Privacy Policy

• Account data: email address, password (hashed with bcrypt, never stored in plain text), and role (athlete, scout, or organisation). Your sign-in credential — the email and hashed password, or the Apple or Google identity you sign in with — is also held by Clerk, our sign-in provider (section 4).
• Profile data: name, date of birth, country, sport, position, gender, physical measurements (with explicit consent: section 15), sport-specific statistics, bio, and any photos or videos you upload.
• Guardian data (accounts under 16, and 16- or 17-year-olds who name a guardian): a parent or guardian's email address and, under 16, a record of their consent, collected only to satisfy COPPA and GDPR Article 8. See section 5.
• Content you create: posts, comments, direct messages between users, and shortlists.
• Athene chats: what you type to Athene. For scouts and organisations using a version of the app with an Athene chat history, each chat is saved to your account, with Athene's replies, the searches it ran and which athletes it showed (section 3). Athletes' conversations with Athene, and those of scouts and organisations on older versions of the app, are kept only on the phone.
• Organisations you invite: if you ask us to invite your club or agency to Scoutyx, the name, city and email address you give for it. The address comes from you, the athlete, not from the organisation. We email that address at most once a week, starting on the day of the first invite, until they create their page or unsubscribe, to say how many of their athletes are waiting for them. The email never names you, the address is never used for marketing, and every such email carries an unsubscribe link that stops them for good. The legal basis is legitimate interest (Article 6(1)(f)): yours, in reaching your club or agency, and ours, in letting it know its athletes want it on Scoutyx. Invite records are kept for 12 months from the invite. An address that unsubscribes is kept only as a hash, a one-way fingerprint that cannot be turned back into the address, indefinitely, so that we can honour the opt-out. If you are under 16, we ask your parent or guardian first, and the organisation is not contacted until they have approved that invite (section 5).
• Consent records: when you accept our terms, when you grant or withdraw the optional marketing permission, when you grant or withdraw the permission for AI features, and when you grant or withdraw the permission to show your physical data, we record the fact, the moment, the version of the wording you were shown, and the IP address it came from. When a parent or guardian gives, changes or withdraws consent for an account under 16, we record their name, their relationship to the child, the choices they made, the IP address and user agent (browser or device) the decision came from, and a hash of the exact text they were shown. See section 7 for why the withdrawals are kept as well as the grants.
• Payment data: handled by Stripe when you pay on our website, and by the app store you downloaded Scoutyx from if you buy inside the app. Scoutyx never receives or stores card numbers.
• Identity verification (optional): if you choose to verify your identity, your document and selfie are sent directly to Stripe and are never received or stored by Scoutyx. We keep only whether the check succeeded, a Stripe reference so we can look up a support case, and how many attempts you have used. We do not keep the document, the photograph or your document number. The date of birth printed on it replaces the one you typed. See section 6.

• Explicit consent (Article 9(2)(a)): for physical data that may concern health, such as weight or VO2 max, given by the athlete from 16 and by their parent or guardian under 16. See section 15.
• Explicit consent (Article 9(2)(a)): in versions of the app with an Athene chat history, for anything a scout or organisation writes to Athene about their own health, wellbeing or safety, which is saved with their chat and which our team may read only as section 8 describes. It is given in the app's AI permission screen with the consent for Athene below, and turning AI features off withdraws it (section 3).
• Performance of a contract — operating your account, showing your profile to scouts, delivering messages, and providing a subscription you have paid for. Without this data there is no service.
• Consent — for accounts under 16, the verifiable consent of a parent or guardian before any profile becomes visible (Article 8). Consent can be withdrawn at any time; see section 5.
• Consent — for Athene, our AI assistant, and for the automated checks of comments and other texts before they are published (section 3): we ask your permission in the app before any of your data is sent to OpenAI (Article 6(1)(a)). For scouts and organisations, the same permission covers saving Athene chats to the account. For users under 16, their guardian gives it. See sections 3 and 4.
• Consent — for marketing email and for using your content to promote Scoutyx. This one is optional, separate from everything above, and switched off unless you switch it on. Withdrawing it costs you no part of the service; see section 7.
• Legitimate interests — keeping the platform safe (Article 6(1)(f)): preventing fraud and abuse, scanning uploads for malware, rate-limiting, and reviewing reported content, including reading a saved Athene chat when a report or one of our automated checks gives us reason to look into it, for example possible misuse of Athene (section 8). We balance this against your rights and collect no more than the purpose needs.
• Legitimate interests — keeping, in a scout's or organisation's saved Athene chat, a link to each athlete Athene showed, so they can find those results again (Article 6(1)(f)). The chat keeps a link, never a copy of the profile, and an athlete who hides their profile, makes it private, blocks the scout or deletes their account drops out of it (section 3).
• Legitimate interests — telling a club or agency that its athletes have invited it to Scoutyx (Article 6(1)(f)), at the email address an athlete gave us for it. The email names no athlete, goes at most once a week and stops for good when the address unsubscribes or the organisation creates its page; see section 1.
• Legal obligation — retaining payment and tax records where law requires it.

• To operate your profile and let scouts and organisations find athletes who match what they are looking for.
• To power Athene, our AI assistant. Athene uses an AI model to work out what a search is asking for — it never invents athlete data, and every athlete it shows comes from our own database. The model receives the message you type and the earlier messages in that conversation. When a scout or organisation asks Athene to compare athletes, the model also receives each athlete's sport, position, country, age, dominant side, years of experience and latest season statistics, labelled “Athlete A”, “Athlete B” and so on rather than by name, and writes a short comparison. For athletes on the Elite plan, Athene's coaching answers are written from the athlete's own messages and their own sport, position, age, dominant side and years of experience. Body measurements and fitness figures such as height, weight or VO2 max are never sent to the model. What you type yourself is sent as written, so do not include another person's health information in it, and if you are an athlete, or a scout or organisation on an older version of the app, do not include your own either. AI outputs are information and suggestions only. Automated content checks can stop a comment or post from being published if it appears harmful; you can edit it and try again, or contact support@scoutyx.com if you think it was blocked by mistake. AI features and content checks never suspend accounts. Decisions taken automatically after identity verification are explained in section 6. The automated content checks cover comments, organisation posts, staff profiles, milestones, trials, endorsements and club invitations. Without permission for AI features you can still use Scoutyx, but you cannot use Athene or publish these texts. Athletes are only included in Athene comparisons if they have allowed AI features (or, for users under 16, their guardian has). For users under 16, AI features require their guardian's permission.
• Saved Athene chats (scouts and organisations). In versions of the app with an Athene chat history, Athene saves each of your chats to your account, so you can pick it up again on any device: what you type, Athene's replies, the searches it ran and which athletes it showed. The athletes are kept as links to their profiles, never copies of them, and the written comparison of athletes is not kept: when you reopen a comparison, you can ask Athene for a new one. The text of your chats is stored encrypted. When you reopen a chat, each athlete is shown as their profile is now and under the same visibility rules as a new search: an athlete whose profile has since been hidden or made private, who has blocked you, or who has deleted their account no longer appears, and deleting an athlete's account deletes the links to them. Anything you write to Athene about your own health, wellbeing or safety is saved with the chat, under the explicit consent you give in the AI permission screen (section 2). Each chat is kept until you delete it or all your chats, turn AI features off or delete your account; our database backups keep it for up to 30 days after that. You can delete a chat, or all of them, in the app at any time, even after your plan ends. Our team can read a saved chat only as section 8 describes, and saving your chats sends nothing more to OpenAI. An athlete's own conversations with Athene, and those of scouts and organisations on older versions of the app, are not saved on our servers: they stay only on the phone and are cleared at log out. When a scout or organisation first uses a version with the chat history, the conversation an earlier version kept on that phone is deleted; it is not sent to us.
• To send transactional email: email confirmation, guardian consent, password resets, and security notices.
• To process subscription payments.
• To detect and prevent abuse, fraud, and breaches of our terms.
• To understand how the app is used, so we can improve it (product analytics; see PostHog in section 4).

We do not sell your personal data. We do not use your profile data to train AI models, ours or anyone else's. We do not run third-party advertising.

We use these providers to run Scoutyx:

• Railway (EU region) — application hosting, database, and storage of uploaded photos and videos.
• Vercel — hosting for this website, and statistics about visits to it (pages viewed, referring site and device type), with the private codes in emailed links removed from the addresses it records.
• Clerk — sign-in for scoutyx.com and the app. It holds your email address, your password in hashed form (never readable, by us or by Clerk), and, if you sign in with Apple or Google, the identifier those providers give us. Clerk also keeps a log of your sign-ins with the internet address and browser or device each one came from, to protect your account. It holds nothing about your role, your plan, your age or any guardian.
• Stripe — subscription payments and optional identity verification (section 6). Where you verify your identity, Stripe receives your document and selfie directly and acts as an independent controller for that check under its own privacy policy.
• RevenueCat — handles subscriptions bought inside the app, so the plan unlocks on your account. On iPhone, the app connects to RevenueCat with your Scoutyx account ID when you sign in, whether or not you buy anything. It receives your account ID and the App Store's purchase record, never card details.
• PostHog — product analytics in the app: which screens are opened, when the app is opened and closed, and some actions such as starting an upload or completing a registration step. Once you are signed in, events are linked to your Scoutyx account ID with your role, plan and account status only — never your name, email, date of birth or anything you type. We do not collect it from signed-in users under 18, or from anyone we cannot confirm is an adult. Before you sign in, the app records usage without linking it to an account.
• Resend — delivery of transactional email.
• OpenAI Ireland Ltd., which may process data in the United States through its affiliate OpenAI OpCo, LLC — the AI model behind Athene, receiving what section 3 describes, and automated checks of comments, organisation posts and some other texts for harmful content before they are published.OpenAI acts as our processor under a data processing agreement and processes this data only to provide these features, on our instructions. It does not use data sent through our integration to train its models, and may retain it for up to 30 days to monitor for abuse, after which it is deleted unless the law requires longer retention. Transfers to the United States are protected by the European Commission's Standard Contractual Clauses between OpenAI Ireland Ltd. and its affiliates outside the European Economic Area, and by OpenAI's certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions). OpenAI is contractually bound to protect your data to the same or an equal standard as this policy. We ask for your explicit permission in the app before any of your data is sent to OpenAI. For Athene and for the content checks, the legal basis is that consent (Article 6(1)(a) GDPR). The permission in the app covers both. You can withdraw it at any time in Profile → Settings → Privacy → AI features (OpenAI). If you are under 16, your parent or guardian decides; they can withdraw it from the link in their confirmation email, which withdraws their consent to the whole account, or by writing to support@scoutyx.com. Withdrawing does not affect processing that took place before. If you are a scout or an organisation, withdrawing it also deletes your saved Athene chats (section 3).
• Sentry — error reports from the app and our servers, so we can fix faults. A report can include your Scoutyx account ID.
• Expo, with Apple — delivery of push notifications to your phone (on Android, see section 14). A notification can name the person who acted, for example who viewed your profile.
• Google — if you choose to sign in with Google, Google tells us your name and email address.
• Apple — if you choose to sign in with Apple, Apple tells us your name and email address, or a private relay address that forwards to you if you choose to hide your email.
• MailerLite — the email list of the waiting list we ran before launch. If you joined it, your address is there, and we ask MailerLite to erase it when you delete your Scoutyx account.

When you buy a subscription inside the app, the app store you downloaded Scoutyx from sells it to you and handles the payment as an independent controller, under its own privacy policy. We learn whether your subscription is active, never your card details.

Some of these providers process data outside the European Economic Area, among them OpenAI, through its affiliate in the United States.

Your profile is not visible to other users until your account is active — and, if you are under 16, not until a guardian has given consent.

Scoutyx welcomes athletes from 13. COPPA applies in the United States to users under 13 and GDPR Article 8 applies in the EU to users under 16. We do not open accounts for anyone under 13: such a sign-up is refused and nothing about the person is kept, only an anonymous record of the refusal (time, country, reason). Rather than track the Article 8 threshold per country, we ask for a parent or guardian's consent for everyone under 16, the highest age Article 8 allows.

This is what actually happens when someone under 16 signs up:

• The account is immediately placed in a restricted state. It does not appear in search or in Athene results, no scout or organisation can see it or make contact, and the account cannot post or send messages.
• We ask for a parent or guardian's email address and send them a verification link.
• The guardian confirms who they are and their relationship to the child and gives consent on a form on this website. No payment, card check or identity document is involved. Two consents are required to open the account: processing the child's data to provide the service, which is a sports profile with photos and videos visible to clubs and scouts on Scoutyx; and, in a box of its own, the child's physical data (section 15). Whether the child can use AI features is optional and decided separately.
• After consent the account opens and the profile is visible straight away to clubs and scouts, inside Scoutyx. We do not review profiles before they become visible; our team reviews profiles and content that are reported.
• The profile of anyone under 18 is seen only inside the Scoutyx app by people signed in to an account. It is never shown on a public page of our website, never offered to search engines, and a shared link to it opens our download page, so a link preview shows nothing of the profile, its data or its photos.
• If your child asks to show a club, academy or agency on their profile, we email you about that one link and it appears nowhere until you approve it. You can decline, and you can end a link you approved at any time from the withdrawal link we emailed you. The organisation is not told the request exists until you have approved it.
• If your child invites a club, academy or agency that is not on Scoutyx yet, we email you about that one invite, and the organisation is not contacted until you approve it. If you approve, the organisation receives an email saying that one of its athletes is looking for it, without your child's name, sport, age or photo. If you decline, the invite is deleted, and a request nobody answers is deleted after 30 days. You can withdraw an approval at any time from the link in that email: the invite then stops counting in any later email, though emails already sent cannot be recalled. If the organisation joins Scoutyx while the request is still waiting, we ask you instead about the link with it, once. Athletes aged 16 and 17 are counted straight away, and are never named either.
• We do not show a minor's email address, and profiles have no field for a phone number or home address. Scouts are the only users who can send an athlete a private message, and only inside the app. No scout or organisation can message an athlete under 16, with or without a guardian's consent. From the athlete's 16th birthday messages stay off until the athlete switches them on themselves (where a guardian answered a messaging question on an earlier version of the consent form, that answer is the starting point), and from then on the athlete can change it. Messages can be blocked and reported. Text that users write themselves, such as a bio, a post or a message, is not checked for contact details.

If you are 13 to 15 and in Australia, you cannot open an account, even with a guardian's consent. To apply this, at sign-up we read the country you give and, without storing them, the country of your IP address, your device region and your time zone. If a sign-up is refused we keep only an anonymous record (time, country, reason).

Where a club or agency link is shown, a young person under 18 is named only to their friends on Scoutyx, to the organisation itself, and to scouts who have verified their identity. Their friends can therefore see which club they train at, including on the organisation's own page, which counts them among its athletes. Everyone else sees the count without the name.

Athletes aged 16 and 17 sign up without a guardian's consent. They can name a guardian, who then receives a notice that the account exists.

A guardian can withdraw the optional AI permission on its own, or their consent altogether (withdrawing the consent to physical data counts as this, since the account needs it; the visible profile is part of the consent itself), at any time from the permanent link in the consent confirmation email, and can ask us to delete the account and its data by emailing support@scoutyx.com. We act on this without requiring a reason.

Any adult account can choose to verify its identity and display a verified badge. It is entirely optional — nothing on Scoutyx requires it, and choosing not to verify changes nothing about how your profile works.

The check is carried out by Stripe Identity. You photograph a government document and take a selfie on a page hosted by Stripe, and that material goes to Stripe directly. It does not pass through Scoutyx, it is not stored on our servers, and it is not written to our logs.

What Scoutyx receives and keeps:

• whether the check succeeded;
• a Stripe reference for the check, so we can look up a support case if you contact us;
• how many attempts you have used, and how you paid;
• the date of birth printed on your document. When the check succeeds and the date can be read, it replaces the date of birth you typed and can no longer be changed.

What Scoutyx never keeps:

• the image of your document, or the selfie — we never receive these at all;
• your document number, nationality or expiry date as printed on the document — we never receive these either;
• the name and address Stripe verified. These do reach our server, in the same response that carries the one field we asked for: Stripe returns them together and offers no way to request one alone. They are not read, not written to our database and not logged — the response is discarded as soon as the age check is done. We would rather say this plainly than claim a tidier thing that is not quite true.
• the reason a check failed.

Why we read the date of birth. Identity verification is not available to anyone under 18. Until this check, the only date of birth we hold is the one you typed in yourself. A government document is the one date nobody chose, so it becomes the date of birth on your profile. If it shows you are under 18, we refuse the badge and return your payment where we are able to.

Decisions taken automatically. Depending on the date of birth on the document, these follow without a person deciding:

• An account that appears to belong to someone under 13 is erased, because no one under 13 may hold an account.
• A scout or organisation account, which only adults may hold, is suspended if the document shows its holder is under 18, and erased after 30 days.
• An athlete under 16 moves into the guardian consent process described in section 5. That is not a penalty: it means the parental consent this platform is legally required to obtain was never obtained, and we are asking for it now.
• An athlete aged 16 or 17 is refused the badge, and nothing else about the account changes.

If you think a decision was wrong, write to support@scoutyx.com and a person will review it. For suspended accounts, write within the 30 days before erasure.

Stripe acts as an independent controller for the verification itself and holds the document under its own privacy policy and retention schedule. When you delete your Scoutyx account, we ask Stripe to redact your verification, including the images of your document and your selfie; if a redaction cannot be confirmed, our team follows it up with Stripe. You can also ask Stripe directly; email support@scoutyx.com and we will point you to the right place.

Everything in this section is optional and switched off until you switch it on. Nothing about the service changes if you leave it off: no feature is withheld, your profile is not ranked lower, and scouts see you exactly the same either way.

What you are agreeing to, if you agree.

• Email from us that is not transactional — news about Scoutyx, offers, opportunities and events. Transactional email (confirming your address, guardian consent, password resets, security notices) is not part of this and continues either way, because it is how the service works.
• Letting Scoutyx feature your profile, your content or your achievements in its own promotion: on our website, our social media accounts, in app-store material, in press, or in paid advertising. The terms of that permission are in section 9 of our Terms of Service.

Where you say yes or no. There is an unticked box on the registration screen where you accept the Terms, and a switch afterwards in Profile → Settings → Privacy. The box is never pre-ticked and ticking it is never a condition of creating an account — a box you must tick to proceed is not a choice, and under GDPR Article 4(11) it would not be consent.

Nobody under 18. This is not a setting a minor can get wrong. The option is not shown to an account under 18, and our servers refuse to record it for one however the request arrives. If you registered as a minor, the question is simply never put to you until you turn 18 — and turning 18 does not switch anything on. We ask you once, and if you do not answer, the answer stays no.

Withdrawing. The same switch, any time, no reason needed, no penalty, and no part of the service withheld for it (GDPR Article 7(3)). New promotional use stops from that moment. Material already published cannot always be recalled — printed material in particular — but we remove what is still in our control and we do not reuse it.

What we record, and why we keep it. When you grant or withdraw this permission we store the fact, the moment, the version of the wording you were shown, and the IP address the decision came from. We keep the withdrawals as well as the grants, in a log that is only ever added to. That is deliberate: Article 7(1) requires us to be able to demonstrate that consent was given, and a record we overwrite every time someone changes their mind could not demonstrate anything. It also protects you — it is the evidence of what you actually agreed to, and when.

This record is kept for as long as your account exists and for 3 years after it is deleted, as proof of what you agreed to. It is not used for anything else: not for profiling, not for advertising targeting, and it is never shared. You can ask for a copy of it under section 9.

What this is not. We do not sell your personal data, we do not license your content to other companies for their advertising, and we do not run third-party advertising inside Scoutyx. This consent covers promoting Scoutyx, and nothing else.

Posts, comments, profiles and direct messages are created by users, not by us. Every post and every profile carries a report and a block option in the app.

• Blocking takes effect immediately and works in both directions: a blocked user cannot contact you, and you no longer appear to each other in search or in feeds.
• Reports go to a moderation queue that our team reviews. We may remove content, restrict, or delete an account that breaks our terms.
• Photos and videos added to profiles, posts and stories are scanned for malware before they are published, and one that fails the scan is never served. Photos and voice notes sent in messages are scanned too, and are shown to the recipient only after they pass. The scan looks for malware only.
• Saved Athene chats are private to the scout or organisation that owns them. Our team can read one only when a moderation case gives us reason to look into it, for example possible misuse of Athene: a case about that account (a report, or a flag raised by our automated checks) or about one of Athene's replies in the chat that its owner reported. Only administrators can open it, in our moderation tools, read only, and only after writing down why. They see what was written (which may name an athlete), Athene's replies and the searches, and how many athletes were shown, but not which ones. Every read is logged with who read the chat, when, which part of it and why, and the log is kept for 2 years. The only other time our team handles saved chats is to send you a copy of your data that you asked for (section 9).

Reports about a user under 18, and reports marked as a child safety concern, are emailed to our team as soon as they are made. If you believe a minor is at risk, email support@scoutyx.com as well as reporting in the app.

You can request a copy of your data, ask us to correct it, ask us to delete it, object to processing, or ask for it in a portable format. EU and UK users have the full set of GDPR rights, and you may also complain to your national data protection authority.

You can delete your account yourself, from Profile → Settings → Delete account in the app or, without the app, at scoutyx.com/delete-account. For anything else — including a parent or guardian asking us to remove a minor's account — email support@scoutyx.com. We reply within 30 days, usually much sooner.

We keep your data for as long as your account exists. When you delete your account it is closed and hidden straight away, and the profile, media and personal details are erased or anonymised 7 days later, and never more than 30 days later.

Some records are kept after that, each for a limited time: payment records where tax and accounting law requires it, records of consents, and reports made about an account. Messages you sent are replaced by "[deleted]" and shown as from "Deleted user"; the other person keeps their own messages. The account deletion page lists what is kept and for how long.

An invite you send to a club or agency is deleted 12 months after you send it, and an under-16's invite that their guardian has not answered is deleted after 30 days. An address that unsubscribed from our invite emails is kept as a hash indefinitely, so that the opt-out holds.

Saved Athene chats of scouts and organisations are kept until their owner deletes them, turns AI features off or deletes the account (section 3). The record of each time our team read a saved chat is kept for 2 years (section 8). Our database backups are overwritten after 30 days, and backups of photos and videos after 90 days, so something deleted can stay in a backup until then.

Passwords are hashed with bcrypt and never stored in a readable form, by us or by Clerk. All traffic uses TLS. Access tokens on mobile are held in memory only, never written to disk, and are short-lived; the token that renews them is kept in the phone's secure storage and replaced every time it is used. Where Clerk provides the sign-in, the session is a short-lived token Clerk renews while you use Scoutyx, and signing out ends it. Uploads are scanned for malware, as section 8 describes. Authentication endpoints are rate-limited.

Cookies. scoutyx.com sets only the cookies needed to keep you signed in, and one more after a refused sign-up: our own session cookies, Clerk's sign-in cookies where Clerk provides the sign-in, and, if a sign-up is refused for age under the Australian rule in section 5, a session cookie (sx_age_check, value 1) so the refusal applies for the rest of that browser session. If a sign-up is refused because the person is under 13, the browser's own storage keeps the time of the refusal, and nothing else, so a second attempt meets the same answer. All of these are strictly necessary for the service you asked for and are not used for advertising or to follow you across other sites. The visit statistics in section 4 use no cookies.

No system is perfect. If you find a security problem, please report it to support@scoutyx.com and we will act on it.

We update the date at the top of this page whenever it changes, and we will tell you in the app before a material change takes effect.

The controller of the personal data described in this policy is:

Operator:

Scoutyx B.V.

Chamber of Commerce (KVK):

42162651

Registered office:

Weena 23 C, 3013 CB Rotterdam, Netherlands

Phone:

+34 722 189 550

Contact:

support@scoutyx.com

Legal notices:

support@scoutyx.com

For any question about this policy, your data, or a request to exercise the rights in section 9, email support@scoutyx.com. We reply within 30 days, usually much sooner.

If you are in the EU or the UK and are not satisfied with our answer, you may complain to your national data protection authority. Scoutyx B.V. is registered in the Netherlands, so our lead authority is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens); you may always complain to the authority where you live instead.

• Subscriptions bought inside the Android app are sold by Google (Google Play), which handles the payment as an independent controller under its own privacy policy.
• Push notifications on Android are delivered through Google's Firebase Cloud Messaging.

The figures an athlete adds to their profile about their body and fitness may be data concerning health under Article 9 of the GDPR. They are: height, weight, wingspan and every reach, top speed and sprint times, jumps, beep-test level, VO2 max, power and FTP, rowing-ergometer times, a weight class or weight category, racing weight, power-to-weight ratio, training load, and injury and recovery status. Match and competition figures (goals, minutes, rankings, race results) are not on this list.

• Legal basis: explicit consent (Article 9(2)(a) GDPR), given in a box of its own, separate from every other consent.
• Required to open an athlete account: Scoutyx is a sports scouting platform built on these figures, so an athlete account does not open without this consent. For an athlete under 16 it is given by their parent or guardian on the consent form; from 16, by the athlete when they sign up (an athlete who signed up before it existed is asked when they next open the app, and cannot continue without answering). Scout and organisation accounts are not asked.
• Who sees them: anyone signed in to Scoutyx who can see the athlete's profile (other athletes, scouts and organisations), and scouts and organisations can search and filter by them. Athletes under 18 appear in searches filtered by these figures only for scouts and organisations whose account is verified (a scout's identity checked with a document, an organisation verified by Scoutyx). The profile of an athlete under 16 is visible only if their guardian allowed it.
• What never happens: these figures are never sent to OpenAI or to any other AI provider, and no automated decision is taken from them.
• Withdrawing: as easy as giving it, at any time: an athlete from 16 in Profile > Settings > Privacy; a guardian from the permanent link in the consent confirmation email. Because the account needs this consent, withdrawing it works like withdrawing consent to the account: the figures stop being shown at once, the account is hidden and closed, and it is deleted 30 days later.
• Searches that return minors: each time a search filtered by these figures returns an athlete under 18, we record the account that searched, when, the filters it used and how many athletes under 18 it returned (not who they were). We keep this record only to detect and investigate misuse, never for anything else, and delete it automatically after 12 months. The legal basis is our legitimate interest, and the athletes', in protecting minors on the platform (Article 6(1)(f)). A scout's or organisation's own saved Athene chats are separate from this record: they keep links to the athletes their searches showed (section 3).

Each grant and withdrawal is recorded with its date, the version of the wording shown and, for a guardian, who decided (section 1).