Scoutty Privacy Policy

Scoutty ("Scoutty," "we," "us") is a product of Acorn Designs, LLC, a Colorado limited liability company ("Acorn Designs," "the Company"). This Privacy Policy explains what information Scoutty collects, why, and what control you have over it.

Scoutty is a free web app (scoutty.app) that helps you track tech/design events, build a personal opportunity pipeline, keep private notes, maintain a personal networking CRM, and optionally generate AI-assisted briefs and reports.

If you don't agree with this policy, please don't use Scoutty.

1. Who we are / how to contact us

Acorn Designs, LLC (a Colorado limited liability company) Email: hello@scoutty.app

Scoutty is a solo-developer project operated through Acorn Designs, LLC — legally, you are contracting with the Company, not an individual. See the Terms of Service for what that means for liability.

2. Information we collect

### 2.1 Account information When you sign in with Google OAuth, we receive your name, email address, and profile avatar from Google. If you sign in via email magic link (sent through Resend), we collect your email address. We never see or store a password — Scoutty has no password-based login.

### 2.2 Content you create Using Scoutty means you generate content that we store on your behalf, including:

• Pipeline stages and status for events you're tracking
• Scores, tags, and personal notes on events
• CRM/contact entries — information you enter about people you meet (names, notes, context, etc.)
• Profile details you provide, such as interests and goals, used to personalize recommendations

This content is yours. We store it to run the app and don't use it for anything else (see Section 4).

### 2.3 Optional Google Calendar connection If you choose to connect Google Calendar, Scoutty requests read-only, free/busy access only (Google's freeBusy API) — meaning we can see which time blocks are busy on a given day, not event titles, descriptions, attendees, or locations. We do not read your full calendar.

• Your OAuth refresh token is stored encrypted at rest (AES-256-GCM).
• You can revoke this connection at any time from within the app, which deletes the stored token and stops all calendar access. You can also revoke Scoutty's access directly from your Google Account permissions page.

Google API Services User Data Policy — Limited Use disclosure: Scoutty's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar free/busy data is used solely to power in-app scheduling features for your account and is never used for advertising, sold, or shared with third parties, and is never used to train generalized AI/ML models.

### 2.4 Optional AI features Scoutty can generate AI briefs and reports. If you choose to enable this, you supply your own AI API key, which we store encrypted. We use it only to make AI calls on your behalf, at your own cost with your provider (e.g., Anthropic). We do not use your key for any purpose other than fulfilling your requests, and we don't inspect or reuse your key.

### 2.5 Operational logs Standard server/hosting logs (e.g., request timestamps, error logs, IP address as logged by our hosting provider) are generated automatically for security, debugging, and abuse prevention. We do not use analytics trackers, ad pixels, or third-party marketing/tracking scripts.

• No payment or financial information (Scoutty is free; we don't process payments)
• No advertising identifiers or cross-site tracking
• No passwords (OAuth/magic-link only)
• No full calendar contents — only free/busy day-level data, and only if you opt in

3. How we use your information

We use your information only to:

We do not use your data to serve ads, and we do not sell, rent, or trade your personal information to third parties.

4. Who we share information with (subprocessors)

Scoutty relies on the following service providers to operate. Each processes data only as needed to provide their service to us:

We do not share your data with any other third party, and we do not sell personal information as defined under California law (see Section 7).

5. Data security

We take reasonable technical measures to protect your information, including:

• Encryption at rest (AES-256-GCM) for sensitive tokens (Google refresh token, AI API key)
• HTTPS in transit
• httpOnly, HMAC-signed session cookies (no client-side session storage)

No system is perfectly secure. As a small, solo-developer-run product, Scoutty does not have a dedicated security team; if you become aware of a vulnerability, please report it to hello@scoutty.app and we'll address it promptly.

6. Data retention & deletion

We retain your data for as long as your account is active. You may:

• Delete individual content (notes, CRM entries, pipeline items) within the app at any time
• Disconnect Google Calendar at any time, which deletes the stored refresh token
• Request full account deletion by emailing hello@scoutty.app — we will delete your account and associated data within a reasonable time (target: 30 days), except where retention is required for legal/security reasons (e.g., abuse logs)

7. Your rights (California / Colorado privacy laws and general privacy rights)

Acorn Designs, LLC is a Colorado company, and its operations (including day-to-day development of Scoutty) are based in California. Because of this footprint, we extend the following rights to all users, regardless of location, whether or not the applicable statutory thresholds for these laws are technically met for a service of Scoutty's size:

• Know what personal information we collect and how it's used
• Request deletion of your personal information
• Request a copy/export of your data
• Non-discrimination for exercising these rights

This is intended to reflect the spirit of the California Consumer Privacy Act / CPRA (which applies to California residents' data and is relevant given our California-based operations) and the Colorado Privacy Act (relevant given the Company's Colorado domicile). Note that both statutes technically only bind businesses that meet certain revenue or data-volume thresholds, which Scoutty may or may not meet at any given time — we're providing these rights as a matter of practice rather than making a representation about which specific thresholds apply to us.

We do not sell or "share" (as defined by CPRA, e.g., for cross-context behavioral advertising) personal information. There is currently no "Do Not Sell/Share My Info" mechanism because we don't engage in that activity.

To exercise any of these rights, email hello@scoutty.app. We'll respond within a reasonable time and may need to verify your identity via your account email.

Other users / GDPR: Scoutty is not specifically targeted at users in the EU/UK, but if you access it from there, we'll make reasonable efforts to honor equivalent rights (access, correction, deletion, portability) — contact us at the email above. Note that as a small, non-EU-targeted service, formal GDPR representative/DPO obligations generally do not apply, but we still aim to respect these rights on request.

8. Age requirement

Scoutty is intended for users 18 years of age or older. We do not knowingly collect information from anyone under 18. If we learn a user is under 18, we will delete the account. This is not a service directed at children (COPPA does not apply, as we do not target or knowingly collect data from children).

9. Third-party links

Event listings and other content may link to third-party sites (e.g., Luma, Meetup, event pages). We aren't responsible for the privacy practices of those sites — check their own policies.

10. Changes to this policy

We may update this Privacy Policy as Scoutty evolves. We'll update the "Effective date" above and, for material changes, make reasonable efforts to notify you (e.g., in-app notice or email). Continued use after changes take effect means you accept the updated policy.

11. Contact

Questions, requests, or concerns about this policy or your data: Acorn Designs, LLC — hello@scoutty.app