Privacy Policy

1. Who We Are

Scouty (heyscouty.com) operates this Software. For privacy-related questions: support@heyscouty.com.

2. What We Collect

• Account data: email address (for authentication and service notifications)
• Profile data: soul.md contents you voluntarily upload (professional background, workflow preferences, etc.)
• Software execution data: search intents, workflow requests, AI analysis transcripts, feedback submissions, usage analytics
• Public page (optional, Scouty link): the address (handle), headline, what you are looking for, request types you accept, and — only if you choose — your display name and Scouty career type. You publish these yourself; anyone with the link can see them, and the page is not indexed by search engines.
• Request content: request and counter-offer messages you send or receive through Scouty links, shown to the recipient.
• Request open status: whether and when a request was opened (the time the recipient first opened it, used to show the sender whether it has been viewed).
• Connection preferences (optional): a scheduling link and a preferred contact method (KakaoTalk open-chat URL, Telegram handle or WhatsApp number). Shared only with people whose connection you accept.
• Host plan requests (optional): answers to the questions a host sets on their link, and — for a sender without a Scouty profile — the name they type on the request. Shown only to that host, who can download the requests they received; the typed name is shown after the connection.
• Host plan settings: for members who turn on the Host plan — plan, period, usage, application window, questions, and the note sent to people not selected.
• Account e-mail at a connection: when a connection is confirmed (the recipient accepts), Scouty sends both members an introduction e-mail, and each member's account e-mail address appears in it as a recipient or reply-to address so the two of you can reply to each other directly.
• Messages after a connection: the text of messages exchanged between connected members on Scouty, and their metadata (time sent, read status, and whether it came from the web or Telegram).
• Telegram delivery data (optional): if you choose to receive messages or notices on Telegram, your Telegram chat ID and username.
• Profile screenshots (optional): LinkedIn or Remember screenshots you upload to draft a profile. They are sent to our AI provider to produce the draft and are not stored by us; names, contact details and company names are left out of the draft.
• Product feedback (optional): integration requests and comments you send us.
• Push notifications (optional): if you turn on notifications, your browser's push subscription (endpoint and keys) and browser type, used only to send new-request and acceptance notices. Delivered through your browser's push service (e.g. Google, Apple, Mozilla).
• Payment data: transaction records via our payment providers (Polar.sh for USD; a licensed Korean Payment Gateway for KRW). We do not store payment card numbers. For a Korean domestic recurring payment (host plan), the card number, expiry date, date of birth (business registration number for corporate cards) and first two digits of the card PIN you enter are encrypted and sent straight to NICEPAY Payments only to issue a billing key; we do not store them. We keep only the billing key issued by the payment company, the card company name and the last four digits of the card.
• Technical data: IP address, browser and device metadata, cookies and similar browser storage (see §9)
• Usage analytics: a random internal member ID once you sign in (not your e-mail address or name), the pages you view and when, the address of the page you came from and campaign tags in the link (utm), feature-use events (for example sign-up, publishing or sharing a link, completing a payment), browser, operating system, device type and screen size, and an approximate location (country and city) derived from your IP address. Collected through PostHog (see §6, §7 and §9).
• Sign-up source: from your first visit, the campaign tags (utm_source, utm_medium, utm_campaign), the host name of the site you came from (never its full address), the page you first landed on, and when. Kept in your browser, and recorded once on our server together with your new account when you sign up.
• Google Calendar connection (optional): if you connect Google Calendar, your Google account e-mail address, an encrypted access credential, your time zone, available hours and meeting length, and meetings booked through Scouty (time and participants). See §5A.

3. How We Use It

We process your data to:

• Operate the Software and execute user-initiated workflows (contract performance)
• Show the sender of a request whether the recipient has opened it (contract performance)
• When a connection is confirmed, send both members an introduction e-mail that shares each other's account e-mail address (contract performance)
• Run the Host plan: deliver answers to the host, draft answers from the sender's own profile with our AI provider (the sender reviews them before sending), close requests at the end of an application window with the host's note, and give the host statistics and a download of the requests they received (contract performance)
• Improve Software performance and AI model quality (legitimate interest)
• Detect fraud, abuse, and security incidents (legitimate interest)
• Understand how people find and use the Software so we can improve it, using usage analytics and sign-up source (legitimate interest)
• If you connect Google Calendar, show your free times to the person whose request you accepted and send calendar invitations for meetings booked through Scouty (contract performance)
• Comply with legal, tax, and regulatory obligations
• Send Software-related communications
• Send optional marketing communications, only with your consent (which you may withdraw at any time)

Messages between connected members.

• Messages between members whose connection is complete are stored on Scouty's servers and processed only to deliver them to the other person (Scouty web conversation, e-mail notice, Telegram bot) and to let members re-read their own conversation history (contract performance).
• When a message is delivered, only the sender's display name or headline is shown to the other person; phone numbers, Telegram handles and e-mail addresses are not disclosed (except contact details a member chooses to share as a connection preference, and the account e-mail addresses in the introduction e-mail sent when a connection is confirmed).
• To improve the service we aggregate only message metadata (time sent, number of messages, whether both sides replied) into statistics; message text is not used for analysis (legitimate interest).
• If you choose to receive messages on Telegram, your Telegram chat ID is stored for delivery, and you can turn this off at any time by sending /unlink to the bot.

We do not sell your personal data. We do not use your data for third-party advertising.

4. Retention

We retain your data only as long as necessary for the purposes stated above, or as required by law. Typical retention:

• Account and profile data: until account deletion, or up to 3 years after last activity
• Public page and connection preferences: until you unpublish or remove them, or delete your account
• Request open status (whether and when a request was opened): stored as part of the request record and kept and deleted together with it, under the same retention as other connection records
• Messages between connected members: kept until the member deletes their account; when either participant deletes their account, that conversation is deleted. A conversation under a report or dispute may be kept for 1 year after the matter is closed.
• Telegram chat ID and username: until you send /unlink to the bot or delete your account
• Profile screenshots: not retained (processed only to create the draft)
• Workflow execution transcripts: up to 3 years, then anonymized for Software improvement
• Payment and tax records: as required by applicable law (typically up to 7 years)
• Logs: up to 1 year
• Usage analytics (PostHog): kept while we use PostHog. At any time — including after you delete your account — you can ask support@heyscouty.com to delete the analytics records linked to your account.
• Sign-up source: until you delete your account (the server record is removed as part of account deletion). The copy in your browser stays until you clear this site's data.
• Google Calendar connection: until you disconnect it or delete your account. Disconnecting asks Google to revoke Scouty's access and stops every calendar lookup, so the stored credential can no longer be used; deleting your account erases it together with your Google e-mail address. Free/busy results are not saved to our database (they stay in server memory for up to 60 seconds). Records of meetings booked through Scouty are kept and deleted together with the connection record.
• To prevent abuse, we keep the e-mail address of a deleted account for 1 year only in a form that cannot be reversed (a one-way hash), and use it only to check whether signup benefits were already given when someone signs up again.
• To prevent impersonation, the public page address (@handle) of a deleted account cannot be used by any other member for 90 days.

5. AI Processing

To provide AI features, the data each feature needs is sent to and processed by our large language model provider, Anthropic (United States): your profile, including what you write in the onboarding chat (profile and fit analysis), and — when you use those features — your public page content and request messages (to draft request, reply or counter-offer messages). Our personnel do not routinely read individual profiles, though limited access may occur for debugging, abuse investigation, or legal compliance.

Profile screenshots you upload are sent to Anthropic only to draft your profile and are not kept by us after the draft is returned.

If you connect your own AI service (such as Claude, ChatGPT or Gemini) to Scouty, the profile and needs your AI writes at your request are sent to us. Processing inside that AI service is governed by the terms between you and its provider.

5A. Google Calendar Integration (optional)

If you connect Google Calendar, Scouty asks Google only for permission to see your free/busy information (the calendar.freebusy scope) and your Google account e-mail address. We read only when your primary calendar is busy — never event titles, descriptions, attendees or locations.

• Purpose: after you accept a request, the other person can pick a meeting time from your free slots inside Scouty. They see only the start times of free slots, never your busy times. When a time is booked, a calendar invitation is e-mailed to both of you.
• Storage: the credential Google issues (refresh token) is stored encrypted on our server and is never sent to a browser; short-lived access tokens are kept only in server memory. Free/busy results are not saved to our database. Your Google e-mail address is used to show which Google account is connected and to pre-select it when you reconnect.
• Disconnecting: you can disconnect at any time with "Disconnect" in Scouty or in your Google Account's third-party access settings. Disconnecting asks Google to revoke our access and we stop reading your calendar; deleting your account also erases the stored credential and your Google e-mail address.
• Limited Use: Scouty's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Calendar information is not used for advertising, is not sent to our AI provider, and is not read by people except with your permission, for security purposes, or where the law requires.

6. Third-Party Processors

We rely on the following service providers to operate the Software:

• Anthropic (United States) — AI model inference (profile processing and fit analysis) · privacy policy
• Supabase (United States) — authentication and database · privacy policy
• Pinecone (United States) — vector search · privacy policy
• Railway (United States) — application hosting · privacy policy
• Amazon Web Services (United States) — email delivery (SES) · privacy policy
• Cloudflare (United States) — network security and delivery (CDN, DNS) · privacy policy
• PostHog (United States) — usage analytics (see §2 and §9), linked to an internal member ID only · privacy policy
• Polar.sh (United States) — USD international payments as Merchant of Record · privacy policy
• NICEPAY Payments (Republic of Korea) — KRW domestic payments, including recurring-payment card registration
• NICE Payments (Republic of Korea) — Korean Won (KRW) payments
• Google (United States, optional) · Kakao (Republic of Korea, optional) · Naver (Republic of Korea, optional) — social sign-in (OAuth; for Naver we receive your email address and Naver account ID); Google also for the optional Google Calendar connection (see §5A)
• Telegram (United Arab Emirates, optional) — notifications and delivery of messages between connected members, if you connect them

These providers process your data under data processing agreements. We will update this policy when providers or their roles change.

7. International Transfers

To provide the Software under our agreement with you, your data is transferred to and stored by the providers listed in Section 6, located mainly in the United States (and the United Arab Emirates if you connect Telegram notifications or messages). Only the data each provider needs is transferred, at the time you use the Software, over TLS-encrypted connections, and it is kept for the duration of the provider's service or until you delete your account (or longer where the law requires). You can object to these transfers or delete your account by writing to support@heyscouty.com; optional providers can be avoided by not using sign-in with Google or Telegram notifications. Because the core features depend on these providers, objecting to required transfers may mean we cannot provide the Software. Data is protected in transit (TLS) and at rest through provider-level encryption.

Main transfers in detail

• Anthropic, PBC (United States) — what: your profile (including onboarding chat answers) and, when you use those features, public page content, request messages and profile screenshots · why: AI analysis and drafting · when and how: when you use the feature, over TLS · retention: as described above · refusing: AI analysis is a core feature, so refusing may limit your use of the Software.
• PostHog, Inc. (United States) — what: the usage analytics in §2, linked to an internal member ID only (no e-mail address or name) · why: usage analytics · when and how: as you use the Software, over TLS · retention: see §4 · refusing: block analytics as described in §9; the Software keeps working.
• Google LLC (United States, optional) — what: free/busy lookups (the time window) and the access credential, only if you connect Google Calendar · why: show free times and book meetings · when and how: when the other person picks a time, over TLS · retention: see §4 · refusing: do not connect Google Calendar, or disconnect it.

8. Your Rights

Subject to applicable law, you may request:

• Access to your personal data
• Correction of inaccurate data
• Deletion of your account and associated data
• Export of your data in a machine-readable format
• Withdrawal of consent for optional processing (e.g., marketing)
• Objection to or restriction of certain processing activities

Requests can be made at support@heyscouty.com. We aim to respond within 30 days. We may retain certain data where required by law (e.g., tax records) even after deletion requests.

9. Cookies and Browser Storage

We use cookies and similar browser storage (localStorage, sessionStorage) for two purposes. We do not use advertising or cross-site tracking cookies.

• Essential: keeping you signed in (a session cookie on heyscouty.com and a copy in browser storage), security, and remembering your language and theme. Without these, sign-in and basic features do not work.
• Analytics: PostHog stores a random identifier and its settings in a cookie and browser storage to count visits and usage (§2, usage analytics), and Scouty keeps your first visit's campaign tags and referring site in browser storage so the sign-up source can be recorded (§2, sign-up source).

How to refuse analytics: Scouty does not have an in-app setting for this. You can block or delete cookies and site data for heyscouty.com in your browser settings, or block PostHog (us.i.posthog.com) with your browser's tracking protection or a content-blocking extension. Blocking analytics does not affect the Software's features; blocking all cookies and storage may stop you from signing in.

10. Security

We take the technical and organizational safeguards required by applicable law to protect your personal data. However, given the nature of the internet, we cannot promise perfect security.

11. Children

The Software is not intended for individuals under 19. We do not knowingly collect data from minors. If we become aware that we have collected such data, we will delete it promptly.

12. Changes

We may update this Policy from time to time. Material changes will be notified by email or in-Software notice.

13. Contact

Privacy officer: Kidong Shin (CEO) · support@heyscouty.com · +82 50-6511-1712

Privacy questions and requests: support@heyscouty.com

Change history

• October 20, 2026 — current version
• October 18, 2026 — view
• October 17, 2026 — view
• October 16, 2026 — view
• October 15, 2026 — view
• October 9, 2026 — first effective