Privacy Policy
Last updated: April 18, 2026
Overview
LOST101 operates a phone relay service that allows subscribers to reach their trusted
contacts by calling the LOST101 relay line. Because contacts trust us with their phone numbers,
we take their privacy just as seriously as our subscribers'.
Information we collect
Account information
When you register we collect your name, email address, phone number, date of birth, and
a security question and answer. During setup you complete a voice-assisted verification
call; speech-to-text creates a text transcription of your spoken name and security answer.
We do not record or store any audio.
Contact information
Subscribers add contact names and relationship labels. Contact phone numbers are provided
by the contacts themselves through our consent process. All phone numbers are encrypted
using AES-256-GCM and stored as irreversible hashes for lookup. If an invited contact does
not approve the request, their information is automatically deleted.
Call records
We log call timestamps, durations, and connection status for usage tracking and billing.
We do not record the content of any calls.
Technical data
When you create an account, give consent, or opt out, we record your IP address and
browser information to maintain audit trails for legal compliance, fraud prevention, and
dispute resolution. We do not use this data for advertising or cross-site tracking.
Authentication and security
LOST101 uses passkeys (WebAuthn) for passwordless login, backed by your device's biometric
sensor or screen lock. Only the public key is stored on our servers — biometric data never
leaves your device. Magic-link email login is also available; links are single-use and
expire after 10 minutes. We do not use tracking, analytics, or third-party cookies. All
communication between your browser and our servers uses HTTPS.
How we use your information
- To authenticate you when you call the relay line
- To connect you with your trusted contacts
- To send SMS about consent, verification, and account security
- To send SMS usage alerts near or over your limits
- To send email reminders before renewal
- To process payments through Stripe
- To enforce usage limits and prevent abuse
Contact consent and opt-out
Contacts are only reachable through LOST101 after they have explicitly consented and
verified their phone number. They can opt out at any time by replying STOP to any LOST101
SMS, replying DELETE when asked to verify, or using the Remove My Number page. Opting out
removes the number from all active contact lists immediately. A record of the consent and
opt-out is retained for legal-defense purposes.
Information about contacts
If you are a contact rather than a subscriber, we store your first and last name, your
phone number (encrypted and as an irreversible hash), the IP address and browser information
of the device used to give consent, the verification method chosen, a Twilio message or call
identifier, and timestamps for each step. These records are retained even if the subscriber
who added you deletes their account, because they are needed to prove valid consent under
the federal Telephone Consumer Protection Act (TCPA) and comparable state laws.
Data retention
- Pending consent invitations expire after 7 days if the contact does not respond.
- Account data is retained while your account exists.
- Call logs are retained for billing and usage tracking.
- Opted-out numbers are kept as hashes only, to prevent re-addition.
- Consent records are retained for seven years from account deletion or opt-out,
whichever is later, covering the TCPA statute of limitations.
- If you used your free introductory call and later delete your account, a one-way
SHA-256 hash of your registration phone number is kept for 24 months to prevent repeat
abuse of the free trial. It cannot be reversed and is never used for marketing.
Account deletion
Deleting your account permanently removes most personally identifiable information,
including your email address, phone number, date of birth, passphrase, PIN, voice
transcriptions, and security question and answer. Active Stripe subscriptions are cancelled
and passkeys, devices, and pending login links are deleted. A limited record is retained for
legal, billing, fraud-prevention, and consent-proof obligations, generally for seven years,
then permanently deleted.
Domestic service only
LOST101 is available for domestic U.S. calls only. We do not support international
calling at this time.
Third-party services
- Twilio — phone calls, SMS messaging, and speech-to-text verification
- Stripe — payment processing and subscription management
- Resend — transactional email delivery
We share only the minimum information necessary, and never sell or share your data for
advertising or marketing.
Age requirement
LOST101 is intended for adults aged 18 and older. All contacts listed must also be at
least 18 years of age.
Contact us
Questions about this privacy policy or your data:
support@mail.888lost101.com