What Unlost knows about you

The line that does not move

Nothing about your drives or your files is ever collected. Not a file name, not a folder, not a drive label, not a preview, not a count of what was found, not one byte of anything you recover. Scanning happens on your computer and the results stay on your computer. That is not a setting, and it is not a promise about intentions — it is the one thing this program exists to be trusted with.

What is collected, on this website and in the program, is counts: how many times a thing happened. Counts have no person behind them, and the rest of this page is the detail of that.

This website

tryunlost.com counts two things: that a page was opened, and that a download button was pressed. The second one answers the only question this site really has — whether somebody who arrives looking for their files ever gets as far as the program. A click that is refused because the visitor is not on Windows is counted separately, so a wall is never mistaken for a success.

What each count contains

The counter is PostHog, and an event carries what PostHog records by default:

• the event itself — a page opened, a download started, or a download refused because the device cannot run Windows software;
• the address of the page, and the address you came from;
• your browser, operating system, device type and window size;
• an approximate place — country and region — worked out from your IP address as the event arrives.

What it does not contain

No cookie is set, and the counter stores nothing in your browser. It is configured to hold its state in memory only, so the moment the page closes there is no identifier left anywhere — the next page you open is a fresh number, not a continuation of this one. There is no profile, no session recording, no replay of your screen, no map of your mouse, and no way to ask the service who visited, because it has not been told.

Two things are written to this browser's local storage, and only these two, because both are answers you gave and would not want asked again: whether you switched the count off, and — if you arrived from an advert — whether you allowed Meta's pixel. They are settings, not identifiers: neither is sent anywhere, and neither is a cookie. Clearing site data for tryunlost.com removes both.

This counter runs only on this website. It never sees a drive, and it cannot: it is a script in a web page, and the page is not open while you are recovering files. The program keeps a separate count of its own, and what that one sends is set out below.

Where it goes

To PostHog's EU Cloud, which keeps its data inside the European Union. PostHog processes it on our instructions and for nothing else; it is not sold, not shared with advertisers, and not joined to anything from anywhere else.

Turning it off

If you would rather not be in the numbers, this switches the counter off in this browser and keeps it off.

Browsers that send a Do Not Track or Global Privacy Control signal are not counted either, whatever this switch says. And because the setting lives in this browser's storage, clearing site data for tryunlost.com resets it.

Advertising

Unlost sometimes pays for an advert. A visit that arrives from one carries a marker in its address, and only such a visit brings up the question of Meta's advertising pixel — the piece that reports back to the ad platform whether the advert led to a download.

That pixel sets cookies belonging to facebook.net and sends what it sees to Meta, which is a different proposition from counting, so it is never loaded until you have said yes to it. A short bar at the foot of the page asks, and until you answer nothing from facebook.net is requested. Decline it, or arrive here any other way — from a search, a link, or by typing the address — and there is no request to Meta at all, ever.

Your answer is remembered in this browser so the question is asked once. Clearing site data for tryunlost.com asks again.

The app and the installer

The program and its installer send anonymous counts of their own — that an installation finished, that a version was started — for the same reason this website does: to know whether the thing is reaching anybody. The limit is the one at the top of this page, and it is absolute: counters, never contents.

What they never carry: a file name, a folder, a drive letter, a volume label, a serial number, a scan result, a recovered file, or anything derived from what is on your disks.

What makes the count anonymous rather than merely small: the identifier on each line is a random value, never anything read off your machine. The installer generates a fresh one for that single message and keeps no copy, so two installs on the same computer are two strangers. The app generates one on first run from the operating system's random number generator and stores it beside its settings — a number that exists only to keep one computer from being counted as ten, and that matches nothing outside this. Neither is derived from a disk serial, a network address, a machine ID, or your Windows account. Person profiles are switched off on the receiving end, so the lines are added up and not assembled into anybody.

The exact list

The installer sends one message, installer_completed, when an installation finishes. It carries the app version, your Windows version, and your system language. Nothing else. If the installation fails, nothing is sent. The finish screen says so in a line under the buttons.

The app sends one message, app opened, when it starts. It carries the same three: app version, Windows version, interface language.

Both messages carry three more fields, and none of them is about you: $process_person_profile set to false, $geoip_disable set to true, and $ip set to a value that resolves to nowhere. They are instructions to the receiving end — build no profile, look up no location, and do not fall back to the address this arrived from. They are listed here because a heading that says "the exact list" should survive somebody capturing the request and counting the fields.

The app's count can be switched off, and the switch is in the window — in the top bar, beside the line promising the drive is only ever read, with a button next to it that lists exactly what is sent. Switched off, the app opens no connection at all. The installer's single line has no switch: it happens once, during the installation you asked for, and then never again.

Scanning, previewing and recovering do not depend on any of this. They work with the network cable unplugged and Wi-Fi off, and you are encouraged to check that for yourself: unplug, then run a full scan.

What stays on your computer

Unlost writes two small text files to your Windows user profile: the size and position the window had when you closed it, and your answer about the launch count together with the random identifier that goes with it. Both are plain text, readable by you, and removed when you uninstall the app. Nothing else is kept — no list of drives you scanned, no history of what was found. Recovered files go wherever you tell Unlost to put them and nowhere else.

Nothing to buy

Unlost is free, so there is no checkout, no payment processor and no card details anywhere in the picture. Nothing about the app is unlocked by paying, which means there is no purchase record to keep and no billing data to protect. The counts are not sold, and there is nothing in them a buyer would want.

No email address is asked for, no licence key is issued, and there is no mailing list to end up on. Writing to [email protected] is the only way we would learn your address, and it is used to answer you and nothing else.

Your rights

If you are in the EU, the UK, or another place with similar law, you have the right to ask what personal data is held about you, to have it corrected, to have it deleted, and to receive a copy of it. In practice, unless you have written to us or agreed to the advertising pixel, we hold nothing that identifies you: the counts described above are not tied to a person and cannot be searched for one.

Two companies process data on our behalf, and only what is described on this page: PostHog, for the counts, inside the European Union; and Meta, for the advertising pixel, and only where you have agreed to it. Meta is in the United States, which is one more reason that piece is never loaded without a yes.

The party responsible for this data — the data controller — is Unlost, reachable at [email protected]. Write there and you will get an answer within 30 days. If you are not satisfied with it, you can complain to your national data protection authority.

Children

Unlost is a general-purpose utility and is not directed at children. Nothing here asks anybody's age, because nothing here asks anybody anything: the counts are counts, and there is no account, no form and no profile in which a child could be told apart from anyone else.

Changes to this policy

If this policy changes, the date at the top of the page changes with it, and the previous wording stays available on request. A change that materially affects what happens to your data will be announced on the download page rather than quietly slipped in.

Contact

Questions about this policy or about what the app does: [email protected]. For how Unlost treats the drive itself — read-only access, administrator rights, and the SmartScreen warning — see Security and data handling.