Scott’s Guide Privacy Policy

Last updated: August 22, 2026

This Privacy Policy explains how Scott’s Guide (“we”, “us”, or “our”) collects, uses, and protects information when you use the Scott’s Guide mobile application and our website.

1. Information we collect

1.1 Account and login information

When you create an account or sign in, we may collect information such as your email address and information provided by your chosen sign-in method (for example, Apple or Google). We use this information primarily to:

• Authenticate you and allow you to log in;
• Associate your data with your account; and
• Help you recover access to your account if needed.

The specific information we receive depends on your sign-in method. Apple Sign-In may provide a private relay email address rather than your personal email. Google Sign-In provides your Google account email address and display name.

1.2 App data you choose to store

Scott’s Guide is designed to store data that you choose to enter or manage, such as:

• Your saved bullets or components;
• Favorites, custom lists, or library entries;
• Other app preferences and settings.

This data is collected so that it can be synced between your devices and restored if you change or reset your phone, sign in on a new device, or reinstall the app.

1.3 AI features and conversation data

Scott's Guide offers AI-powered features, including the AI Load Advisor and AI Product Identification. When you use these features:

• Your text prompts, bullet/powder selections, and AI-generated responses are collected and stored;
• Your prompts are transmitted to OpenAI, a third-party AI model provider, for processing via Cloudflare AI Gateway;
• AI conversations are associated with your Firebase user ID and stored in our database for 30 days, after which they are automatically deleted;
• When you use AI Product Identification to describe a bullet or powder not in our database, the text you submit and your user ID are stored in a staging table for review;
• When a product you describe cannot be matched to an existing entry in our database, we may make additional AI requests using the identified product name and manufacturer to gather product specifications. This data does not include any personal information.

OpenAI processes your prompts solely to generate responses and is contractually prohibited from using your data to train its models when accessed via API. For more information, see OpenAI's Privacy Policy at openai.com/policies/privacy-policy.

1.4 Subscription and usage data

If you subscribe to Scott's Guide, we store the following data associated with your account:

• Your subscription status (active, expired, or trial);
• Trial start date and AI query count (to manage trial limits);
• Platform-specific subscription identifiers (Apple original transaction ID or Google Play purchase token) used to verify and manage your subscription status;
• Disclaimer acceptance status.

We do not collect or store your payment information. All payment processing is handled directly by Apple through the App Store (iOS) or Google through Google Play (Android).

We use RevenueCat to manage and validate subscription entitlements across platforms. RevenueCat receives your Firebase user ID together with the purchase receipt or token issued by Apple or Google, and returns your current entitlement status. RevenueCat does not receive your payment card details.

1.5 Usage and technical information

We may collect limited technical information automatically when you use the app or website, such as:

• Device type and operating system;
• Approximate time of use and basic interaction data;
• Error logs or crash reports.

This information is used to maintain and improve the stability, performance, and usability of Scott’s Guide. We use Firebase Analytics to collect anonymous usage data (such as feature engagement and subscription events) to improve the app. We do not use any advertising SDKs or cross-app tracking technologies.

We also use PostHog for product analytics. PostHog records in-app events such as screen views, onboarding completion, sign-in method, feature usage, and subscription status changes. Unlike Firebase Analytics, PostHog events are linked to your account: once you sign in, we identify you to PostHog using your Firebase user ID and attach your email address as a user property. When you sign out, we reset that identity. PostHog data is used to understand how the app is used and to improve it. It is not used for advertising, and we do not use PostHog session replay.

On Android, we may use Google Play Integrity API to verify that the app is running on a genuine, unmodified device. This check transmits a device integrity token to Google’s servers, which returns a verdict about app integrity, device integrity, and account licensing status. We use this solely to prevent fraud and abuse. No personal information is collected through this process beyond the integrity verdict.

If you submit a diagnostic report through the app’s settings, we collect detailed technical information including app logs, network request logs, device model, operating system version, connection type, and any description you provide. This data is sent to our diagnostic service and is used solely to troubleshoot issues you have reported.

1.6 Feedback and support data

If you submit a feedback report or bug report through the app, we collect the information you provide (such as a description of the issue, the category of feedback, and any associated bullet or data references), along with technical context including your platform, app version, operating system version, and device model. This data is stored in our database and may be sent via email to our support team. Feedback reports are associated with your user account.

2. How we use your information

We use the information we collect for the following purposes:

• To create and manage your account and authentication;
• To store and sync the data you choose to save (such as your library, favorites, and preferences);
• To operate, maintain, and improve the app and website;
• To communicate with you about important updates or changes related to the app;
• To respond to support requests you submit;
• To provide AI-powered features, including generating load data recommendations and identifying products based on your descriptions;
• To manage your subscription, enforce trial limits, and track AI query usage;
• To enforce rate limits and prevent abuse of the service;

3. No sale of your personal information

We do not sell your personal information. We also do not share your personal information with third parties for their own marketing purposes.

We use the following third-party service providers to operate Scott’s Guide. These providers process your data on our behalf under data processing agreements and appropriate safeguards:

• Firebase (Google) — Authentication, analytics, crash reporting, and performance monitoring services. Receives your email address, name, and authentication tokens when you sign in with Apple or Google. Firebase Analytics collects anonymous usage data such as feature engagement, screen views, and subscription events. Firebase Crashlytics collects crash reports including device model, OS version, and stack traces to help us fix issues. Firebase Performance Monitoring collects app startup time, network request latency, and screen rendering data. Analytics and performance data is not linked to your personal identity and is not used for advertising. Crash reports (Crashlytics) may be associated with your user ID to help us diagnose issues specific to your account, but this data is not used for advertising.
• PostHog — Product analytics. Receives in-app event data (screen views, feature usage, subscription status changes) along with your Firebase user ID and email address once you are signed in, plus basic device and app-version context. Data is processed on PostHog’s United States cloud. PostHog is not used for advertising or cross-app tracking.
• RevenueCat — Subscription management. Receives your Firebase user ID and the purchase receipt or token issued by Apple or Google in order to validate your subscription and return your entitlement status. Does not receive payment card details.
• Cloudflare Workers and Cloudflare D1 — Backend hosting and database. Stores your account data, library items, AI conversations, and subscription metadata.
• Cloudflare AI Gateway — Proxies AI requests between our backend and OpenAI. Processes your AI prompts in transit.
• OpenAI — AI model provider. Receives and processes your text prompts to generate AI Load Advisor and AI Product Identification responses. OpenAI does not use API-submitted data to train its models.
• Apple (StoreKit) — Processes subscription purchases on iOS. Apple manages payment information directly; we do not receive or store your payment card details.
• Google (Google Play) — Processes subscription purchases on Android. Google manages payment information directly through Google Play; we do not receive or store your payment card details. Google Play purchase tokens are stored to verify subscription status.
• Google (Play Integrity API) — Verifies device and app integrity on Android to prevent fraud. Receives device attestation tokens and returns integrity verdicts. No personal information is shared beyond what is required for the integrity check.

We do not use any advertising SDKs or cross-app tracking technologies.

4. Data retention and deletion

We retain different categories of data for different periods:

• Account information (Firebase UID, email): Retained for as long as your account is active.
• Library items and preferences (saved bullets, disclaimer acceptance): Retained for as long as your account is active.
• AI conversation data (prompts and responses): Retained for 30 days from creation, then automatically deleted.
• AI Product Identification submissions: Retained in a staging table until reviewed, then deleted or anonymized.
• Subscription metadata (trial start date, AI query count): Retained for as long as your account is active.
• Feedback reports: Retained for as long as needed to resolve the reported issue, then deleted or anonymized.
• Rate limit data (request counts per time window): Automatically purged after 2 hours.

You can delete your account directly within the app by navigating to your account settings and selecting "Delete Account." This will permanently delete your account and all associated data, including your library, AI conversation history, and subscription metadata. You may also request account deletion by contacting us at info@scotts-guide.com.

Upon account deletion, we will delete or anonymize all personal data within 30 days, except where retention is required by law or to resolve disputes. AI conversation data that has not yet reached its 30-day automatic deletion will be deleted immediately upon account deletion.

5. Your rights

5.1 Rights for all users

All users of Scott's Guide may:

• Delete their account and all associated data through the app or by contacting us;
• Access the data stored in their account (library items, AI conversation history) through the app;
• Request a copy of their personal data by contacting us at info@scotts-guide.com.

5.2 Additional rights for EU/EEA residents (GDPR)

If you are located in the European Union or European Economic Area, you have the following additional rights under the General Data Protection Regulation (GDPR):

• Right of access — You may request a copy of the personal data we hold about you.
• Right to rectification — You may request correction of inaccurate personal data.
• Right to erasure — You may request deletion of your personal data (also available via in-app account deletion).
• Right to restrict processing — You may request that we limit the processing of your data in certain circumstances.
• Right to data portability — You may request your personal data in a structured, machine-readable format.
• Right to object — You may object to processing based on legitimate interests.

To exercise any of these rights, contact us at info@scotts-guide.com. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.

Legal basis for processing: We process your personal data on the following bases:

• Contract performance (GDPR Article 6(1)(b)) — To provide the Scott's Guide service, including account management, library sync, and AI features.
• Legitimate interests (GDPR Article 6(1)(f)) — To maintain security, prevent abuse (rate limiting), verify device integrity (Play Integrity), and improve the service.
• Consent (GDPR Article 6(1)(a)) — Where you voluntarily submit data to AI features. You may withdraw consent at any time by ceasing use of those features and requesting data deletion.

5.3 Additional rights for California residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know — You may request the categories and specific pieces of personal information we have collected about you.
• Right to delete — You may request deletion of your personal information.
• Right to opt-out of sale or sharing — We do not sell or share your personal information for cross-context behavioral advertising. No opt-out is necessary.
• Right to non-discrimination — We will not discriminate against you for exercising your privacy rights.

To exercise your CCPA rights, contact us at info@scotts-guide.com. We will verify your identity before processing your request and respond within 45 days.

6. Security

We take reasonable technical and organizational measures to protect your information from unauthorized access, loss, or misuse. However, no system can be guaranteed to be 100% secure, and you use Scott’s Guide at your own risk.

7. International data transfers

Your data may be processed in the United States and other countries where our service providers operate. Specifically:

• Cloudflare processes data on its global network, which may include servers outside your country of residence;
• OpenAI processes AI prompts in the United States;
• Firebase (Google) may process authentication data in the United States;
• PostHog processes product analytics data on its United States cloud;
• RevenueCat processes subscription and entitlement data in the United States.

Where data is transferred outside the European Economic Area, we rely on service provider compliance with Standard Contractual Clauses (SCCs) or other approved transfer mechanisms under GDPR Chapter V to ensure adequate protection of your data.

8. Children’s privacy

Scott’s Guide is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe that a child has provided us with personal information, please contact us so that we can take appropriate steps.

9. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Your continued use of Scott’s Guide after any changes take effect means that you accept the updated policy.

10. Contact

If you have questions about this Privacy Policy or our handling of your information, you can contact us at:

Email: info@scotts-guide.com