Privacy Policy

Last updated 13 October 2026 · Applies to scoutdeck.lovable.app and all ScoutDeck pages.

ScoutDeck produces scouting reports on public YouTube channels and, with a creator's consent, enriches those reports with the creator's own private analytics. This page explains exactly what data we handle, why, and what we never do with it. See also the Terms of Service.

1. Scout accounts

Saving briefs, comparing scenarios, and reviewing claim evidence requires a free account. We store your email address and a securely hashed password through our authentication provider. Passwords are never readable by us or anyone else. Your saved briefs, saved creators, and platform scenarios are private to your account and are not visible to other scouts or to the public.

2. Public YouTube data

The core of every report is built from publicly available YouTube data retrieved through the official YouTube Data API: subscriber counts, view and like counts, comments, upload dates, video durations, livestream flags, channel country and keywords, and comment threads. We only retrieve data that is already visible to anyone on youtube.com.

3. Creator consent and private analytics

Some metrics — impressions, click-through rate, watch time, returning viewers, revenue — exist only in a channel owner's YouTube Analytics. To include them, a scout sends the creator a private form link. If the creator chooses to connect:

• You sign in with Google and explicitly consent to read-only YouTube scopes: youtube.readonly, yt-analytics.readonly, and optionally yt-analytics-monetary.readonly if you separately approve revenue access.
• ScoutDeck imports analytics at consent and retains an encrypted Google refresh authorization for ongoing, creator-requested syncing. Short-lived access tokens are used only during requests and are not stored. Your creator page shows connection status and offers Sync now, Reauthorize and Disconnect.
• We store the snapshot data, your name and email as the submitter, and the timestamp of your consent — so there is a record of what was shared and when.
• You can instead enter figures manually. Manually entered numbers are stored the same way and are labelled as creator-entered, not independently verified.

Use of information received from YouTube APIs adheres to the YouTube API Services Terms of Service and the Google API Services User Data Policy, including the Limited Use requirements. Data from YouTube APIs is not transferred to advertising platforms and is not used to train AI models. You can revoke ScoutDeck's access at any time in your Google account permissions. Disconnecting on your creator page removes stored refresh authorization and stops future syncing. Revoking at Google stops future authorized access; ScoutDeck detects it on the next sync. Previously shared snapshots are not deleted by disconnecting.

4. AI-generated briefs

When a scout generates an AI scouting brief, the channel's report metrics (public data plus any consented or creator-entered figures) are sent to our AI provider to draft the brief. We do not send creator names, emails, or consent records to the AI provider, and we do not allow our provider to train on this data.

5. Share links

A scout can make a brief shareable via a private link. Only claims whose evidence has been approved in the review workflow appear on the share link — rejected or unreviewed claims are held back. Anyone with the link can view the approved brief; it is not indexed for search engines.

6. What we never do

• We never sell personal data.
• We never run advertising or third-party tracking cookies.
• We never store Google or YouTube access tokens.
• We never make one creator's private analytics visible to another creator or to the public.

7. Cookies and local storage

We use browser local storage to keep you signed in and a short-lived, secure authorization cookie to verify Google callbacks. No analytics cookies, advertising cookies, or cross-site trackers are used.

8. Retention and deletion

Saved briefs and scenarios are kept until you delete them or close your account. Creator data requests can be deleted by the scout who created them; creators may also ask us to remove their submitted data. To request deletion of your account or your submitted data, contact us and we will remove it.

Removing ScoutDeck through Instagram can send Meta’s signed deletion request. ScoutDeck removes matching authorization, imported figures, linked intake evidence and tracked observations and returns a private confirmation address. Older connections without an app-scoped identity mapping need review and are not labelled completed. Previously downloaded copies cannot be recalled.

9. Security

All traffic is encrypted in transit. Private data lives behind row-level security so a signed-in scout can only read their own records. Private creator links use unguessable tokens, and the most sensitive work (token lookup, analytics snapshots) runs server-side only.

10. Contact

Questions, deletion requests, or privacy concerns: use the contact details on this site's published listing, or reach the ScoutDeck team through the support channel where you received your invite.