ScoutGPS

1. Who we are

ScoutGPS is an expedition-management and tracking support tool provided to Scout groups and similar youth organisations running supervised activities. Questions about this notice or your data: support@scoutgps.app.

2. What we collect

• Account details — your email address, a display name where provided, your group and role (administrator, group lead or viewer), and your approval status.
• Location data — GPS positions from trackers your group has configured, including live positions, historical trails and estimated positions during signal loss.
• Route data — the day routes (GPX files / route cards) your group uploads and the derived timings, distances and progress statistics.
• Device identifiers — a device cookie used to bind your sign-in to the device that opened it, and push-notification subscription identifiers if you enable alerts.
• Technical logs — basic request and position logs used to operate, monitor and secure the service.

Email accounts. Where available, volunteers should use a Scout-owned or Scout-managed email address to access ScoutGPS rather than a personal email account, so the Scout Unit can maintain appropriate control over access, account security and organisational records when volunteers change roles or leave. Where a personal email address is used, it must be an address controlled solely by the authorised user and protected appropriately.

Tracker identification. ScoutGPS does not require the names of expedition participants to be associated with GPS trackers. Trackers are normally identified using non-personal aliases such as "Tracker 1", "Alpha" or "Red". Organisations should not enter participant names or other unnecessary identifying information into tracker labels, route names or other free-text fields. The organisation responsible for the expedition may separately maintain information identifying which team or participants are carrying a particular tracker where this is necessary for managing the activity.

3. Why we process data and how we use it

• To authenticate you and keep your account secure.
• To show live tracking, route progress, timings and alerts to people authorised for the relevant expedition.
• To produce the daily timings log and end-of-day reports for review by leaders.
• To operate, maintain and secure the service, including abuse prevention and operational logs.

Location data is shown only to people authorised for the relevant expedition. It is never sold or used for advertising.

4. Controller and processor roles

Your organisation is the controller for participant and expedition information. The Scout Group, District, County or other organisation running the activity normally decides why participants are tracked, which expedition is tracked, which trackers are used, who can access the expedition, and how tracking forms part of its supervision arrangements. Where ScoutGPS processes that information to provide the service your organisation has requested, ScoutGPS acts as a processor.

ScoutGPS acts as a controller separately for information it determines the purposes of processing itself, such as user account administration, authentication, platform security, abuse prevention and service protection. The contractual arrangements between your organisation and ScoutGPS reflect the actual processing.

5. Legal basis

The organisation responsible for the expedition determines the appropriate legal basis (for example, under UK GDPR) for participant and expedition processing, which may include legitimate interests depending on the circumstances. Particular consideration is required when processing children's information. Participants and, where appropriate, their parents/carers should be properly informed that GPS tracking will be used and why.

For account, security and service-operation processing, ScoutGPS relies on its legitimate interests in operating a secure service and its legal obligations.

6. Retention

Personal information is not retained for longer than reasonably necessary for the purpose for which it was collected. Different categories may have different retention periods:

• Live / high-resolution GPS data — kept only as long as needed to operate the service and produce reports, then deleted. Where a group has set its expedition event (name and end date in the dashboard), position data is retained through the event end date plus a short review window (default 30 days) so leaders can review the expedition, then pruned automatically.
• Derived expedition timings and daily logs — kept for the group's review after the expedition.
• Account data — kept while your account is active and deleted when you (or your group lead) close it.
• Security and technical logs — kept for a defined period for security and abuse prevention.
• Incident-related records — retained only where legitimately required (for example for safeguarding incidents, accidents, emergency searches, complaints, insurance matters, disputes, or investigating system failures).

7. Sharing and service providers

ScoutGPS runs on infrastructure and services including Cloudflare (Workers, D1, KV, Email Service) and, for tracker data, the TruTrak telematics API your organisation has authorised. These providers' precise legal roles depend on their contractual arrangements with ScoutGPS and how their services operate; the controller/processor relationships are documented in the relevant agreements. ScoutGPS does not share personal data with any other third parties.

8. Security

• Sign-in uses single-use, device-bound magic links — a forwarded link cannot be used on another device.
• Sessions are signed and expire automatically; administrators and leads can approve, revoke and expire access at any time.
• Tracker credentials are stored as secrets and never returned to the browser.
• Access is role-controlled, expedition-specific and logged; transmission is encrypted (HTTPS).
• Only the minimum identifying information necessary is held — trackers use neutral aliases rather than participant names.

9. Cookies

ScoutGPS sets only cookies or equivalent identifiers necessary for authentication, maintaining sessions and account/device security: a session cookie and a device cookie that together keep you signed in on the device that opened your sign-in link. No advertising or behavioural-tracking cookies are used, and none will be introduced without reviewing this notice.

10. Your rights

You may ask for access to, correction of, or deletion of your personal data at any time. Contact your group lead or support@scoutgps.app. We will respond within one month. You may also complain to your data protection authority (in the UK, the Information Commissioner's Office).

11. Breaches

If we become aware of a personal data breach that creates a risk to individuals, we will notify the relevant organisation (and, where required, the data protection authority and affected individuals) in line with our obligations.

12. Changes to this notice

We may update this notice from time to time; the date above shows when it was last changed. Significant changes will be notified to administrators.