Privacy policy

In short

• You can use it without signing in. Budgets made that way are deleted six months after they were made.
• If you sign in with Online Scout Manager (OSM), we keep your name, your OSM user id and the link to your OSM photo. Budgets you add to your account or share with your sections are kept until someone deletes them.
• Everything goes over HTTPS, sign-in details are encrypted, and edit keys are kept only as hashes.
• No adverts, no analytics, no tracking cookies. We never sell or share your information for marketing.

What we keep

Your budgets

Everything you type into a budget: the event's name, dates and description, how many people are coming, the groups paying and what they pay, the costs and income, cash flow dates and any notes. Each budget has a code (such as SCT-TD6PD5) and a private edit key. We keep only a hash of the edit key, never the key itself.

Budgets are about money, not people. Please don't type young people's names, health details or other personal information into them.

Version history

Each time a budget is saved with changes, we keep that version, when it was saved and who saved it: your name if you're signed in, or "Guest User" if you're not. To tell guests apart, your browser sends a random id, and we keep only a hash of it.

If you sign in with OSM

• You sign in on OSM's own site, so we never see your OSM password.
• We keep your OSM user id, your name, the web address of your OSM profile photo, when you first and last signed in, and which OSM sections you can see. The sections are read again from OSM each time you sign in, so if you lose access to a section in OSM, you lose its budgets here too.
• Your sign-in lasts 30 days, or until you sign out. While it lasts we keep the OSM access tokens that let the app read from OSM on your behalf, encrypted (see How it's protected).
• The app only asks OSM for permission to read events and, if you fetch actuals, to read finances. It never writes anything back to OSM.

From OSM, when you link a budget to an event

• The event's name, dates and OSM ids, and its parent portal description if a one-sentence summary is made (see Who else handles it).
• If you fetch actuals: each transaction allocated to the event, with its date, reference, description, amount and OSM category, and the budget category you put it against. A transaction's description can include the name of the person who paid. Only the budget's owner can see the transactions; people it's shared with, and anyone with the view link, see the plan only.
• To keep requests to OSM few, some of OSM's answers are kept for a short time: a section's list of events for 30 minutes, and other answers for a minute.

For running the site

If OSM ever blocks the app, we keep a record of when and why, and the request that caused it, so an administrator can put it right. We also keep the list of people allowed to clear that block. Our host, Cloudflare, keeps logs of requests to the site (including IP addresses) for a few days, which we use only to find faults and stop misuse. IP addresses are also used, without being stored by us, to limit how many requests one person can make in a minute.

What stays on your device

So the app works quickly and offline, your browser keeps:

• the edit keys of budgets you've saved in this browser, so you don't need the edit link again here;
• copies of budgets you've opened, your My budgets list and who's signed in, so they open without a connection;
• a copy of the app's own files;
• small preferences: Light, Dark or Auto, which cards you had open, and the random id described above.

Signing out deletes the budgets, list and sign-in kept on the device, after sending any saves still waiting. The only cookie is the sign-in cookie, which is set only when you sign in. None of these are used for tracking or advertising, so we don't ask for cookie consent.

Why we use it

Only to let you and your section plan, share and account for Scout events: saving budgets, showing who made and changed them, sharing them with the right sections, and matching them against what OSM says was spent. Under UK GDPR, our lawful basis is legitimate interests: Pegasus ESU and the sections using the app have a legitimate interest in planning events and keeping their money properly accounted for, and we only keep what that needs.

How long we keep it

• Budgets made without signing in are deleted automatically six months after they were made, with their version history. Saving or editing doesn't extend this. The date is shown on the budget.
• Budgets added to an OSM account (yours, or shared with your sections) are kept indefinitely, so sections keep a record of past events for their accounts and for planning the next one. They're kept until their owner deletes them with Delete budget, which removes the budget and its version history.
• Your account (name, OSM id and photo link) is kept while you use the app. Ask us and we'll delete it.
• Sign-ins end after 30 days or when you sign out. OSM's short-term answers are kept for 30 minutes at most. Cloudflare's request logs are kept for a few days.

Who can see your budgets

• Anyone with the code or view link can look at a published budget, but not change it, and doesn't see its transactions. Codes are hard to guess and the site limits how many a person can try.
• Anyone with the edit link can change it, so share that only with people who should.
• Members of the OSM sections a budget is shared with can see and edit it after signing in. A draft is seen only by the person who made it.
• Pegasus ESU volunteers who run the site can reach the database when they need to fix a fault. They don't look at budgets otherwise.

Who else handles it

• Cloudflare hosts the site and its database. Cloudflare may handle data outside the UK, under the safeguards in its data processing terms.
• Online Scout Manager (Online Youth Manager Ltd) handles your sign-in, and the app reads events and finances from it with your permission. OSM's own privacy policy covers what OSM keeps.
• Fly.io runs our OSM relay in London, which passes the app's requests to OSM from one fixed internet address. It keeps nothing it passes on, and logs only the time, which tool asked, which OSM call it was and whether it worked.
• Google Gemini, when AI summaries are switched on, writes the one-sentence description of a linked event (from OSM's parent portal description) and the summary of what changed in each version. It's sent the event description, or the changes and figures with the first name of the person who saved, never transactions. Google's Gemini API terms apply.

We don't sell or share your information with anyone else, and we don't use it for marketing.

How it's protected

• Every connection uses HTTPS, and browsers are told never to use plain HTTP for the site. The database is encrypted at rest by Cloudflare.
• Sign-in sessions are stored under a hash of your sign-in cookie, and their contents, including OSM's tokens, are encrypted (AES-256-GCM) with a key made from your cookie and a server secret. A copy of the database alone can't be used to sign in as you or to call OSM.
• Edit keys and guest browser ids are kept only as hashes. The sign-in cookie can't be read by scripts on the page.
• Every request is checked: only the owner, the sections a budget is shared with and edit-link holders can change it, and only the owner sees its transactions. Your OSM sections are checked with OSM itself at each sign-in.
• The pages load no third-party scripts, can't be framed by other sites, and run under a strict content security policy. Requests are rate limited to stop people guessing codes.
• Transactions fetched from OSM are signed by the server, so a locked budget's actuals can't be quietly changed.

No system is perfectly secure. If something went wrong that put your information at risk, we would tell the people affected and, where the law requires, the Information Commissioner's Office.

Your rights

Under UK GDPR you can ask us:

• for a copy of the information we hold about you;
• to correct it if it's wrong (your name and photo come from OSM, so change them there and sign in again);
• to delete it, or to stop or limit how we use it;
• for your budgets in a form you can take elsewhere. You can do this yourself with Export (PDF, CSV or Excel).

You can delete your own budgets at any time from the budget or from My budgets. For anything else, speak to a Pegasus ESU leader, who will pass it to the volunteers who run the site. We'll reply within one month.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.