Privacy Policy

Effective Date: April 24, 2026 · Last Updated: September 29, 2026

1. Introduction

Scott Applications LLC ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what choices you have — when you visit www.scottapplications.com, buy a website template, or buy a Scott Skill Pack (including install through our MCP server at mcp.scottapps.com).

We operate our own first-party analytics on this website. Page views are recorded only if you choose "Accept all" on the cookie banner. Google Analytics 4 and a Meta (Facebook) pixel are in the site code and stay off unless both of these are true: we have configured a real measurement id, and you chose Accept all. As of this update, neither id is configured, so neither tag loads. We do not sell personal information. Skill packs and their checkers never phone home — they do not contain analytics, beacons, or account gates. The Cookie Notice lists every cookie and storage value this site sets.

2. Information We Collect

A. Information You Give Us Directly

When you fill out a contact form, buy a website template, buy a skill pack, or join our newsletter, we collect:

Name and business name
Email address
Phone number
Project details and message
Budget range (if provided)
Service(s) of interest
City or region (if provided)
Purchase email and the license key we issue for a skill pack (the key is hashed at rest)
Optional pack-improvement notes you type in your locker after ticking the consent box — never your source code or AI prompts

A job application also includes a resume file, an optional cover letter, LinkedIn and portfolio links, and whether you agree to that role's terms. A venture inquiry includes the project description, budget band, and any brief you upload. Checkout and onboarding for a website plan or a skill pack include the name, email, and business details you submit there. Card numbers stay with Stripe. We do not ask for government ID numbers, precise GPS, or health information. A resume can contain whatever the applicant chose to put in it, and we use that file only to consider the application.

Separately from these forms, we keep business contact details — name, company, role, a public business email, and city — for companies we may email about our services, including details taken from public business listings. If you tell us to stop, we keep a record of that request so we do not email you again.

B. Information Collected Automatically

If you choose "Accept all" on the cookie banner, our first-party analytics records the following. If you choose essentials only or decline, we do not write page views.

IP address — used to derive city-level location only (we do not store street-level or precise GPS location). Your IP is stored temporarily and used to map general visitor geography.
City-level location — derived from your IP address via a geolocation lookup. We record city and region, not your exact address.
Device type, operating system, and browser — parsed from your User-Agent string (e.g., "mobile / iOS / Safari").
Pages visited and session path — we track which pages you view and in what order, to understand how visitors navigate the site and which pages lead to contact form submissions. This data is linked to an anonymous session ID, not your name or email.
CTA and link clicks — we record when visitors click call buttons, email links, or other key actions on the site. These events are linked to the same anonymous session ID.
Referrer URL — the page or search engine that brought you to our site, if your browser sends this information.

C. Cookie Consent Record

When you respond to our cookie consent banner, we record your choice (accepted or declined), along with your device type, browser, and the page you were on when you responded. This record is stored so we can honor your preference and demonstrate compliance.

D. reCAPTCHA v3

Our contact forms are protected by Google reCAPTCHA v3, which analyzes visitor behavior to detect bots. reCAPTCHA operates under Google's Privacy Policy. We store the reCAPTCHA score on each lead submission for spam auditing purposes. We do not have access to any additional data reCAPTCHA may collect on Google's end.

E. Skill Packs and MCP

A purchased skill pack is installed through our MCP with your SSK- key. The files your agent writes locally do not contact us. They do not see your repository. They do not upload prompts. There is no tracker, beacon, or analytics SDK inside any pack.

To deliver the product we do collect:

The email used at Stripe Checkout
A license key we generate (SSK-…), stored hashed
That you opened the locker or asked MCP to install a pack you paid for

When your coding agent talks to mcp.scottapps.com, that is an HTTPS request to our server so we can deliver the product. We retain operational records of that use:

Which tool ran (for example install, load a pack, fetch a reference)
Which pack slug was requested, when one was named
Whether the call succeeded, and a short error code if it did not
A hash of your license key — never the key itself
Which kind of coding app called us (Claude, Cursor, Copilot, Grok, or other), taken from the request's user-agent family — not the full string

We do not receive, store, or read the files on your disk, the prompt you typed, your source code, .env files, repository paths, or how many tokens your agent used. Those never leave your machine.

We use the operational records to run and secure the service, and — when we choose to — to decide which pack to upgrade next. Daily counts (tool, pack, success or fail) can be copied into our internal factory inbox. Same company. Not sold. Not shown on the public site. A count is a hypothesis for a later edition; the copy already on your disk does not change by itself.

If you send an improvement note from the locker, you must tick a box first. We store whether the pack helped on that task, an optional short note, which pack you named, and your locker email so we can delete the note if you ask.

3. Cookies and Local Storage

The full list, including how long each one lasts, is on the Cookie Notice. In short:

Consent cookie (sa_consent) — your choice of full, essential, or declined, for one year, so we do not ask on every page. The same choice is also kept in local storage under cookieConsent.
Analytics session (sa_session_id and sa_first_touch in session storage, not a cookie) — a random id for that browser tab, written only after you choose Accept all. It is not your name or email, and it is cleared when you close the tab.
Skill locker cookie (skill_portal) — httpOnly, set for 24 hours after you paste a license key or enter an email code. It lets you download a pack you paid for. It is not an analytics cookie.
Poll cookie (voted_ plus the poll id) — if you vote in an on-site poll, a cookie stores that vote so it is not counted twice. It expires after 30 days.
Staff sign-in — the admin dashboard sets its own session cookie. Visitors who never sign in to admin do not receive it.

We do not set advertising cookies of our own. The map loads Mapbox tiles when you open a page that shows the map, and that request includes your IP address. Contact and venture forms load Google reCAPTCHA. Stripe may set cookies on Stripe's own checkout page when you pay. Those services are named in Section 5.

4. How We Use Your Information

To respond to your inquiry — we use your name, email, phone, and project details to follow up on contact form submissions and proposal requests.
To process payments — website templates and skill packs are paid through Stripe. We do not store your card number or full payment details — Stripe handles all payment data.
To deliver skill packs — we use your purchase email and license key so you can open the locker or install through MCP. We use MCP operational records (tool, pack slug, success or fail, hashed key) to keep the host running and to decide which packs to upgrade when we choose to. Optional locker notes are used the same way, and only after you opt in. Your email stays with the order; it is not copied into that upgrade inbox.
To secure the MCP host — rate limits, fault codes, and hashed-key check-ins help us stop abuse and keep paying seats working. We do not use this to read your projects.
To send transactional emails — we use SMTP2GO to deliver form receipts, purchase confirmations, job-application notices, and venture-inquiry notices. Those messages are about something you just submitted or bought.
To email businesses about our services— we may email a publicly listed business address. Those messages name Scott Applications, include our postal address at 212 Dallas St, Waco, TX 76704, and include a way to opt out. Reply "unsubscribe" or email us and we stop. We honor that request within 10 business days, and we keep the opt-out so the address is not mailed again. We do not sell the list.
To send our newsletter — if you opt in, we use your email address to send occasional business tips and updates. You can unsubscribe at any time by replying to any newsletter email or contacting us directly.
To understand how our site is used — if you accepted analytics, first-party page views, session paths, and device/browser breakdown help us improve the site. This data is never sold or shared with advertisers, and it is never written by a skill pack.
To detect and prevent spam — reCAPTCHA scores and IP-based dev/test flags help us filter automated form submissions from real inquiries.

5. Third-Party Services We Use

The following third-party services process data on our behalf. Each operates under its own privacy policy:

MongoDB Atlas — cloud database where all lead, analytics, and consent data is stored. Hosted in the United States. MongoDB Privacy Policy
SMTP2GO — transactional email delivery for contact form confirmations and admin notifications. SMTP2GO Privacy Policy
Stripe — payment processing for website plans, add-ons, and skill packs. We do not store payment card details. Stripe is PCI DSS compliant. Stripe Privacy Policy
Vercel— hosts this website. A request to the site is handled on Vercel's servers, which see the IP address and the page requested as part of running the site. Vercel Privacy Policy
Microsoft 365 — our own business mailbox. It is not a tracker on the public site. Replies to us land there.
Smartlead — a processor we previously used to send business outreach email, only on our instructions and never for its own marketing. We stopped using it in September 2026 and no longer send it any data. Outreach now goes out from our own Microsoft 365 mailbox.
Google reCAPTCHA v3 — bot detection on contact forms. Google Privacy Policy
Mapbox — map tiles on public pages that show our service area, and on the private admin map. Mapbox receives your IP address when those tiles load. This is not an advertising tag. Mapbox Privacy Policy

We do not sell personal information, and we do not share it for cross-context behavioral advertising. Google Analytics 4 and the Meta pixel described in Section 1 load only after Accept all, and only if that product's id is actually configured. TikTok and other ad-network pixels are not installed.

6. Data Retention

Lead submissions — retained indefinitely for business records and project history unless you request deletion.
Analytics data (page views, events, journey sessions) — retained for up to 24 months for trend analysis, then purged.
Cookie consent records — retained for 12 months.
Newsletter subscribers — retained until you unsubscribe, at which point your email is removed from the active list within 7 days.
Job applications and resumes — kept while we are considering the role, then deleted when you ask or when we no longer need the file for hiring.
Venture inquiries and uploaded briefs — kept as a record of the inquiry unless you ask us to delete them.
Business outreach contacts — kept so we know who was already emailed. An opt-out is kept for as long as we run outreach, so the address is not mailed again.
Template waitlist entries — retained until the template launches or you request removal.
Skill-pack orders and hashed license keys — retained as business records of the sale so we can re-issue access. Ask us to close a key and we will mark it revoked.
Opt-in pack feedback — retained up to 24 months, or deleted sooner if you ask.
MCP operational events (tool, pack slug, success or fail, hashed key, client family) — retained 90 days, then purged.
MCP daily counts (how often a tool or pack ran, success or fail — no hashed key) — retained up to 24 months so we can plan upgrades, then purged.

7. Your Rights and Choices

You have the right to:

Access — request a copy of the personal information we hold about you.
Correct — ask us to correct inaccurate information.
Delete — request that we delete your personal information. Note that some data may need to be retained for legal or business record purposes.
Opt out of the newsletter — reply to any newsletter email or contact us directly and we'll remove you within 7 days.
Withdraw cookie consent— clear this site's cookies and site data in your browser, then reload. The banner asks again. Choosing essentials only or decline stops optional analytics.
Opt out of sale or sharing — we do not sell personal information and we do not share it for cross-context behavioral advertising. You can still email us and we will confirm that.
Appeal — if we refuse a privacy request, reply to that email and we will look at the refusal again.
Skill-pack notes — locker feedback is optional. Do not tick the box if you do not want the note stored. Email us to delete a note you already sent.
MCP usage — ask us to close a key and we delete the hashed operational events for that key. Daily counts have no key on them and stay as de-identified totals until they age out.

To exercise any of these rights, contact us at contact@scottapps.com or call (254) 900-2520. We'll respond within 10 business days. You may use an authorized agent if you give us proof that they represent you. We will not charge a different price or refuse a sale because you made a privacy request.

We are based in Waco, Texas, and we serve customers in the United States. Texas residents can use the same address to ask us to access, correct, or delete personal data, and to appeal a refusal. California residents can ask what categories of personal information we collected, the sources, the purpose, and the categories of parties we disclosed it to. We do not sell or share personal information as those words are used in the California Consumer Privacy Act. Other state privacy laws give similar access, correction, and deletion rights where they apply to us, and we handle those requests at the same address. Some records, including tax and payment records and outreach opt-outs, have to be kept even after a deletion request.

8. How We Protect Information

The public site is served over HTTPS. Admin access requires a password and a second factor. Payment card numbers are handled by Stripe, not stored here. Skill-pack license keys are stored hashed. Resume and venture files are stored in our database and are not posted on the public site. No method of storage or transmission is perfect, and we do not claim that unauthorized access is impossible. If we learn of a breach of personal information that the law requires us to announce, we will notify the people affected and the authorities the statute names.

9. Children's Privacy

Our website and our services are not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has submitted information to us, contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy as our services evolve. When we do, we'll update the "Last Updated" date at the top of this page. Continued use of the site after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

Scott Applications LLC
212 Dallas St, Waco, TX 76704
contact@scottapps.com
(254) 900-2520