Privacy Policy

Effective October 26, 2026

This policy explains what personal data Scrounge collects, why, who it is shared with, and the choices you have. Scrounge is operated by ? ("we", "us"), ?, United States. Questions: legal@opossumware.net.

What we collect

• Account data: your email address, an optional display name, your plan, and when you created your account and last logged in.
• Login data: one-time login codes (stored only as a hash and deleted within a day) and a session cookie that keeps you logged in for up to 30 days.
• Your content: boards and everything on them: notes, spun words, drawings, and images you upload or add from a link. When you add an image from a link, our server downloads it from that site.
• Sharing data: when you invite someone to a board, their email address, who invited them, and when. When someone accepts, we record that they are on the board.
• Subscription data: if you buy a paid plan, we receive your subscription's status, plan, renewal and end dates, and a link to manage it from our payment provider. We never see or store your card or bank details.
• Technical data: your IP address, used in memory to limit login attempts and stop abuse. Our web server also keeps an access log of each request: the time, your IP address, the page requested (without query strings, IDs, or invite links), the response status and size, and how long it took. It does not record cookies or other request details. When something goes wrong, the app's error log may also note details of the failed request, such as your email address.

We do not use advertising, analytics, or tracking cookies, and we do not track opens or clicks in our emails. The only cookie is the session cookie, which the site needs to work.

How we use it

• To provide Scrounge: log you in, save and show your boards, and apply your plan's limits.
• To send login codes, board invites you ask us to send, and essential messages about your account or subscription.
• To keep Scrounge secure, prevent abuse, and enforce our Terms.
• To keep Scrounge running: find and fix errors, and watch for outages and unusual traffic.
• To meet legal obligations, such as responding to valid legal requests and reporting child sexual abuse material to NCMEC.

We do not sell your personal data, share it for advertising, or use your content to train AI models.

Shared boards

Boards are private until you share them. When a board is shared:

• Everyone on it can see and change everything on it, including what others added.
• Everyone on it sees the others' names (your display name, or the part of your email before the @) and who has the board open right now.
• The board's owner sees the email addresses of the people they invited.
• What you add to someone else's board stays on it if you leave, and counts toward the owner's storage.

Who we share it with

We use these service providers, who process data only on our instructions:

• netcup GmbH: server hosting. All data is stored on servers in Manassas, Virginia, USA.
• Resend: sends login code and invite emails (receives the recipient's email address and the message).
• Lemon Squeezy: our reseller and merchant of record for paid plans. They handle checkout, payment, tax, and invoices under their own privacy policy.

We may also disclose data if the law requires it, to protect the rights or safety of our users or others, or as part of a sale or transfer of the service (in which case this policy continues to apply).

How long we keep it

• Account data and content: until you delete them or your account.
• Login codes: deleted within 24 hours. Sessions: deleted when they expire (30 days) or when you log out.
• Invites: deleted when accepted or revoked, or within a day of expiring (they last 14 days).
• Subscription records: while your account exists. Lemon Squeezy keeps billing records as tax law requires.
• Access logs: deleted after 14 days. Error logs: kept up to a fixed size (30 MB), after which the oldest entries are overwritten.
• Backups may hold deleted data for up to 30 days before it is overwritten.

Your choices and rights

You can edit or delete your boards at any time. To get a copy of your data, correct it, or delete your account and all its content, email legal@opossumware.net from the address on your account. We respond within 30 days. California residents can use these same rights to review and change their information.

Our site does not respond differently to "Do Not Track" browser signals, because we do not track you across sites in the first place.

Users in the EU, EEA, UK, and Switzerland

? is the controller of your personal data. We rely on these legal bases:

• Contract: to provide your account, boards, and paid plan.
• Legitimate interests: to secure Scrounge and prevent abuse (such as limiting login attempts), and to keep it running (access and error logs).
• Legal obligation: where the law requires us to keep or disclose data.

You have the right to access, correct, delete, restrict, or object to the processing of your data, and to receive it in a portable format. To use these rights, email legal@opossumware.net. You also have the right to complain to your local data protection authority.

Your data is stored and processed in the United States. Where required, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard. We have data processing agreements with our providers.

Children

Scrounge is not for children under 13, and we do not knowingly collect their data. If you believe a child under 13 has an account, email legal@opossumware.net and we will delete it.

Security

Connections are encrypted with HTTPS, login codes are stored only as hashes, and your images are shown only to you and the people you share their board with. No system is perfectly secure, but we work to protect your data and will notify you of a breach where the law requires.

Changes

If we change this policy, we will update the effective date above. If a change is significant, we will tell you by email or on the site before it takes effect.