby alerts are enabled. The new current Area ID overwrites the previous one. We do not intentionally create a regular movement route or store a separate exact latitude and longitude history for this feature. A persistent Android notification is displayed while the background service is active.

You may turn the feature OFF at any time from Settings > Location & Alerts. Turning it OFF stops scheduled background updates and removes the persistent tracking notification. Logging out, deleting the account, revoking location permission, or choosing Stop All Location Sharing also stops the service and makes the latest Area ID inactive or deletes it.

3.7 Emergency SOS precise live location

SOS is a separate, user-initiated emergency feature. After a prominent disclosure, permission check, final confirmation, and short cancellation countdown, an active SOS may collect and update your precise live location even when the app is closed or not in use. The latest location, last update time, SOS event ID, start time, status, message, helper responses, and delivery status may be processed.

While SOS is active, relevant nearby FindFlash users within approximately 5 km and the emergency contact or guardian you selected may receive the alert and the location information needed to respond. Notification previews are designed not to display an exact home address. SOS automatically expires after 60 minutes unless you extend it. You may stop it sooner using Stop SOS / I Am Safe. The active precise location is then deleted promptly, while limited incident, safety, delivery, report, or fraud-prevention records may be retained as described in Section 9.

FindFlash does not guarantee rescue or emergency assistance. In a real emergency, contact Bangladesh national emergency number 999 or the appropriate police, fire, ambulance, hospital, or other authority.

3.8 Emergency contacts

If you add an emergency contact or guardian, we collect the name and phone number you enter and use them for the alert purpose you requested. You must have authority to provide the number and to request the communication. FindFlash does not upload your entire address book. Guardian SMS alerts are sent through an authorized backend SMS provider.

3.9 Payments and physical poster orders

For digital services such as paid post publication, priority notification, extra area reach, or a boost, Google Play Billing processes the purchase. We receive limited purchase information such as product ID, purchase token, Google order ID, amount or price information, purchase status, acknowledgment status, and time. We use this information to verify the purchase, prevent duplicate entitlement, deliver the feature, maintain purchase history, handle support, and process eligible refunds.

For physical poster printing, delivery, or distribution, we collect order details, poster content, quantity, delivery or placement address, instructions, transaction ID, amount, payment method category, status, and fulfillment records. UddoktaPay and its supported payment providers process the payment. FindFlash does not store your mobile-wallet PIN, full card number, CVV, banking password, or full payment credential.

3.10 Device, notification, search, and security information

We may process an FCM push token, device type, operating system and app version, language, IP address, request time, security events, error information, and limited service logs. We also process search terms, selected filters, search result interactions, and indexed public post fields needed to operate search. FindFlash uses Google AdMob / Google Mobile Ads to display advertisements. Depending on device settings, consent choices, and our advertising configuration, Google may process device or advertising identifiers, IP-derived approximate location, app interactions, diagnostics, and related technical information for ad delivery, measurement, analytics, and fraud prevention. FindFlash does not use precise location for advertising.

4. Permissions We Request

• Approximate or precise foreground location: to show a map, select an area, create a location-based post, or start SOS.
• Background location: only after a prominent disclosure and your action to enable Automatic Nearby Alerts or an eligible background SOS function; it supports the core area-alert feature even when the app is closed or not in use.
• Notifications: to deliver nearby alerts, post updates, message notifications, SOS alerts, and persistent notifications while a location service is active.
• Camera and photos/media: to capture or select the specific image you choose for a post, report, message, poster order, or profile.
• Internet/network access: to authenticate, load content, send alerts, process messages, verify purchases, and provide other online functions.

FindFlash does not request SMS inbox, call log, or full contact-list access for ordinary operation. A Call 999 or Call action may open the device dialer so that you initiate the call.

5. Prominent Disclosure and Consent

Before requesting unexpected or sensitive background location access, FindFlash displays a clear in-app disclosure describing what location is collected, the feature it enables, whether collection continues when the app is closed or not in use, how it is shared, and how to stop it. The disclosure appears before the Android runtime permission request. Choosing Not Now does not block ordinary app access, and the feature is not enabled automatically.

Location consent may be withdrawn at any time. Revoking consent does not affect processing already lawfully performed, but it stops future collection for the disabled feature as described in this Policy.

6. How We Use Information

• Create, verify, protect, and manage accounts.
• Publish posts, comments, replies, and messages at your direction.
• Match posts and notifications to manually selected or current areas.
• Operate Automatic Nearby Alerts and show the related persistent notification.
• Operate SOS, notify nearby helpers and selected emergency contacts, show last update and delivery status, and end sharing when SOS stops.
• Deliver search, map, notification, support, report, block, appeal, and moderation functions.
• Verify Google Play purchases, fulfill physical poster orders, prevent duplicate use, keep purchase history, and administer refunds.
• Detect spam, fraud, false SOS, harmful content, security incidents, and violations of the Terms or Community Guidelines.
• Comply with applicable law, enforce rights, resolve disputes, and protect users and the public.
• Maintain and improve reliability using limited operational information.

Where applicable law requires a legal basis, processing is based on your consent, performance of the Service requested by you, our legitimate interests in safety and security, compliance with legal obligations, or protection of vital interests in an emergency context.

7. How Information Is Shared

7.1 Other FindFlash users

Posts, public comments, profile information you make public, selected area information, and contact details you intentionally include may be visible to other users. During active SOS, relevant nearby users may receive the information needed to assess and respond to the alert. Blocked users are restricted according to the in-app blocking controls.

7.2 Emergency contacts

During active SOS, your selected emergency contact may receive your name, contact details, SOS message, current location or a location link, and later an SOS-ended notice.

7.3 Service providers

We use service providers only for defined operational purposes, including:

• Firebase/Google: authentication, Firestore data storage, Cloud Functions, and Firebase Cloud Messaging.
• Cloudflare R2: uploaded image and media storage.
• Algolia: search indexing and retrieval for appropriate public or searchable fields.
• Google Maps Platform: map display, location selection, routing or area-related functions.
• BulkSMSBD or a disclosed replacement: OTP and guardian/emergency SMS delivery.
• Google Play Billing and Google Play Developer services: digital purchase processing, verification, refunds, and purchase lifecycle management.
• Google AdMob / Google Mobile Ads: advertising delivery, ad measurement, analytics, diagnostics, and fraud prevention. Depending on device settings, consent choices, and our configuration, Google may process device or advertising identifiers, IP-derived approximate location, app interactions, diagnostics, and related technical information under Google's own privacy terms.
• UddoktaPay and supported payment providers: payment processing for physical poster services.
• Hostinger or a disclosed replacement: website, domain, or support-email hosting.

Each provider receives only the information reasonably necessary for its function and handles data under its own terms and security practices.

7.4 Legal, safety, and business requirements

We may preserve or disclose information when reasonably necessary to comply with law or a valid legal process; respond to an emergency; investigate fraud, child-safety concerns, threats, false SOS, or illegal activity; protect a person's safety or rights; enforce our Terms; or complete a lawful merger, financing, reorganization, or transfer of the Service with appropriate protections.

7.5 Advertising, no sale of personal information, and location limits

FindFlash does not sell or rent personal information and does not share precise location for advertising or data-broker profiling. FindFlash may display third-party advertisements through Google AdMob / Google Mobile Ads. Depending on device settings, consent choices, regional requirements, and our advertising configuration, ads may be personalized or non-personalized, and Google may process limited device, advertising, interaction, diagnostic, and IP-derived approximate-location information for ad delivery, measurement, analytics, and fraud prevention. FindFlash does not provide SOS precise live location or the Automatic Nearby Alerts Area ID to AdMob for advertising.

8. International Processing

Some providers may process information outside Bangladesh. Where required, we use contracts, provider safeguards, and other lawful measures designed to protect information during international processing. Local laws in a processing country may differ from Bangladesh law.

9. Data Retention

We keep information only for the period needed for the purposes described below, unless a longer period is required or permitted by law, a dispute, a safety investigation, or a valid legal hold.

10. Security

FindFlash uses reasonable administrative, technical, and organizational safeguards, including access controls, authenticated requests, security rules, encrypted network transport, role-restricted moderation access, purchase-token verification, and service-provider security controls. Sensitive backend actions are designed to run on trusted server functions rather than only on the device.

No electronic service can guarantee absolute security. Users should protect OTPs, devices, and account access and should report suspected unauthorized use to support.findflash@gmail.com.

11. Your Rights and Controls

Depending on applicable law, you may have rights to access, correct, export, delete, restrict, or object to processing of personal information, and to withdraw consent. The app provides controls for profile edits, location permissions, Automatic Nearby Alerts, manually selected areas, blocked users, message or conversation deletion, and account deletion.

To make a privacy request, use the applicable in-app control or contact support.findflash@gmail.com. We may verify identity before fulfilling a request. We may refuse or limit a request where required by law, where we cannot verify identity, or where an exception applies, and we will explain the reason when appropriate.

12. Account and Data Deletion

You may permanently delete your account from Settings > Account & Security > Delete Account. You may also request deletion without reinstalling the app at https://myfindflash.com/delete-account.

Deletion requires OTP or recent-login verification and a final confirmation. Once confirmed, FindFlash disables the account, turns off Automatic Nearby Alerts, stops background location, ends any active SOS, removes the FCM token, deletes or anonymizes account-linked content and messages according to the stated deletion behavior, removes search records, deletes associated Cloudflare R2 media, and deletes the Firebase Authentication account after backend cleanup. A request/reference ID and expected completion date are provided.

Active account data is normally removed or anonymized within 30 days. Backup copies may take up to 90 days to cycle out, unless they must be preserved for security, legal, fraud-prevention, payment, report, or moderation purposes. Another user's copy of a conversation may retain message text where required for conversation integrity, but the deleted sender's profile information is removed or replaced with "Deleted User" unless the message is retained as report evidence.

Deleting a FindFlash account may not automatically cancel a Google Play subscription if one is offered and active. Google Play subscription management remains available separately. Account deletion is not blocked by an active subscription.

13. Children and Minor-Related Content

FindFlash accounts are intended for people aged 18 or older. We do not knowingly permit a person under 18 to create an account. If we learn that an underage account exists, we may restrict it and delete associated information after appropriate verification.

A post about a missing or endangered minor may be submitted only by a parent, legal guardian, authorized person, or person with another lawful basis. Child sexual abuse material, exploitation, grooming, trafficking, or other child-harmful content is prohibited and may be preserved and reported to the appropriate authorities. Child-safety concerns may be reported in-app or to support.findflash@gmail.com.

14. Third-Party Links and Services

The Service may open Google Play, map, payment, phone, SMS, or website services controlled by third parties. Their privacy practices are governed by their own policies. FindFlash is not responsible for a third party's independent practices, but we select and configure providers with reasonable care.

15. Changes to This Policy

We may update this Policy to reflect changes to the Service, law, providers, safety measures, or Google Play requirements. We will update the Last Updated date and provide in-app notice for material changes. Where required, we will request new consent or acceptance.

16. Contact Us