Security & Privacy Protocol
ReclaimX is built with a privacy-first architecture to protect campus students, prevent fraudulent claiming, and secure personal information.
Handover Verification (OTP)
When a claim state transitions to verified, the backend generates a secure 6-digit numeric One-Time Password (OTP). This key is visible solely to the lost item owner. The finder must physically retrieve this code from the owner at handover and verify it via the app to complete the transaction, eliminating false claims.
Anti-Fraud Questionnaires
To claim a found item, owners must configure secret verification questions. Claims are evaluated using text similarity algorithms to rank credibility. To block brute-force attempts on secret questions, users are automatically suspended after 3 failed verification attempts.
Sensitive Data Prevention
All postings undergo RegEx filtering via our backend Sensitive Data Middleware. Submissions containing personal ID numbers (Aadhaar, PAN cards) or telephone details in public fields are automatically flagged and blocked before reaching the database, keeping private data safe.
Masked Public Feeds
Only general category names, dates, and campus zones are public. Detailed descriptions, photographs, and precise locations are locked. Finder identities are hidden behind the claim interface, and emails are only exposed after matching ownership is verified.
Infrastructure Integrity
User logins and sessions are encrypted using Firebase Auth tokens. The backend database uses strict Row Level Security (RLS) policies in PostgreSQL, preventing unauthorized users from accessing or modifying claims, reports, or match scoring metrics belonging to other students.