Missing.today

Privacy notice

missing.today

This notice describes how personal data are processed on missing.today. It is the Art. 13 / 14 GDPR information for the live stack as of 2nd November 2026. It is not legal advice. How this site may be used is in the terms of use.

1. Controller

The controller is the person named in the Imprint:

Fabio Micciche
Emmi-Ruben-Weg 13c
21147 Hamburg
Germany
Email: [email protected]

No data protection officer has been appointed, as the statutory requirements for mandatory appointment are not met.

2. What this notice covers

Personal data are processed when you open a page (IP address and usual HTTP request data), when you send a tip, when identified visit measurement runs, and when case records that named sources already published are shown here. Providing data through the tip form is voluntary. You can browse the board without a tip. A dynamic IP address is personal data.

3. Hosting and server logs

The origin server is a machine the controller operates in Germany. There is no separate commercial host. The connection uses HTTPS. The web server and container logs may keep time, requested path, status, user agent, and IP address. Purpose and legitimate interest (Art. 6(1)(f) GDPR): security, abuse detection, and keeping the site running. Those logs are deleted after at most 7 days.

4. Content delivery (Cloudflare)

Public traffic reaches the origin through Cloudflare (Cloudflare, Inc., United States): DNS, CDN, and a tunnel. Cloudflare sees IP addresses and request metadata in order to deliver the site and to absorb abuse. Cloudflare may set technically necessary cookies or similar storage for that security and delivery (section 25(2) no. 2 of the German Telecommunications-Telemedia Data Protection Act). Purpose and legitimate interest: Art. 6(1)(f) GDPR (availability and protection of the site).

That involves a transfer to the United States. Cloudflare publishes that it participates in the EU–U.S. Data Privacy Framework. This site relies on that adequacy decision (Art. 45 GDPR). Cloudflare’s Data Processing Addendum also includes Standard Contractual Clauses (Art. 46 GDPR) if that listing does not cover a given transfer.

5. Fonts

Public pages load Caveat, Roboto Slab, and Special Elite from this origin (/fonts/faces.css and the matching .woff2 files). Your browser does not contact Google to draw the type. Caveat and Special Elite are SIL Open Font License; Roboto Slab is Apache 2.0. The licence files sit next to the fonts.

6. Maps

The board map and the case-file location map use the MapLibre library (the library itself does not track). The script, stylesheet, state outlines, and territory polygons are served from this origin. Map tiles and style come from OpenFreeMap (Hyperknot Software Kft., Hungary; OpenStreetMap data). Hungary is in the EU; that tile request is not a third-country transfer by itself. OpenFreeMap may still use Cloudflare, which is described in section 4.

OpenFreeMap receives your IP address and request metadata when the map loads. Their public privacy note states that normal access logs do not keep IP addresses; error logs may. Purpose and legitimate interest: Art. 6(1)(f) GDPR (show where cases are). OpenStreetMap data is used under ODbL; attribution is shown on the map. MapLibre is not listed as a tracker.

7. Visit measurement (consent)

The board, case file, tip form, and admin screens can load analytics.js. This page and the Imprint do not. That script does not write a visitor id and does not POST events until you allow visit measurement in the cookie card. Allow and reject use the same kind of button. You can change the choice later under Cookie settings in the footer. Legal basis if you allow it: Art. 6(1)(a) GDPR and section 25 of the German Telecommunications-Telemedia Data Protection Act. You may withdraw at any time; withdrawal does not affect earlier lawful processing.

If you allow it, the browser stores a visitor id in localStorage (mt_vid) and a session id in sessionStorage (mt_sid), then POSTs to this site’s API. Each request can include: visitor id, session id, event type, page name (board / case / tip / admin), path and query string, case id, tab name, search text, referrer, language, screen size, and a small meta object (for example selected state, pager rail, or duration). Event types the script is allowed to send: session_start, session_heartbeat, session_end, board_view, board_search, board_filter_state, board_sort, board_page, board_rail_more, board_map_click, board_pin_click, board_card_click, case_view, case_tab, case_photo_click, case_namus_click, case_osm_click, case_map_view, case_tip_click, case_back, tip_view, tip_submit_ok, tip_submit_fail, admin_view, admin_login_ok, admin_login_fail. The API adds IP address and user agent. Tip bodies and passwords are not put in these events. Rows are kept for 400 days, then deleted. If you reject or later turn measurement off, those device ids are deleted in this browser; rows already stored on the server stay until the 400-day period ends unless you ask for erasure.

8. Other cookies and device storage

  • mt-cookie-consent (localStorage): remembers allow or reject and the time of the choice. Needed to apply that choice (section 25(2) no. 2 of the German Telecommunications-Telemedia Data Protection Act).
  • mt-board-theme (localStorage): remembers Light theme or Night theme in this browser when you are signed out. Needed to show the theme you chose (section 25(2) no. 2 of the German Telecommunications-Telemedia Data Protection Act). Not used for visit measurement.
  • mt-gate (cookie, SameSite=Lax) and the same key in sessionStorage: set after the preview password, until launch. Purpose: keep the preview wall down for that browser. This is needed for that gate, not for analytics. It will be removed when the gate is removed.
  • mt_user (HttpOnly, Secure, SameSite=Lax, 30 days): passkey session from the API. Set only after you create or use a passkey. Needed to keep that account (section 25(2) no. 2 of the German Telecommunications-Telemedia Data Protection Act; Art. 6(1)(b) GDPR). The same cookie is used if a profile is flagged in the database as an operator. Not used for visit measurement.
  • Cloudflare security cookies, if Cloudflare sets them, as in section 4.

You can create a passkey profile to save cases. The profile is a generated handle starting with mt-, an optional name you choose, a passkey, a session cookie, a private saved-case list, optional private folders for grouping those cases, and an optional theme (Light theme or Night theme). There is no email address on the account. Signup and login use the device passkey prompt, not the handle and not the optional name. Saved cases and folders are not shown as a public count. You can set that optional name from your profile. Night or Light is chosen from the chip next to Sign in on the board; when you are signed in, that theme is stored on the profile. If you send a tip while signed in, that profile can list those notes on the same page. You can delete your account at any time from that same page; that removes the profile, its saved cases, its folders, and that theme. Tips already sent stay for operator review with the handle and name copied at submit. If the passkey is lost and the operating system did not sync it, the profile cannot be recovered. Legal basis: Art. 6(1)(b) GDPR (the account you asked for).

9. Tips

If you submit the tip form we store the case id, your note, and optional contact. If you are signed in, we also store a copy of that profile’s handle and optional name with the tip so operators can see who sent it, and you can read those notes again on your profile. That copy stays on the tip if you later delete the profile. We do not store an IP address or user agent with the tip. Tips are not published on the board. If you sent the tip while signed in, a later decision (approved or rejected) and a short reply from this site can appear on that same profile page. Purpose: receive information about a case, and to reply about that tip (on the profile if you were signed in, or using the optional contact). Legal basis for the whole tip, including optional contact, the signed-in profile snapshot, and that reply: Art. 6(1)(f) GDPR (handle a tip you chose to send). You may leave the contact field blank. This site does not send an automatic email. Tips are kept for 12 months after receipt, then deleted, unless they are still needed to handle that case or a longer legal hold applies. An operator may delete a tip sooner.

10. Case files of missing people (Art. 14)

The board and case files show names, photos, last-seen place, physical description, and other fields that the named source already published. Those people did not send this data through our form. The source of the data is named on that case (currently NamUs, a U.S. public database). Some fields can be special-category data (for example ethnic origin or health). Purpose: make public missing-person records easier to browse for educational and research use. We do not sell this data. Files stay on the board while that source still publishes them and while this site keeps that catalog; they are removed when the source no longer lists the case or the operator hides it.

Legal basis for ordinary personal data is intended as Art. 6(1)(f) GDPR (inform the public from official records). Special-category fields need a separate Art. 9 GDPR ground; “manifestly made public by the data subject” is a poor fit, because NamUs published the file, not the missing person. That Art. 9 analysis is not closed. Each case file names its source on Sources and links to that source’s page. Community is further-reading links this site chose to show; those links are not the source of the file.

11. Operator accounts

People who run the site sign in with a passkey on a profile that is flagged as an operator in the database. Creating a public passkey profile does not grant that flag. Login attempts may store IP, user agent, and success or failure. That processing is limited to operating the site (Art. 6(1)(f) GDPR). The flag is kept while that operator profile exists.

12. Recipients and third countries

Recipients are the controller; Cloudflare, Inc. (United States) as described in section 4; OpenFreeMap / Hyperknot Software Kft. (Hungary) for map tiles; and — for case content — anyone who opens the public pages. There is no advertising network. Fonts, MapLibre, and the US outline file are served from this origin.

Third-country transfers: Cloudflare in the United States (Art. 45 DPF and Art. 46 SCCs as in section 4). Case-file content originates from NamUs, a U.S. public catalog, and is then shown from this German origin.

13. Your rights

You may request access, rectification, erasure, restriction, and data portability under Articles 15–20 GDPR. Erasure is Art. 17 GDPR, subject to the conditions and exceptions there. If you have a passkey profile, you can also delete that account yourself at any time from your profile.

Withdrawal of consent (Art. 7(3) GDPR): where processing is based on Art. 6(1)(a) (visit measurement), you may withdraw at any time without affecting earlier lawful processing. Use Cookie settings in the footer, or No thanks on the first card.

Right to object (Art. 21 GDPR): you may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (including hosting, the map, tips, and case files). Write to the email in section 1.

You may lodge a complaint with a supervisory authority. For Hamburg that is:

The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI)
Ludwig-Erhard-Strasse 22
20459 Hamburg
datenschutz-hamburg.de

A list of German authorities is published by the Federal Commissioner for Data Protection and Freedom of Information.

14. Automated decisions

This site does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR).

15. Changes

This notice will be updated when the stack changes (for example a consent banner, removal of the preview gate, or a new data source).