Privacy policy

What Scout does

Scout provides separate fraternity chapter recruitment workspaces. An authorized chapter administrator can connect an Instagram Business account. Scout receives accessible incoming text message events through Meta’s official API and displays those messages to authorized members of the connected chapter.

Information processed

Scout processes chapter names, account email and identity, chapter memberships and roles, Instagram account identifiers and usernames, message identifiers, sender identifiers, text, and timestamps. Its recruitment database supports potential new member (PNM) names and pipeline stages. Information supplied in messages may include student details even when Scout does not ask for them.

Connection credentials are encrypted before storage. Short-lived OAuth state is bound to the requesting user and chapter. The development demo uses fictional information in browser memory; importing simulated messages into a signed-in workspace stores fictional records in the database.

Purpose and access

Messages and PNM records support recruitment organization within the relevant chapter. Chapter members with permitted roles can read their workspace; administrators manage connections. Authorized service operators and infrastructure providers may have operational access. Supabase supplies database and authentication services; Meta supplies Instagram authorization and message delivery. Hosting also processes network requests.

The current application does not send messages, import an entire historical Instagram inbox, run AI extraction, or automatically generate PNM profiles. A message or PNM record is not proof that a person’s claims have been verified. Chapter administrators are responsible for informing people about their chapter’s use of Scout and handling appropriate requests.

Security and cookies

Scout uses authenticated sessions, chapter membership authorization, database row-level security, signed webhook validation, and server-side encryption of connection tokens. Session and OAuth cookies support sign-in and connection security. Database message text is not encrypted by Scout at the application layer. These controls do not guarantee that all security incidents can be prevented.

Scout does not intentionally log raw Instagram message payloads, authorization codes, access tokens, or secrets. Hosting and monitoring must be configured to redact sensitive request data. The current source includes no advertising SDK or AI processing service.

Retention and deletion

Proposed: retain Instagram messages and PNM records for 12 months after the relevant recruitment season ends.

This is a proposed rule, not an active automatic deletion schedule. Scout does not yet record recruitment season end dates or run a retention worker. Existing records remain until an authorized deletion occurs. Season attribution, enforcement and backup handling must be completed before this rule can be promised publicly.

Disconnecting access and deleting recruitment records are distinct operations. Disconnection removes Scout’s saved credential and stops new imports. Existing history remains under the proposed retention/deletion process; upstream permission revocation must be completed in Instagram where supported. See data-deletion instructions for available actions and their scope. Backup retention depends on infrastructure configuration; no backup-erasure deadline is promised here.

Deletion handling target: Proposed: respond to verified deletion requests within 30 days after verification, subject to applicable legal requirements. This timeline is pending operational verification.

Audience and requests

The initial pilot is intended for United States chapters, with chapter users and PNMs aged 18 or older. Age and geographic eligibility controls have not yet been implemented.

To request access, correction, or deletion, use the contact above and identify the chapter and relevant account or record. Do not send passwords, access tokens, or unnecessary copies of private conversations. Identity and chapter authority may need to be verified before a request is fulfilled. Removing data from Scout does not delete the original conversation from Instagram or copies retained by other recipients.