Privacy notice

This notice describes the personal data ScoutDNA holds about people who hold an account. It is a description of how the software behaves. It has not been reviewed by a lawyer, and it does not assert compliance with GDPR, KVKK or any other regime. An operator deploying ScoutDNA commercially should have it reviewed against their own obligations.

• Account details: name, email address, and optionally the club or organisation you enter.
• A password, stored only as a scrypt hash. The password itself is never stored and cannot be recovered from the hash.
• Session records: a hash of your session token, its expiry, and the IP address and browser user agent at sign-in, used to let you review and end your own sessions.
• Your own content: watchlists, shortlists, saved searches, notes and scouting reports.
• Authentication and administrative events in an audit log, which records who did what and when.

There is no analytics or advertising tracking in this application, and no third-party script runs on these pages.

• Passwords in plain text, at any point, including in logs.
• Session tokens. Only a hash is stored, so a copy of the database yields no usable sessions.
• The content of your private notes. The audit log records that a note changed, never what it said.

Player data in ScoutDNA describes footballers in a professional capacity and comes from the configured data source. Where no licensed source is configured, the players shown are invented sample records and do not describe real people.

• Sessions expire after seven days and expired rows are deleted by a scheduled job.
• Password reset tokens expire and are deleted on the same schedule.
• Audit log entries are kept for one year, then deleted automatically.
• Your account content is kept until you delete it or close your account.

You can change your details, end your sessions and close your account from your account settings. Closing an account revokes every session immediately and removes your personal details. Content you created may be retained in anonymised form where an operator has a legal reason to keep it.

One cookie is set: a session cookie that keeps you signed in. It is httpOnly, so page scripts cannot read it, and it is marked Secure in production. There are no analytics, advertising or third-party cookies, which is why this site has no cookie banner asking you to accept any.