Privacy Policy

1. Scope

This policy explains how the Scouter mobile application, Lumen image generation service, and related support website handle information. Scouter is operated by 张轶凡, an individual developer whose App Store seller name is Yifan Zhang. The operator is the controller responsible for the service data described here and can be contacted at support@scouter.uk. This policy applies to distributed versions of Scouter unless a newer policy is posted.

2. Age eligibility

Scouter is intended only for people who are at least 16 years old. If you are under 16, do not use Scouter, create or link a Scouter service account, make a purchase, or submit an image to Lumen.

If Scouter learns that service data was collected from someone under 16, it will take appropriate steps to delete that data. A parent or guardian can report a concern using the privacy contact below. Users aged 16 or 17 must also have any parent or guardian agreement required by the law where they live.

3. Information kept on your device

Scouter stores projects, captured photos and clips, generated images, notes, custom framelines, LUTs, camera and lens selections, preferences, and shot metadata locally on your device by default.

Shot metadata can include camera and format, lens set and focal length, frame and recording aspect ratios, look or LUT, focus, exposure, white balance, capture time, and optional location, compass, tilt, or roll data.

4. Optional iCloud sync

If you enable project sync, Scouter uses Apple CloudKit to synchronize project records and media through your private iCloud account. Apple processes that data under its own terms and privacy policy. Scouter does not operate a separate copy of your iCloud project library.

5. Lumen relighting

Lumen runs only after you select a captured shot and request a generation. The app sends the selected image, your chosen preset or custom direction, source and project identifiers, image dimensions, and relevant technical shot metadata to Scouter's backend.

Technical metadata can include camera, recording format, lens set, focal length, aspect ratio, look or LUT, focus, exposure, white balance, and equipment-catalog version. Precise GPS coordinates, compass heading, altitude, pitch, and roll are not included in Lumen requests.

A Project shot created by an earlier app version can retain legacy Stand-in content. If you submit such a shot to Lumen, the temporary image contains its visible rendered appearance and Scouter may send a compatibility handling mode, count, and broad model categories for compatibility. The current app does not offer Stand-in authoring. AR world maps, camera transforms, tracking matrices, and the editable scene document are not sent.

Scouter's backend sends the selected image and generation instruction to Alibaba Cloud Model Studio, using Qwen or Wan image models according to the generation route available for that job. Processing currently uses the China (Beijing) service region and may occur in a country or region different from yours. Scouter does not use your images to train its own models. Alibaba Cloud states that Model Studio customer content is not used to develop or improve its models without separate consent. Providers must protect the information consistently with this policy and applicable contractual and legal requirements.

6. Accounts and service records

If you use Sign in with Apple, Scouter processes the Apple account identifier and any name or email address Apple provides with your consent. The service also processes device session and refresh-token records, plan and generation-credit balances, App Store transaction and entitlement records, job status, timestamps, and request identifiers. Refresh tokens are stored as hashes on the service.

Lumen's launch Live Activity is local to your device. This release does not request an ActivityKit push token, register the activity with Scouter's backend, or use Apple Push Notification service for remote Live Activity updates. The app may update the activity locally while iOS allows it to run.

Limited operational and security logs may include timestamps, request or job identifiers, error details, and standard network information such as an IP address. Scouter does not use third-party advertising or cross-app tracking.

Welcome Lumen credits are limited to one grant for each verified Apple identity. To prevent a deleted account from claiming the same grant again, Scouter stores only a keyed, one-way code derived from the Apple account identifier. The server uses a separate secret to create that code. The code contains no name, email address, account ID, or Apple identifier and is used only for grant-abuse prevention.

7. Online monitoring

Online monitoring runs only after a host deliberately starts a session. The host approves each invited viewer. For Internet viewing, including an optional Internet link added to a Local Wi-Fi session, Scouter then sends that viewer a short-lived connection credential. While Internet sharing is live, camera video is encrypted in transit and relayed through Scouter's LiveKit Cloud project to approved Internet viewers. That project uses a United States data region and LiveKit's global edge network, so real-time media may be processed in an available LiveKit region near the participants. This release does not transmit microphone audio and does not enable server-side recording.

If the host selects Local Wi-Fi, nearby Scouter devices discover an anonymous, temporary peer and connect directly using an encrypted local-network transport. The host must approve the requesting peer before any live frame is sent. A local-only session does not create a Scouter backend session or LiveKit room, and its peer identifiers and approval tokens are kept only in memory while the session is active. A host may separately turn on Internet sharing for that local session and create a link for remote viewers. Doing so creates the backend session and LiveKit room described here for the Internet branch only; approved nearby viewers continue to receive their stream over the direct local connection.

Whenever Internet sharing is enabled, Scouter's backend handles the session owner, invite, approval, participant, expiry, and revocation records needed to operate and secure that Internet connection. It does not receive or store the live video as an image or video file. Ending a session disconnects its viewers, and removing a viewer revokes that participant's access. Connection credentials expire quickly and cannot be used to browse another session. Account-linked session, invite, approval, participant, expiry, and revocation records are deleted within seven days after the Internet session ends or expires. If LiveKit is unavailable at that deadline, an unlinkable cleanup receipt may retain only opaque, randomly generated room and relay-participant identifiers until revocation and room deletion succeed. It contains no account link, invite, display name, connection token, or media.

A host is responsible for having permission to transmit the people, places, and material visible in the camera. Approved viewers can use Scouter to deliberately save a still frame from the live view to their current Scouter Project, and may also capture it using other features of their device, which Scouter cannot prevent. The in-app capture stores one frame as ordinary project media on the viewing device. If the viewer enables automatic saving to Photos, Scouter also adds a copy with overlays and camera information to Photos. It does not capture microphone audio, start continuous or server-side recording, or send a copy to Scouter's backend or media relay. If the viewer has enabled optional private iCloud project sync, Apple CloudKit may sync that project media as described in section 4. Hosts should stream only with the permission of everyone whose image or work may be visible.

8. Retention and deletion

• A Lumen source upload is retained only while a job is queued, running, or retrying, and is deleted after success, terminal failure, or cancellation.
• A generated result remains temporarily available until the app confirms that it was saved to the project. Unclaimed results are deleted after 24 hours.
• This release does not create or upload Live Activity push-token material. The local Live Activity ends when its Lumen work is finished or no longer needs to be shown.
• Account-linked online-monitoring session, invite, approval, participant, expiry, and revocation records are deleted within seven days after a session ends or expires. If relay cleanup is temporarily unavailable, an unlinkable receipt may keep only opaque room and relay-participant identifiers until cleanup succeeds; it has no account link, invite, display name, token, or media. Live video and audio are never stored as part of those records.
• When Scouter uses Model Studio's asynchronous generation interface, Alibaba Cloud retains the task status and temporary result URL for up to 24 hours so Scouter can recover a generation after a worker restart. Scouter downloads the result promptly and does not treat that provider URL as permanent storage.
• Limited operational backups and security logs may remain temporarily under Scouter's operational retention controls. Generic App Store notification UUID and payload hashes that contain no signed payload, account key, Apple subject, email, or name may also remain, together with aggregate service metrics. These records are not used to restore a deleted account and do not contain source or generated image bytes.
• A keyed, one-way welcome-grant redemption code remains after account deletion for the life of the welcome-credit program and for up to 24 months afterward. It is not linked to a Scouter account, cannot restore a deleted account, and is retained only to prevent the same verified Apple identity from repeatedly claiming one-time promotional value.
• Deleting a local project removes its local content. iCloud copies follow Apple's CloudKit synchronization and deletion behavior.
• Using Settings > Account > Delete Account permanently removes the Scouter account and profile, authentication and private-installation sessions, Apple identity link, Lumen jobs and provider-call receipts, online-monitoring sessions and participant records, credit history and reservations, Scouter-side App Store account links and aliases, transactions and reconciliation records, and any remaining source and result objects. Apple-linked accounts must confirm with a fresh Sign in with Apple authorization before deletion. Scouter exchanges and revokes that authorization and does not retain the Apple OAuth token.

9. Device permissions

Scouter requests camera access for the viewfinder, microphone access for scout clips, and permission to add to Photos only when you choose Save to Photos or enable automatic saving in Scouter Settings. Automatic saving is off by default and adds copies of new still captures with overlays and camera information; the originals remain in Projects. Lock-screen captures stay in protected local storage until you unlock Scouter, when they are added to Projects and, if enabled, copied to Photos. Scouter may also request location access for optional location and sun-planning features, and motion access for compass, horizon, tilt, and roll tools. Imports use system file pickers and do not require broad access to your photo library. You can change these permissions in system Settings.

10. Sharing, providers, and exports

Scouter does not sell personal information. Information is shared with Apple for features such as iCloud, Sign in with Apple, and App Store purchases. This release does not use APNs for remote Live Activity updates. Information is shared with Alibaba Cloud Model Studio when you request Lumen. Whenever you enable Internet monitoring, including by adding an Internet link to a local session, the live image is shared with the configured LiveKit media infrastructure and the Internet viewers you approve. The Local Wi-Fi branch sends the live image directly to the nearby viewers you approve. Information is shared with other infrastructure providers only as needed to operate the service, maintain security, meet legal obligations, or complete a transaction. When you export a photo, clip, report, or lighting plan, you choose the recipient and become responsible for that copy.

11. Mainland China data-transfer notice

The current public release uses Scouter's account and service backend at api.scouter.uk, hosted in Tokyo, Japan. When the app establishes or restores its private service account, that backend may receive a randomly generated installation credential, device name, session records, standard network information, account and generation-credit records, and request timestamps. If you choose Sign in with Apple, it also receives the Apple account identifier and any name or email address Apple provides with your consent. If you make or restore an App Store purchase, it receives the signed StoreKit transaction and the product, entitlement, transaction, and app-account-token records needed to verify and credit that purchase.

The recipient and service operator for that Tokyo processing is 张轶凡(Yifan Zhang). The purposes are to create and secure the service account, restore sessions, verify purchases and entitlements, maintain generation credits, prevent abuse, operate requested online features, and answer account or privacy requests. Contact support@scouter.uk to ask about this processing or to request access, a copy, correction, or deletion of applicable service records.

In the current release, a Lumen request sends the selected shot, relighting direction, source and project identifiers, dimensions, and the limited technical metadata described in section 5 to the Tokyo backend. The backend then sends the selected image and generation instruction to Alibaba Cloud Model Studio in the China (Beijing) service region, and the generated result returns through Tokyo. Precise GPS coordinates and the other excluded fields listed in section 5 are not part of that request.

Internet Monitoring is a separate, host-initiated choice. Its account, invite, approval, participant, expiry, and revocation records use the Tokyo backend, while its live video uses the United States and global LiveKit path described in section 7. Local Wi-Fi-only monitoring does not use either path. Ordinary viewfinder use, projects stored on the device, and Local Wi-Fi-only monitoring remain local except for any separate Apple service, permission, or sync feature you choose.

The current release can contact Tokyo when it creates or restores its private service account after launch. If you are in mainland China and do not agree to that transfer, do not use Scouter's online services and contact support for help. A forthcoming app update will place Scouter's mainland cross-border notice and affirmative choice before those Scouter backend calls; declining it will leave device-local projects, the viewfinder, and Local Wi-Fi-only monitoring available. This notice does not claim that all Scouter processing occurs in mainland China.

12. Security and international processing

Scouter uses encrypted transport, scoped service credentials, private object storage, and limited retention. No system is completely secure. Service data may be processed where Scouter and its providers operate, subject to the safeguards required by applicable law.

This support website does not use advertising or analytics cookies. Its hosting provider may process basic network and security logs needed to serve the site and prevent abuse.

13. Your choices, rights, and contact

You can keep projects local, disable iCloud sync, deny optional permissions, avoid Lumen, and delete projects. To permanently delete your Scouter service account, open Settings > Account > Delete Account in the app. A private account can be deleted directly. An Apple-linked account requires a fresh confirmation with the same Apple Account so Scouter can verify and revoke its authorization before deleting the account.

Account deletion does not remove projects or photos stored locally on your device and does not delete projects in your private iCloud library. Those copies remain under your control and can be deleted separately. You can review or revoke Scouter's device permissions in system Settings.

Deleting the Scouter app or account does not cancel an App Store subscription. The deletion screen offers Manage Apple Subscription before and after deletion; cancel with Apple if you do not want the subscription to renew. You may still delete your Scouter account immediately without first cancelling the subscription.

If European Economic Area or United Kingdom data-protection law applies to your use of Scouter, you may have the right, subject to applicable conditions and exceptions, to request access to, correction or deletion of, restriction of processing of, or a portable copy of your personal data. You may also have the right to object to processing. Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

You may also lodge a complaint with a data-protection supervisory authority, including an authority in the EEA country where you live or work or where you believe an infringement occurred. The European Data Protection Board publishes a list of EEA supervisory authorities. In the United Kingdom, you can contact the Information Commissioner's Office.

To exercise a privacy right, withdraw consent, ask a privacy question, or report that the in-app deletion request failed, contact support at support@scouter.uk. Scouter may need to verify that the request comes from the account holder. Never send an Apple password or verification code.

14. Changes

Material changes will be posted on this page with a new date. When required, Scouter will provide an in-app notice or request consent before applying a change to existing data.