Privacy Policy

1. What this covers

This policy covers ScoutCode Cloud (the hosted models, the ScoutCode API, the Chat page and accounts on scoutcode.dev) and the Scout desktop app. Providers you link yourself in the app, such as OpenRouter, GitHub Copilot or Kiro, handle your data under their own policies.

2. What we collect

Account details. Your username, your password (stored only as a hash), your API keys (stored only as hashes, with a short hint to tell them apart), your limits and credit, and when you made the account and last signed in.

Requests and traces. What you send to the models and what they answer, and traces of each request: the prompts, responses, tool calls and errors, and which models and providers it went through. We may keep these traces to run, debug and improve the Service.

Usage records. For each request: the time, which model and provider handled it, whether it worked, how long it took and how many tokens it used. These are counted against your account or, without an account, against a hash of your IP address, so the saved counts do not hold the address itself.

Voice. If you use dictation, the audio is sent to a speech-to-text provider to be transcribed and is not stored by us.

Product analytics. We use PostHog to see how scoutcode.dev and the Scout app are used: pages visited, buttons and links clicked, your browser, device and rough location (from your IP address), and in the app, its version and which provider and model each message ran on. Never the text of your messages, files or keys. The site keeps a random ID in your browser's local storage; the app keeps one in its settings. Once you sign in, this activity is linked to your username. The site sends nothing if your browser asks not to be tracked, and the app has a switch in Settings > Privacy to turn it off.

Cookies. The site sets a sign-in cookie when you sign in. We do not use advertising or analytics cookies.

3. Where your requests go

Requests are answered by third-party model providers, and as the Terms of Service explain, a request may go to a different model or provider than the one you selected. Providers ScoutCode uses include Groq, Google, Cloudflare, OpenRouter, Mistral, NVIDIA, Cohere and Z.ai, among others, and the list changes. Each receives the requests it handles and processes them under its own terms and privacy policy, not ours. Providers may log and retain some or all of what they receive, for their own monitoring, abuse prevention or other purposes, and some, particularly for free models, may use it to improve their models. We do not control what a provider keeps once a request reaches it, so do not send passwords, keys or other information you would not want a third party to hold.

We also use Supabase to host our database and file storage, and PostHog (in the United States) for product analytics.

4. How we use it

To run the Service and route your requests; to enforce limits and credit; to prevent abuse and keep the Service secure; to fix problems; and to understand which models work well. We do not sell your data.

5. The desktop app

The Scout app keeps your chats, settings and keys on your computer, in the .scoutcode folder in your home folder. It sends to a model only what that model needs for the chat: your messages and the files, command output and other context Scout reads to answer. It checks scoutcode.dev for updates, which tells us your app version and platform.

6. How long we keep it

Traces and usage records: as long as we need them to run, debug and improve the Service and to enforce limits. Data that providers retain is kept for as long as their own policies allow. Account details: until you ask us to delete your account, after which we delete them within 30 days unless the law requires us to keep them.

7. Your choices and rights

You can ask to see, correct, export or delete your account data, or object to how we use it, by emailing us. Depending on where you live, you may have further rights under laws such as the GDPR or the CCPA, and you can complain to your data protection authority.

The Service is not meant for children under 13, and we do not knowingly collect their data.

8. Security and transfers

We use encryption in transit, hashing for passwords and keys, and access controls, but no system is perfectly secure. Your data may be processed in countries other than yours, including by the model providers above.

9. Changes

We may update this policy. If a change is significant we will show it on the site or in the app before it takes effect.