Privacy

Your stills stay on your machine.

Last updated October 31, 2026

Scout Composer runs in your browser. The photographs you bring into it, the frames you draw, the crops you export and the project files you save stay on your device. They are never uploaded to us or to anyone else, unless you choose Publish for review for a web deck. Then only that deck's frames are uploaded, and only until the review closes.

This page lists everything Scout Composer keeps, and everything it sends anywhere, with why and for how long. If that changes, this page changes with it.

What we keep, and why

Your email from earlier visits. Until October 20, 2026, opening the app from this site asked for your email address and what you were scouting for. Answers given then are kept, with the time you gave them, so we can tell you when the app changes and see who is using the beta. They don't expire on their own; see Removing your email. The front page no longer asks.

Your early-access request. When you use Ask for access on the front page, we get one email with the name, address and note you typed, so we can add you to the early-access list. The site itself keeps nothing from the form. The internet address a request comes from is used only to limit how many can be sent, a few every ten minutes, and that count is gone within the hour. Requests and approvals made before October 20, 2026 are kept until they're removed.

Feedback you send. The Feedback button, in every view, sends what you write, your 1 to 5 rating if you give one, and a little context: the app version, the view you opened it from, how many photos and checked formats you had, your window size, which browser and system you're using, and the time. When the app knows your sign-in, the form says so, and every note goes with that email, so we can write back if something needs a closer look. Otherwise the form has a box for an email, which you can fill in or leave empty. We keep each note, and a copy is emailed to us. Notes don't expire on their own. No photos, file names, project titles or locations are ever part of one.

The internet address a note comes from is used only to count notes, five an hour at most, and that count is gone after an hour. It is not kept with your note.

Signing in

Sign-in is handled by Cloudflare Access, part of Cloudflare, which hosts this site. It emails a short code to the address you give, and keeps you signed in with its own cookie. Cloudflare sends a code only to addresses on our early-access list. Scout Composer uses the address you signed in with to put it on your feedback and to keep it with any review you publish.

Lookups, only when you ask

Finding an address. If you type an address to place a photo, that text (and nothing else) goes to our lookup service, which asks OpenStreetMap's Nominatim service where it is. Nominatim hears from our service, not from you. The answer is kept for 30 days under that address, so the next lookup is quicker. It isn't linked to you.

Finding the nearest hospital. Find nearest hospital, on a Location card, sends only that place's location, rounded to about 100 m, to our lookup service. It asks the public OpenStreetMap Overpass servers (overpass-api.de, or overpass.private.coffee when the first is busy) for the nearest hospitals with an emergency department. The answer is kept for 30 days under that rounded point. If those servers are too busy to answer, the same rounded point goes to OpenStreetMap's Nominatim service instead, and that backup answer is kept for 1 hour. No photos or project details are sent.

Map data © OpenStreetMap contributors.

Weather near the shoot day

Weather heads-up. When a project has a shoot date within 10 days and a place, that place's location rounded to about 1 km and the shoot date go to our lookup service, which asks MET Norway's forecast service. The answer is kept for up to an hour under that rounded point and date. No photos or project details are sent. A switch in Project Info turns it off.

The forecast is saved in your project with the time it was fetched, so it shows when you are offline. If you publish a review with crew pages, the crew's page for the setup shows the forecast as of that time, with the place's name, or a point rounded to about 100 m when the place has no name. Weather data from MET Norway (api.met.no), under the Norwegian Licence for Open Government Data and CC BY 4.0.

Publish for review, only when you choose it

A web deck can go out two ways. Exporting it to a file (a folder or a .zip) happens on your device and sends nothing to us. Publish for review puts the deck on a private link at scoutcomposer.com, so reviewers can open it on any screen and their notes come back to your Responses as they leave them. Nothing is published until you choose it, and only the deck you publish goes. Publishing follows the Publishing terms, which the app asks you to agree to once.

What we keep. The frames in the deck you publish, and the deck's own page: its title, its scene headings and the details you chose to include, such as camera and lens, location and sun, stand-ins or lighting. Your original photos and the rest of your project stay on your device. With the review we keep the email you're signed in with, so only you can change it or take it down, and the emails you invite. If you choose a passcode, we keep it only in a scrambled form that can't be read back. Your own copy stays in your project, so you can see it again. When you agree to the Publishing terms, we keep a record of it: your email, the version of the terms and the date.

What reviewers leave. The name they type, and their role if they give one. Their keep, maybe or cut on each frame, their notes, and Wider or Tighter where they ask for it, each with the time it was left. On a review for invited people, the email each reviewer confirmed with a code. And when each reviewer last had the page open, so you can see who is reading now.

Where. All of it is kept in Scout Composer's own storage at Cloudflare, which hosts this site.

Who sees it. Only people who have the link and pass the check you chose: the link alone, a passcode you share, or a one-time code sent to an email you invited. Reviewers see the frames, each other's names, roles and notes, and who else has the page open. They never see each other's emails, or yours. You see everything they leave, in Responses. The link is long and random, and its pages ask search engines not to list them.

How long. Until the date you chose under Open until (30 days unless you pick another date, up to 90 days ahead), or until you take it down from Responses, whichever comes first. Take down deletes the frames at once. When the date passes, the review closes and its frames are deleted overnight. A publish that never finishes uploading is deleted after a day. We keep frames and notes longer only when the law requires it, for example to respond to a legal notice.

Reviewers' names, notes and emails are kept 14 more days after a review closes or is taken down, so you can open your project and bring in the last notes. Then they are deleted. Every note already in your project stays there. A short record of each review then stays, with its title, its dates and your email but none of its frames, notes or reviewers, so we can look into a report about it later.

The crew. After the director and you have signed off, you can bring in your crew by department. We then keep, for that review, each crew member's name or the email you typed, their department, and the questions and notes they write. The department pages they read are made from your project: the sun at your call time, power from your lighting plan, access, hazards, the nearest hospital and the day's sun times, for the setups you and the director kept. They read, add notes and ask questions; they cannot choose frames. They follow the same rules as everything else here: until you take the review down or its date passes, then 14 more days for the names, notes and emails.

The code emails. On a review for invited people, each reviewer gets a one-time code from [email protected], sent by Cloudflare. It goes only to an email on that review's list, and holds the code and the deck's title, with no links. The code works for 10 minutes. We keep only a scrambled form of it, cleared once it runs out. Your own invitation is never sent by us: Send by email opens it in your own mail app.

Note emails. When reviewers leave notes on a review you published, we email you a short summary from [email protected]: who left notes and how many, with no note text and a link to the app only. It comes after a reviewer has been quiet for about 5 minutes, at most once every 3 hours for each review, and once more after it closes on its date if notes came in since. Notes you already brought into the app are left out. Turn it off in the Publish dialog or in Responses.

On the reviewer's side. A review link sets cookies for that review only: one for half an hour after the passcode or code, while the reviewer types a name; one that remembers who they are until the review closes, so they aren't asked again; and one that lets the frames load, renewed every hour. The page also keeps their notes in their own browser as they write, so nothing is lost if the connection drops.

The internet address a reviewer comes from is used only to count tries at a passcode, a code or a name, so nobody can guess their way in. Each count covers an hour at most and is cleared overnight. It is not kept with the notes.

Reporting a review. Every review page has Report this review, which opens an email to [email protected]. If a review misuses the service, we take it down the same way, and we may pause publishing for the account that published it.

Deleting it sooner. Take down, in Responses, deletes the frames at once. To have a review's notes, names and emails deleted before the 14 days are up, write to [email protected] with the review's link. If you left notes on someone's review and want your name and notes removed, write to us the same way. Notes the person who published it has already brought into their project live in that project, on their own device.

Only when AI is on

AI is off in a project until you turn it on. With it off, none of this runs.

AI talent. Stand-ins can use Scout Composer's AI talent pictures in place of silhouettes. Those pictures come from this site. Nothing about your photos is sent anywhere.

Mock-ups. Mock-up, in the Scenes list, writes a text prompt from your frame, your lens and your own words, on your device. You can copy it and take it to Google Flow, Kling or Runway yourself. Scout Composer sends nothing to those services, and they have their own privacy terms. A mock-up picture you bring back stays with your project, on your device.

Hide behind objects (beta), in Stand-ins, is separate from the AI switch and stays off until you tick it. It works out depth from your photo on your own device, with a model this site sends the first time you use it. Your photo is not sent anywhere.

Dictation

Dictation uses your browser's built-in speech recognition, which may send your voice to your browser's maker to turn it into text, under that company's own terms. Nothing you say is sent to us, apart from the words you choose to send.

What stays on your device

Your projects. Scout Composer keeps your 12 most recent projects in this browser (settings, notes, previews of your photos up to 3840 pixels wide, mock-up pictures and room scans) so you can pick up where you left off from Projects. Removing a project from Recent removes this browser's copy of it, and clearing your browser's data for this site removes them all. Browsers can also clear what a site stores on their own, so save your project as a file now and then.

Your email. To skip the sign-in form next time, this site remembers your email in your browser. The app shows it, and notes it as the author inside project files you save. Those files live wherever you put them, and travel with whoever you hand them to. Choosing Not you? on the sign-in page clears the remembered email.

Your request. While you wait for early access, the sign-in page remembers your request in your browser, so it can keep checking for you and pick up where you left off. It's cleared once you're in, or when you choose Not you?.

Your settings. Preferences like units, views and your AI choice are kept in your browser, and so is a Feedback note you haven't sent yet, until you send it. Sun times, time zones and all the frame math are worked out on your device.

How we see the site is working

Cloudflare Web Analytics, part of Cloudflare, which hosts this site, adds a small script from Cloudflare to each page. It sets no cookies and doesn't identify you. It records the page, the page you came from, how long it took to load, your browser and system, and your country, so we can see how the site is doing during the beta.

What we don't do

No advertising trackers, no third-party cookies. Apart from that one Cloudflare script, the app's code, fonts and pictures all come from this site. Cloudflare also records ordinary request logs (address, time, page) as any host does.

Links you choose to open, like Open in Maps or a setup's map pin (both open Apple Maps), take you to that site under its own terms.

Removing your email

Write to [email protected] and we'll remove your email from our list and your early-access record, along with any feedback you've sent and any reviews you've published, with everything in them. We keep only the record that you agreed to the Publishing terms (your email, the version and the date), so we can show what was agreed.

Who we are

Scout Composer is made by Rebirth Productions LLC. Questions about any of this: [email protected].