Scout

Privacy Policy

Last updated: November 4, 2026

This policy explains how the Scout mobile app (“Scout,” “we,” “us”) collects, uses, and shares information when you use it. Scout turns trips into a collection: you visit real-world places and unlock digital patches. You can start using Scout as a guest, with no account required.

1. Information we collect

Account information. If you create an account, we collect your email address and, optionally, a display name. You can sign in with Apple, with Google, or with an email and password. Signing in with Apple or Google shares your email (and name, if you choose to share it) with us. Guests are identified only by an anonymous device identifier.
Location. With your permission, Scout uses your device’s precise location to detect when you arrive at a place and automatically unlock the corresponding patch, and coarse (city/state) location for region-based patches. If you enable it, location may be used in the background so patches can unlock while the app is not open. We store the coordinates associated with patches you collect. You can turn location off at any time in Settings or your device settings.
Photos. If you use the photo-import feature, Scout reads the location (GPS) metadata and dates of photos in your library on your device to find places you have already been. For most accounts the photos themselves are never uploaded. If you choose to add a photo to a patch’s community gallery, that image is uploaded and stored. If you choose to share a memory as a link, resized copies of that trip’s photos are uploaded for 7 days (see Sharing a memory).
Cloud album (limited availability). Cloud album is enabled by us for individual accounts and is off unless we have turned it on for yours. When it is on, Scout uploads a resized copy (not the original file) of each photo that matched a place, so your album survives a lost or replaced phone. The uploaded image files contain no embedded metadata; the capture location, date and camera details are stored separately in our database, alongside a fingerprint of the original file used to recognise the same photo after a restore.
User content. Comments you post on patches, patches you submit, and similar contributions are stored and associated with your account.
Purchases. If you make a purchase, our payments provider records your purchase history and entitlements. Payment card details are handled by Apple/Google and are never received by us.
Usage and diagnostics. We collect basic product-interaction events (for example, opening the app, viewing or collecting a patch) to understand engagement, and crash and performance diagnostics to keep the app stable.

2. How we use information

To provide core functionality — detecting arrivals, unlocking and syncing patches, and maintaining your collection across devices.
To operate accounts, community features, and purchases.
To analyze usage so we can improve Scout, and to diagnose crashes and performance issues.
Where cloud album is enabled for your account, to store your album so it survives a lost or replaced phone, and to serve any album pages you choose to share.

If cloud album is enabled for your account, you can create a link to a campaign, a collection, a place, or a single photo. Anyone with the link can view those photos without signing in, so treat a link as public: share it only with people you intend to see those photos.

Links are long random tokens and are not listed, indexed, or discoverable — but they are not password-protected.
Nothing is shared until you create a link. Creating one never shares your whole album, only the campaign, collection, place, or photo you chose.
You can stop sharing at any time from the same place you shared. The page then stops working.
Images served on a shared page contain no embedded location or camera metadata.
A shared page names the place the photos are filed under, which may be as broad as a city or state.

On This Day can show you a trip from a past year. You can share it two ways. A picture is made on your phone and nothing is uploaded. A link uploads resized copies (not the original files) of up to 8 of that trip’s photos and a postcard image, so the link works for anyone you send it to.

Nothing is uploaded until you choose “Share a link”, and the app says what it will upload before you do.
Anyone with the link can view those photos without signing in, so treat it as public. Links are long random codes and are not listed or indexed.
A link and its photos are deleted automatically 7 days after you create it. Deleting your account deletes them immediately (an upload still in progress at that moment is removed within a day). There is currently no way to stop a link early from inside the app; to remove one sooner, contact us.
The uploaded images are re-encoded on your phone before upload and contain no embedded location or camera metadata. The page names the trip’s main place and its dates.

3. What we do not do

We do not show ads in the app, and we do not collect your device’s advertising identifier (the IDFA on iOS or the Google advertising ID on Android).
We do not ask iOS for permission to track you, and we do not send your account, name, email, location, photos, or what you do in Scout to any advertising company.
We do not sell, rent, or trade your personal information, and we do not share it with data brokers.

On our websites

This section covers scout-patches.com and shop.scout-patches.com. Where section 3 talks about ads, advertising identifiers and tracking, it means the app. The websites work differently, and this section says how.

Cookies we set, by purpose:

Visitor ID: scout_vid is a random ID that lasts one year and is shared by both sites. It tells us whether a visitor is new or returning.
Where you came from: scout_touch lasts one year on the shop. It remembers the ad campaign that brought you: the source, medium and campaign from the link.
Cart: scout_session_id lasts one year on the shop and ties your cart to your visit.
Shop sign-in: scout_at and scout_rt are set only if you sign in to the shop. They last until you close your browser.
Discounts: scout_discount lasts 30 days and holds a discount code from an ad link.
Your opt-out: scout_privacy_optout lasts one year and remembers that you opted out (see below).
Meta’s own cookies, such as _fbp, are set by the Meta Pixel when it loads.

What our own analytics record on both sites:

The pages you view, the page that referred you (its address without any query), the first page you landed on, and how long you stay on a page.
The link that brought you, including its campaign tags and any Facebook or Google ad click ID.
Your rough location (country and region), worked out from your IP address.
Your device and browser type.
Your clicks on store badges and links.
On the shop, also: products you view, the words you type into shop search, filters, sorting and image swipes, and cart and checkout steps.
The ad or link that brought you to the shop. It is copied onto your Shopify cart, so it ends up on your order.
If you sign in to the shop, your email address, for your account. Your account ID is also added to your Shopify cart, and a completed purchase is recorded against your account. If you buy while signed in, your visit ID is also added to the order, so that visit's browsing on our sites can be matched to your account.

About IP addresses: our analytics events do not store your IP address. We use it once to find your country and region, then discard it. There are two exceptions. When you open a QR-code link on scout-patches.com, we store a salted, shortened hash of your IP address and your browser’s user agent, so we can spot bursts of clicks from one source. And our web server logs keep IP addresses for about two weeks, for security and debugging.

The analytics data we store is never sold or shared. We keep it indefinitely. It holds no name, email address, postal address or payment details; for orders, Shopify keeps those. Deleting your Scout account does not delete these analytics records, but the account ID on a past purchase no longer points to anyone once the account is gone.

Separately, our website and the web shop load the Meta Pixel. It does not load inside the Scout app, including the shop you reach from the app. It sends Meta the page address, the referring site, your IP address and browser details, and actions such as viewing a product or adding to cart. This happens directly from your browser. We use it to measure and target our Facebook and Instagram ads. Some state laws call that sharing. Meta handles the data under its own privacy policy.

To turn the Meta Pixel off, go to /privacy/choices. If your browser sends Global Privacy Control, we honour it automatically. Opting out stops the pixel only. Our own analytics keep running, and the ad-source tag still goes onto Shopify carts.

Checkout runs on Shopify at checkout.scout-patches.com and is governed by Shopify’s privacy settings and policy.

4. Service providers

We share information with vendors who process it on our behalf, solely to provide the app:

DigitalOcean — server and database hosting for your account and collection.
RevenueCat — managing purchases and entitlements.
Sentry — crash and performance diagnostics.
Apple and Google — sign-in and map display.
Shopify — if you buy physical merchandise from our store, your order is processed by Shopify under its own privacy policy.

Meta (Facebook and Instagram) — measuring our app-install ads. Scout includes Meta’s SDK so we can tell whether our ads on Facebook and Instagram lead to installs. It tells Meta when the app is installed and opened, together with basic device information (such as the device model, operating system version, language, time zone, an install identifier generated by the SDK, and your IP address). It does not receive the advertising identifier, your account, location, photos, or anything you do in the app. Meta processes this data under its own privacy policy (facebook.com/privacy/policy).

Each provider processes data under its own privacy policy.

5. Storage, retention, and security

Your data is stored on secured servers and retained for as long as your account is active or as needed to provide the app. Guest data lives on your device until you create an account, at which point it syncs to your account. We use reasonable technical and organizational measures to protect your information.

Cloud album images are stored privately on Amazon S3 and are never publicly listed. They are served only to you, or through a share link you created, and always through short-lived signed URLs. If we turn cloud album off for your account, uploading stops and any share links stop working immediately, but your stored images are kept until they are deleted — by you deleting your account, or at your request.

6. Your choices and data deletion

You control location, photo, and notification permissions in your device settings. To access, correct, or delete your account and associated data, email us at alan@scout-patches.com from the address associated with your account, and we will process your request promptly. Deleting your account removes your profile, collected patches, contributed content, and any cloud album images and share links, subject to any records we are required to keep by law.

7. Children

Scout is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above.

9. Contact

Questions about this policy or your data? Email alan@scout-patches.com.