Privacy policy
Scoutfolio, a Belgian business with enterprise number (KBO) BE 1044.459.277, is the controller of your personal data. Contact us at hello@scoutfolio.football.
What we collect
- Account: your email address, your name if you give it, and your password stored as a secure one-way hash. Nobody, including us, can see your password.
- Your content: the reports, shortlists, calendar entries and templates you create, including photos you upload and, on Pro, your logo and brand colour.
- Billing: handled by Stripe. We receive your subscription status and a customer reference, never your full card details.
- Emails: we send emails about your account: the link to confirm your email address after you sign up, a welcome email, the confirmation of Pro, a reminder before a yearly plan renews, three days before the free Pro of the beta ends (or before a trial that started before Free and Pro existed ends), payment problems, password resets and security notices. If you tick "Send me emails to get started" when you sign up (it is off unless you do), we also send three short emails about how Scoutfolio works in your first three weeks, one a month after a Pro plan ends, and a short reminder when you have not written or opened a report for a month (at most once every two months). Every one of these emails has a one-click unsubscribe link, you can switch them off under Account, and they go only to a confirmed address. We never send advertising for others. Emails are sent through Resend (servers in the EU), which only processes your email address to deliver them. The confirmation link works once, for one hour; we store only a scrambled copy (a hash) of it.
- Contact form: when you write to us, your name, email address, topic and message are sent to us by email and kept in our mail queue, encrypted, for at most three days. If you are signed in, we add your account reference and plan.
- Where your visit came from: when you sign up we store, encrypted, the utm_source, utm_medium and utm_campaign of the link you followed and the name of the website that linked to us, if any. We only look at these as totals. No cookies are used for this.
- Visit statistics: if we switch them on, our public pages (not the app and not shared shortlists) use Plausible Analytics, a cookieless service that counts visits without identifying you.
- Voice input (Pro): dictation uses your browser's own speech recognition (the Web Speech API). Scoutfolio never receives the audio, only the text you choose to insert. In Chrome and Edge the browser sends the audio to its maker's speech service (Google for Chrome, Microsoft for Edge) to turn it into text; Safari may use Apple's. This happens only while you use dictation.
- Technical: a session cookie to keep you signed in, a cookie that remembers the language you chose, and server logs (IP address, time, requested page) kept for at most 30 days for security.
How we protect it
- Passwords must have at least 12 characters with an upper-case letter, a lower-case letter, a number and a symbol. They are hashed with scrypt, a slow, memory-hard algorithm, combined with a secret key that is kept outside the database. A copy of the database alone is not enough to try to crack them.
- Your reports, templates, name and email address are encrypted with AES-256 before they are stored. The encryption key is never stored in the database, so a stolen database or backup is unreadable.
- New passwords are checked against lists of passwords leaked in other breaches through the Have I Been Pwned service. Only the first five characters of a hash of the password are sent, never the password itself.
- Two-step verification with an authenticator app is available for every account, with one-time recovery codes.
- Connections use HTTPS only. Sign-in cookies cannot be read by scripts, are never sent to other sites and expire after 14 days without activity. Repeated wrong sign-ins are blocked.
- Only you can open your reports. Every request is checked against your account.
No system is ever perfectly safe. If a breach affecting your data ever happens, we will inform you and the data protection authority as the GDPR requires. Report security issues to the address in security.txt.
Why we use it
To provide the service you signed up for (contract), to bill your subscription (contract and legal obligations for bookkeeping) and to keep the service secure (legitimate interest). We do not sell your data, show ads or use your reports to train AI models.
Cookies
We only use strictly necessary cookies: one to keep you signed in and one to remember your language. No tracking or advertising cookies, so there is no cookie banner. Fonts are served from our own server.
Who processes data for us
- Hosting: Render Services, Inc. (servers in Frankfurt, Germany)
- Encrypted backups: Cloudflare R2 (storage in the EU)
- Emails: Resend (servers in Ireland)
- Payments: Stripe Payments Europe, Ltd.
- Voice input, only when you use dictation: your browser's speech service (for example Google in Chrome, Microsoft in Edge)
- Visit statistics on public pages, only when switched on: Plausible Insights OÜ (servers in the EU)
How long we keep it
As long as your account exists. Reports you delete stay in the trash for 30 days and are then removed. Earlier versions of a report are kept for up to 180 days on Pro; on Free, versions older than 7 days are deleted once the account has been on Free for 30 days. When Pro ends, every report stays: no report is deleted because of your plan. A logo you upload is kept until you remove it or delete your account, also when Pro ends. When you delete your account we delete your account data and content straight away; encrypted backups are kept for disaster recovery for at most 13 months and then deleted. Billing records are kept as long as tax law requires.
Your rights
You can access, correct, download (Account, Download my data) and delete (Account, Delete account) your data yourself. You can also object to processing or ask us to restrict it, and you can complain to your data protection authority.
Data about players
Reports can contain information about players. You decide what you write and you are responsible for it. Keep it to what you need for scouting, and do not record sensitive data such as health details unless you have a lawful reason.
Sharing a report by link
On every plan you can share a report with a link. Anyone who has the link can read that report as it is now (including the photos in it, and the first name or profile name of the scout) until the link expires or the scout stops it. When someone opens the link we store only the moment it was opened, so the scout can see how often and when; we store no address, device or cookie of the reader. To count a reader only once in half an hour, the address is kept in the server's memory for thirty minutes and never written down. Opens by the scout are not counted. Shared reports are not indexed by search engines. The link itself is stored as a hash to look it up and encrypted so the scout can copy it again.
Public scout profile
A scout can turn on a public profile. It shows the name the scout chooses, an optional region and introduction, totals of the scout's work in Scoutfolio (reports, players, matches watched, positions and competitions, reports per month) and the reports the scout chooses to make public. The email address and all other reports stay private. The profile is off until the scout turns it on, can be turned off at any time, and is only shown to search engines when the scout allows that.
Shortlist share links
On Pro you can share a shortlist with a link. Anyone who has the link can see the listed fields of the players on it (name, position, club, age, nationality, status, priority, verdict and overall grade, plus the shortlist name and your first name) until the link expires or you revoke it. Links expire after at most 90 days. The rest of your reports, your notes and your photos are never shown through a link. We store only a scrambled copy of the link (a hash), so we cannot look it up for anyone, and shared pages are not indexed by search engines. When Pro ends, every share link of the account stops working.