Privacy Policy

Last updated 16 October 2026.

Most privacy policies promise to keep your information private. This one cannot, and you should understand why before you file a report.

A missing person notice only works if people see it. When you report someone missing and we approve that report, we deliberately publish their name, photograph, physical description, age, and where and when they were last seen, to anyone on the internet. That is the entire purpose of the register. If you are not comfortable with that information being public, do not file a report here — contact the police directly instead.

What we do not publish is anything about you, the person filing the report, and anything anyone tells us afterwards.

For an approved case, these appear on a public page and in a printable poster:

• The missing person's full name and any nickname
• Their photographs
• Sex, age, height, weight, hair, eyes, and distinguishing features
• What they were last seen wearing
• The date they went missing and the district and province they were last seen in
• The circumstances you describe
• The case number

Public case pages are readable without an account and can be indexed by search engines and shared on social media. Assume anything you enter in those fields will be seen widely and copied beyond our control.

• Your name, phone number and email address as the reporter
• Your relationship to the missing person
• Every sighting submitted on the case, and the contact details of whoever sent it
• Photographs attached to sightings
• Payment records

Reports that are awaiting payment, awaiting review, or rejected are not public at all. Their pages and photographs are visible only to you and to our review team.

Publishing a child's photograph and description carries risks as well as benefits: it reaches people who can help, and it also reaches people who should not have that information. We think the trade-off is usually worth it for a missing child, but it is your decision to make knowingly.

Only file a report about a child if you are their parent or legal guardian, or you have that person's agreement. We may refuse or remove a report where we are not satisfied of this. Needs legal review: the lawful basis for publishing a minor's data, and whether police notification should be a precondition.

If you report a sighting you may ask us not to share your name with the family, and we will not. Our review team still sees your contact details so a tip can be followed up, and we will not pass them on without your agreement — except where we are legally required to, or where we believe someone is at immediate risk of serious harm.

We record the IP address a sighting was submitted from. We use it only to limit abuse of the form.

Photographs taken on a phone often contain hidden location data recording exactly where the picture was taken — frequently the family's home. Where our server is able to, we strip that data by re-saving every uploaded image before storing it. On this installation that stripping is currently unavailable, so uploaded images retain their original metadata.

Uploaded files are stored outside the public web directory under randomly generated names, and are served only through an access check that confirms the case is published, or that you are the reporter or an administrator.

We send SMS to the number on your account when your payment is received, when your case is published or rejected, and whenever a sighting is submitted. Messages contain the case number and the missing person's name, so anyone who can read your phone can read them.

Delivery is handled by httpSMS, which relays messages through a mobile handset we operate. We keep a log of every message sent, its recipient and whether it was delivered.

We record the amount, currency, reference, status and time of each posting fee. We do not store card numbers or mobile money PINs. Needs legal review and updating once a live payment provider is connected: which provider processes the payment, what they receive, and where that data is held.

Published notices stay up while the person is missing. When a person is found we mark the case as resolved and keep the notice, so people who saw the original poster learn the outcome — but you can ask us to take it down instead.

Administrative records of who approved or rejected a case are kept for accountability. Needs legal review: specific retention periods for resolved cases, rejected reports, sightings and payment records.

You can ask us to:

• Show you what we hold about you
• Correct anything inaccurate
• Take down a notice you filed
• Close and remove your account

Email info@returnsafe.rw from the address on your account. We may ask you to confirm your identity before acting on a request that would remove or change a published notice, because that notice may be the only thing helping someone be found.

Passwords are stored hashed, never in a readable form. Accounts lock temporarily after repeated failed sign-ins. Administrative actions on a case are recorded with the account that performed them. No system is perfectly secure, and we will tell affected users if we discover a breach involving their information.

Questions or complaints about privacy: info@returnsafe.rw.