Privacy notice

Badges makes badge reports for young people in Scouting, from their group’s Online Scout Manager (OSM). This notice explains what personal data it handles, for leaders, young people and parents. Each Scout group is the data controller for its members’ information; Tools for Scouting processes it on the group’s behalf.

What Badges reads from OSM

A leader connects their own OSM account and chooses, in OSM, which sections Badges may see. Badges then reads, for those sections:

• Badge records: each young person’s name, six or patrol, and which badges and requirements they’ve done, with the dates and any leader’s note on where.
• The programme and events: meeting and event names and dates, which badges they cover, and who is going to an event.
• Only if the leader uses parent emails: the names and email addresses of each young person’s primary contacts 1 and 2. OSM’s permission for this also covers medical and other contact details; Badges doesn’t read them.

None of this is stored. Each report, overview and PDF is built from OSM when a leader opens or downloads it, and parents’ addresses are read at the moment of sending. So what Badges shows is always what’s in OSM, and changing something in OSM changes it here.

What Badges keeps

• Leader accounts: name and email address, used to sign in. The same account works across every Tools for Scouting product.
• Each leader’s OSM connection: the access tokens OSM issues, encrypted, and the leader’s name in OSM. Only that leader’s own sessions can use it.
• The group’s report settings: the name and logo printed on reports, and which OSM group it is.
• For each parent email: a record that it was sent and whether it was delivered or bounced, with the address partly hidden (for example s***@example.com), and which young people’s reports a leader emailed, in the group’s activity log.
• Parents who asked to stop: not the address itself, but a one-way fingerprint (hash) of it, so Badges can tell it apart from others without being a list of parents’ addresses.

Parent emails

A leader in the group can email each young person’s badge report to their primary contacts in OSM: a short summary, with the full report attached as a PDF. It comes from the group, “via Badges”, and replies go to the leader or to an address the group chooses. Before anything is sent the leader can see each email and who it will go to.

Every email has a link to stop them. It stops badge report emails from that group to that address, straight away and without signing in. To change which addresses get them, ask the group to update your details in OSM.

Who can see it

Reports are visible to the group’s members who have access to Badges, and only for the sections their own OSM account can see: OSM decides that, not us. Parent emails can only be sent by the group’s owner or leaders. Each group’s data is isolated from every other group’s at the database level, not just hidden in the interface.

Where it’s kept

What Badges keeps is stored in the United Kingdom, in Supabase’s London region, and sent over encrypted connections. The site runs on Vercel, in its London region, and emails are sent through Resend. Both are US companies, so data passes through their systems while a page is served or an email sent. Both are covered by the UK’s approved international transfer arrangements.

The walkthrough video on the home page is hosted on YouTube. Nothing loads from YouTube until you press play, and it then plays in YouTube’s privacy-enhanced mode, which sets no cookies until the video starts. Badges itself uses cookies only to keep you signed in and to remember choices such as the last section you used.

How long it’s kept

• An OSM connection, until the leader disconnects it, or OSM ends it.
• Report settings, opt-outs and the activity log, until the group is deleted.
• The record that an email was sent, with its partly hidden address, as a delivery history. Ask us and we’ll delete a family’s.

Your rights

Under UK GDPR you can ask to see, correct or delete your personal data, or object to it being used. For a young person’s or parent’s details, the group’s leaders are the place to start, since the group holds them in OSM. You can also email support@toolsforscouting.com.

This notice is a starting template. Each Scout group should review it against its own circumstances and The Scout Association’s data protection guidance.