Privacy Policy — Scoutsy

MSCLTHRU Unlimited ("MSCLTHRU," "we," "us," or "our") operates the Scoutsy mobile application ("Scoutsy," the "App") and the website located at getscoutsy.com (the "Website"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the App and the Website (collectively, the "Service").

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

1. Information We Collect

We collect information in several ways: directly from you, automatically when you use the Service, and from third-party services you connect to your account.

1.1 Information You Provide Directly

Account Information. When you create an account, we collect your name, email address, and profile photo. You may register using email and password, Apple Sign-In, or Google Sign-In.
Profile Information. You may provide additional information to your profile, including a display name, bio, and profile picture.
Listing Content. When you create product listings, we collect the photos you take or upload, product descriptions, pricing information, condition details, sizing, and category selections.
ThriftWish Content. When you create a Wish (a request for a specific item), we collect your wish title, inspiration photos, budget range, category, brand, size, color, condition preferences, search radius, and urgency level.
Payment Information. When you set up payouts or make purchases through ThriftWish, payment processing is handled by Stripe Connect. We do not store your full credit card number, debit card number, or bank account number on our servers. Stripe collects and processes this information directly in accordance with Stripe's Privacy Policy.
Shipping Information. When you ship items through the Service, we collect shipping addresses, package dimensions, and weight information. Shipping labels are generated through Shippo.
Chat Messages. When you communicate with other users through the in-app messaging system, your messages are processed and stored by Stream Chat. We may access message content for safety moderation purposes, including automated filtering of personal contact information and off-platform payment solicitations.
Support Communications. If you contact us for customer support, we collect the information you provide in your correspondence, including your name, email address, and the content of your messages.

1.2 Information Collected Automatically

Device Information. We collect information about the device you use to access the Service, including device model, operating system and version, unique device identifiers, and mobile network information.
Photo Provenance Data. When you take photos within the App, we record the timestamp and device identifier associated with each photo. This information is used to establish proof of original creation for DMCA compliance and fraud prevention.
Usage Data. We collect information about how you interact with the Service, including the features you use, the actions you take, the time and duration of your activities, and diagnostic data.
Log Data. Our servers automatically record information when you access the Service, including your IP address, browser type, referring/exit pages, and timestamps.

1.3 Information Collected With Your Permission

Location Data. With your explicit permission, we collect your device's geographic location. Location data is used to show you nearby ThriftWish wishes, suggest safe meetup locations, and calculate distances for local transactions. You may revoke location permissions at any time through your device settings. The Service will continue to function with reduced functionality if location access is denied.
Camera Access. With your permission, we access your device camera to allow you to take product photos for listings and Scout Mode scans. Camera access is required for core listing functionality.
Photo Library Access. With your permission, we access your device's photo library to allow you to upload inspiration photos for ThriftWish wishes and supplementary listing photos.
Push Notifications. With your permission, we send push notifications for new messages, order updates, ThriftWish match alerts, and other Service-related communications. You may disable push notifications at any time through your device settings.

1.4 Information From Third-Party Platform Connections

When you connect external selling platforms to your Scoutsy account for cross-listing purposes, we collect and store OAuth authentication tokens for those platforms. The platforms you may connect include:

Auto-Post Platforms (API integration): eBay, Etsy, TikTok Shop, Shopify, BigCommerce, WooCommerce, and Whatnot.
Assisted Platforms (copy-paste workflow): Poshmark, Mercari, Depop, Facebook Marketplace, and OfferUp.

For Auto-Post platforms, we store encrypted OAuth tokens in our database to post listings on your behalf. We do not store your login credentials (username and password) for any connected platform. You may disconnect any platform at any time through the App settings, which will revoke our access and delete the stored tokens.

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Providing and Maintaining the Service

Creating and managing your account.
Generating and cross-posting product listings to connected platforms.
Facilitating ThriftWish transactions between buyers and sellers.
Processing payments and managing escrow through Stripe Connect.
Generating shipping labels through Shippo.
Enabling in-app messaging between buyers and sellers.
Managing your subscription through RevenueCat.

2.2 AI-Powered Features

Listing Generation. Product photos you take in the App are sent to Google Gemini AI to automatically generate listing titles, descriptions, and category suggestions.
Background Removal. Product photos may be processed by Google Gemini AI to remove backgrounds for cleaner listing images.
Price Estimation. Product photos and identifying information are processed by Google Gemini AI and eBay's completed listings data to provide resale price estimates.
Scout Mode. Photos taken in Scout Mode are analyzed by Google Vision API and Google Gemini AI to identify items, estimate resale value, and match against open ThriftWish wishes.
Photo Similarity Matching. When a hunter proposes a ThriftWish match, AI compares the hunter's photos against the buyer's inspiration photos to generate a similarity score.

We process your photos through AI services solely to provide the features described above. We do not use your photos to train AI models. Please refer to Google's Privacy Policy for information about how Google processes data sent to its AI services.

2.3 Safety and Moderation

Automated filtering of chat messages to prevent sharing of personal contact information, off-platform payment links, and external marketplace links.
Photo provenance recording (timestamp and device ID) for DMCA compliance and fraud prevention.
Monitoring for counterfeit items and prohibited goods.
Enforcing our Terms of Service and Prohibited Items Policy.

2.4 Communication

Sending transactional notifications (order updates, shipping confirmations, payment receipts, dispute notifications).
Sending Service-related announcements and updates.
Responding to your customer support inquiries.

2.5 Improvement and Analytics

Understanding how users interact with the Service to improve functionality and user experience.
Diagnosing technical issues and bugs.
Analyzing aggregate usage trends.

3. How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

3.1 With Other Users

Sellers: When you purchase an item or submit a ThriftWish match, the seller or hunter will see your display name, profile photo, and general location (city-level, not exact address). If a transaction proceeds to shipping, the seller will receive your shipping address.
Buyers: When you list an item or propose a ThriftWish match, buyers will see your display name, profile photo, listing content, and general location.

3.2 With Third-Party Service Providers

We share information with the following third-party services that help us operate the Service:

Service Provider	Purpose	Data Shared
Supabase	Database hosting, authentication, file storage	Account info, listing data, photos, auth credentials
Stripe Connect	Payment processing, escrow, payouts	Name, email, payment info, transactions, identity verification
RevenueCat	Subscription management	User ID, subscription status, purchase history
Stream Chat	In-app messaging	User ID, display name, chat messages
Google Gemini AI	Listing generation, BG removal, pricing	Product photos, listing metadata
Google Vision API	Image analysis for Scout Mode	Product photos
Shippo	Shipping labels, carrier rates, tracking	Addresses, dimensions, weight
eBay API	Price estimation, cross-posting	Product identifiers, listing content
Etsy, TikTok Shop, Shopify, BigCommerce, WooCommerce, Whatnot APIs	Cross-posting listings	Listing content, product photos
Apple / Google Sign-In	Authentication	Auth token, email, name

Each of these service providers processes your data in accordance with their own privacy policies. We encourage you to review the privacy policies of any third-party services you interact with through the App.

3.3 For Legal Purposes

We may disclose your information if required to do so by law or in response to valid requests by public authorities (for example, a court order or government agency request). We may also disclose your information when we believe in good faith that disclosure is necessary to:

Comply with a legal obligation.
Protect and defend our rights or property.
Prevent or investigate possible wrongdoing in connection with the Service.
Protect the personal safety of users of the Service or the public.
Protect against legal liability.

3.4 DMCA and Intellectual Property Matters

If we receive a valid DMCA takedown notice concerning content you have posted, we may share limited information with the complainant as required by law. If you file a counter-notice, that counter-notice (including your name and contact information) will be provided to the original complainant.

3.5 Business Transfers

If MSCLTHRU Unlimited is involved in a merger, acquisition, asset sale, or bankruptcy, your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Service before your information is transferred and becomes subject to a different privacy policy.

4. Data Storage and Security

4.1 Where Your Data Is Stored

Your data is stored on servers operated by Supabase, which uses Amazon Web Services (AWS) infrastructure located in the United States. OAuth tokens for connected platforms are stored in encrypted form in our Supabase database.

4.2 Security Measures

We implement commercially reasonable security measures to protect your personal information, including:

Encryption of OAuth tokens at rest.
Row-level security (RLS) policies on all database tables to prevent unauthorized access.
Rate limiting on all API endpoints.
HTTPS encryption for all data in transit.
Authentication throttling (cooldown and lockout mechanisms) to prevent brute-force attacks.
AI kill switch capability to immediately disable all AI processing in the event of a security incident.

While we take reasonable precautions, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your information.

4.3 Data Retention

We retain your personal information for as long as your account is active or as needed to provide you the Service. Specifically:

Account data is retained until you delete your account.
Listing content and photos are retained for the duration of your account, plus a reasonable period after deletion for legal and dispute resolution purposes.
Transaction records are retained for a minimum of seven (7) years to comply with financial record-keeping requirements.
Chat messages are retained in accordance with Stream Chat's retention policies.
Scout Mode scan history is retained for the duration of your account.
Photo provenance records (timestamps, device IDs) are retained permanently for DMCA compliance purposes.

When you delete your account, we will delete or anonymize your personal information within thirty (30) days, except for data we are required to retain by law or for legitimate business purposes as described above.

5. Your Rights and Choices

5.1 Account Information

You may update your account information at any time through the App settings. You may update your display name, profile photo, and email address.

5.2 Platform Connections

You may connect or disconnect external selling platforms at any time through the App settings. Disconnecting a platform will delete the stored OAuth tokens and prevent further cross-posting to that platform. Listings previously posted to that platform will remain on the platform and must be managed directly through that platform.

5.3 Location Data

You may enable or disable location services at any time through your device settings. Disabling location services will prevent the App from showing you nearby ThriftWish wishes and suggesting meetup locations.

5.4 Push Notifications

You may enable or disable push notifications at any time through your device settings.

5.5 Account Deletion

You may request deletion of your account and associated data by contacting us at legal@getscoutsy.com or through the account settings in the App. Upon receiving your request, we will delete your account and personal information within thirty (30) days, subject to the retention requirements described in Section 4.3.

6. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

6.1 Right to Know

You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which the information was collected, the business or commercial purpose for collecting the information, and the categories of third parties with whom we share the information.

6.2 Right to Delete

You have the right to request that we delete the personal information we have collected from you, subject to certain exceptions permitted by law (for example, transaction records required for financial compliance).

6.3 Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you.

6.4 Right to Opt Out of Sale or Sharing

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. Therefore, there is no need to opt out. However, if our practices change in the future, we will update this policy and provide an opt-out mechanism.

If you wish to exercise your "Do Not Sell or Share My Personal Information" right proactively, you may contact us at legal@getscoutsy.com to place this preference on file.

6.5 Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you the Service, charge you different prices, provide a different level of quality, or suggest that you will receive a different level of service for exercising your rights.

6.6 Categories of Information Collected

Category	Examples	Collected
Identifiers	Name, email, device ID, IP address	Yes
Customer Records	Name, address, payment info (via Stripe)	Yes
Commercial Information	Products listed, purchasing history, transactions	Yes
Internet/Network Activity	App usage data, browsing history within the Service	Yes
Geolocation Data	Device location (with permission)	Yes
Sensory Data	Photos taken within the App	Yes
Inferences	AI-generated descriptions, price estimates, categories	Yes
Sensitive Personal Information	Account login credentials	Yes

6.7 How to Submit a Request

To exercise your CCPA/CPRA rights, you may:

Email us at legal@getscoutsy.com with the subject line "CCPA Request."
Use the data export or account deletion features within the App settings.

We will verify your identity before processing your request. We will respond to verifiable requests within forty-five (45) days of receipt. If we require more time (up to an additional forty-five days), we will inform you of the reason and extension period in writing.

You may designate an authorized agent to make a request on your behalf. To do so, provide the agent with written permission and contact us for identity verification.

7. Other State Privacy Rights

If you reside in a state with a comprehensive consumer privacy law (such as the Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, or similar legislation), you may have rights similar to those described in Section 6, including the right to access, delete, and correct your personal information, and the right to opt out of the sale of personal information or targeted advertising.

To exercise these rights, contact us at legal@getscoutsy.com. We will respond in accordance with applicable law.

8. International Users

The Service is operated from the United States. If you are accessing the Service from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States. By using the Service, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on your consent and our legitimate interests as the legal bases for processing your personal information. You have the right to withdraw your consent at any time by contacting us at legal@getscoutsy.com.

9. Children's Privacy

The Service is not intended for children under the age of thirteen (13). We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us at legal@getscoutsy.com so we can take appropriate action.

Users between the ages of 13 and 17 may use the Service only with the involvement and consent of a parent or legal guardian.

10. Third-Party Links and Services

The Service may contain links to third-party websites, services, or applications, including the external selling platforms to which you cross-post listings. This Privacy Policy does not apply to those third-party services. We encourage you to read the privacy policies of any third-party services you visit or use.

When you connect an external selling platform to your Scoutsy account, your interactions with that platform are governed by that platform's own terms of service and privacy policy. We are not responsible for the privacy practices of any third-party platform.

11. In-App Messaging and Moderation

Messages sent through the in-app messaging system are processed by Stream Chat and are subject to automated moderation. Our moderation system automatically filters messages that contain:

Phone numbers or email addresses.
Links to off-platform payment services (such as Venmo, CashApp, PayPal, or Zelle).
Links to external marketplaces.

This filtering is performed to protect users from fraud and to keep transactions within the safety of the Scoutsy escrow system. Filtered messages are not delivered to the recipient. We may review flagged messages to improve our moderation systems and investigate potential fraud.

12. AI Processing Disclosure

Certain features of the Service use artificial intelligence to process your data:

Listing Generation: Photos you take are sent to Google Gemini AI, which analyzes the images and generates suggested titles, descriptions, and pricing. The generated content is presented to you for review and editing before publication.
Background Removal: Product photos may be sent to Google Gemini AI to produce images with transparent or clean backgrounds.
Scout Mode: Photos taken in Scout Mode are sent to Google Vision API for item identification and to Google Gemini AI for price estimation and wish matching.
Photo Similarity: When matching ThriftWish proposals, AI compares photos to generate a similarity score.

Your photos are transmitted to Google's servers for processing and are subject to Google's data handling practices. We do not use your content to train our own AI models. The AI-generated content (titles, descriptions, price estimates) is derived from your photos and publicly available market data.

You may disable AI features by not using the Scout Mode or AI listing generation features. Core listing functionality (manual entry and cross-posting) does not require AI processing.

13. Subscription and Purchase Data

Subscription management is handled by RevenueCat. When you subscribe to a Pro or Icon tier, the following occurs:

Your subscription purchase is processed through Apple's App Store or Google Play Store.
RevenueCat receives your anonymized user ID and subscription status to manage entitlements.
We receive your subscription tier and status from RevenueCat to determine your feature access and fee rates.
We do not receive or store your App Store or Google Play payment method details.

For information on how Apple or Google handle your purchase data, please refer to their respective privacy policies.

14. Cookies and Tracking Technologies

The Scoutsy mobile application does not use cookies. The getscoutsy.com website may use cookies and similar technologies (such as web beacons and local storage) for the following purposes:

Essential Cookies: Required for the website to function properly, including authentication and security.
Analytics: To understand website usage patterns and improve the user experience.

You may control cookies through your browser settings. Disabling essential cookies may prevent you from using certain features of the Website.

15. Do Not Track Signals

Some web browsers transmit "Do Not Track" (DNT) signals. Because there is no uniform standard for interpreting DNT signals, the Service does not currently respond to DNT signals. We will update this policy if a uniform standard is established.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last Updated" date at the top of this policy and, if the changes are material, we will notify you through the App or by email.

Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated policy. We encourage you to review this Privacy Policy periodically.

17. Data Breach Notification

In the event of a data breach that compromises your personal information, we will notify affected users in accordance with applicable law. Depending on the jurisdiction:

California residents will be notified in accordance with California Civil Code Section 1798.82.
Residents of other states will be notified in accordance with their state's breach notification laws.

We will provide notification as promptly as possible and no later than required by applicable law, including a description of the breach, the types of information affected, and steps you can take to protect yourself.

18. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: legal@getscoutsy.com

Mailing Address:
MSCLTHRU Unlimited
Attn: Privacy
getscoutsy.com

For CCPA/CPRA requests, please email legal@getscoutsy.com with the subject line "CCPA Request."

For DMCA-related inquiries, please email legal@getscoutsy.com with the subject line "DMCA."

For account deletion requests, you may use the in-app account deletion feature or email legal@getscoutsy.com with the subject line "Account Deletion Request."

This Privacy Policy is effective as of March 2026.