Privacy Policy
What data we collect
When you create an account with DiscRetur, we collect the following information:
- Name – to identify you as a user
- Email address – to send notifications and for login
- Phone number – to match you with found discs that have a phone number on the surface
- Password – stored as a secure hash; we never see your plaintext password
When disc finders register a found disc, they may record text written on the disc surface (name and/or phone number). This information is an observed fact from the disc surface, not user-submitted personal data.
Purpose of processing
We process personal data in order to:
- Provide you access to the service (account creation and login)
- Notify you if a disc that may be yours is registered at a course
- Allow you to claim found discs
- Show course administrators relevant contact details to help disc owners
Legal basis
| Processing | Legal basis |
|---|---|
| Account and login | Performance of contract (GDPR art. 6(1)(b)) |
| Email notifications about matched discs | Performance of contract (GDPR art. 6(1)(b)) |
| Disc surface PII (name/phone observed on disc) | Legitimate interest (GDPR art. 6(1)(f)) – necessary to reunite owner with disc |
| Usage statistics and performance (Vercel) | Legitimate interest (GDPR art. 6(1)(f)) – improving the service |
| Error reporting (Sentry) | Legitimate interest (GDPR art. 6(1)(f)) – finding and fixing faults |
Cookies and analytics
We set strictly necessary session cookies for login. Beyond those we set no cookies, and we use no advertising or tracking networks. No personal data is shared with third parties for marketing purposes.
We use two services that process data about how the site is used:
Vercel Analytics and Speed Insights (provided by Vercel Inc.) count page views and measure how quickly pages load. The service uses no cookies and builds no profile of you — the figures are aggregated per page, not per person. See Vercel's privacy policy.
Sentry (provided by Functional Software, Inc.) receives error reports when something goes wrong in your browser, so that we can find and fix it. The data is stored in the EU (Germany). See Sentry's privacy policy.
When an error occurs, Sentry also stores a recording of what happened on the page just before it, to show us how it arose. The recording is masked: all text, and anything you have typed into a form field, is replaced with grey blocks, and images are left out. We see where you clicked and how the page behaved, not what it said. Recordings are only made when an error occurs — not during normal use.
Both services can be blocked with a content blocker in your browser, and the site works as normal without them. If you wish to object to this processing, please contact us (see below).
Storage and deletion
- Account data is stored for as long as your account is active
- Found discs are removed from public view once the course's holding period is over. The course decides how long that is, and must set it before the course can be published
- Disc surface PII (name/phone on the disc) is retained as part of the factual registration record, even after the owner is found
You can request deletion of your account at any time via your account settings. After submitting a deletion request, you have 30 days to cancel. After 30 days, your personal data will be permanently deleted.
Your rights
Under GDPR, you have the right to:
- Access – request a copy of the data we hold about you
- Rectification – request correction of inaccurate data
- Erasure – request deletion of your data (see above)
- Data portability – receive your data in a machine-readable format
- Objection – object to processing based on legitimate interest
To exercise these rights, please contact us (see below).
Contact
Questions about privacy or want to exercise your rights?
Send an email to: info@mail.discretur.no
DiscRetur is the data controller for the personal data described in this policy.