Privacy Policy

01Overview

This policy covers three things run by Douglas Matheny / Capital High Robotics (together, “we,” “us,” or “the Program”):

• OmniScout (“the App”), a companion app for RECF robotics competition teams. It is available for Android and iOS, as Windows, macOS and Linux desktop installers, and as a browser version.
• capitalhighrobotics.us (“the Website”), the public website for the robotics program.
• The Inventory Manager (“the IMS”), at manager.capitalhighrobotics.us. It is a login-restricted internal tool for tracking parts, orders and usage, and is not intended for anyone outside the team.

The short version: the App and the Website have no user accounts, run no analytics or advertising software, and sell no data. The App keeps everything you enter on your own device. The only things it sends on its own are anonymous crash reports (to Sentry) and a small check of a status file on our website. If you choose to send a bug report, it goes to Sentry too. The IMS is different: it is a private tool with accounts, a session cookie and a database, described in Part 3.

02What we do not collect

• We do not offer or require account creation or login.
• We do not collect your scouting notes, ratings, photos, match schedules or anything else you enter. None of it is sent to or stored on a server we operate.
• We do not use analytics, tracking or advertising SDKs. The App includes one third-party SDK for reporting problems, Sentry (see Crash reports).
• We do not sell your data or share it for advertising. We do not have your scouting data to sell.
• The App does not ask for access to your location or contacts.

03What is stored on your device

The App stores the following locally, using standard device storage. It stays on your device unless you choose to export or share it:

• Team numbers, names, ratings and scouting notes you enter, your watchlist, and partner and strategy sheet entries
• Pit photos you take with your camera, if you add one to a team profile
• Planned and starred events, your saved next event, Event Day settings, score goals, and the reminders you set
• Match schedules you add by hand or by scanning a printed sheet, and the team you mark as yours
• Checklist progress, failure log entries and your skills-run log
• A copy of the engineering notebook file you choose to import, kept in the App’s own storage
• App preferences: language, theme, accent color, notification and display settings, tutorial progress, and the games you selected
• Cached copies of public RECF content so the App still works without internet at events: game manuals and PDFs, Q&A, field images, the scoring calculator, the approved-events listing, and the team directory built from event rosters
• Bug reports you wrote while offline, until they can be sent (see Bug reports)

04Your choices and deleting your data

• Delete my data in Settings erases everything the App stores on the device (team info, events, notes, checklist, skills log, match schedule, notebook, reminders and settings) and restarts the App.
• You can also clear the App’s storage in your device settings, or uninstall the App.
• You can turn notifications off in the App or in your device settings, and withdraw camera permission at any time. Features that need the camera stop working, and the rest of the App is unaffected.
• Because we do not hold your App data, we cannot look it up, export it or delete it for you. Use the tools above. Crash and bug reports are covered under Crash reports and Bug reports.

05Exporting and sharing

Nothing leaves your device through these features unless you start it, and we never receive a copy:

• Backup & Restore creates a file of your saved App data and imported notebook. You choose where it goes through your device’s share sheet, and you can restore from a file you pick.
• Team QR codes are generated on your device so another OmniScout user can scan a team profile.
• Text-message export opens your messaging app with a scouting summary pre-filled. Nothing is sent until you send it.
• Notebook sharing and manual PDF export hand a file to your device’s share or print dialog.

Once you share something outside the App, it is governed by the app or service you shared it with, not by this policy.

06Camera, photos and schedule scanning

The App uses the camera, or a photo you pick, for three optional features:

• QR code scanning to import a team profile another OmniScout user shared with you.
• Pit photos attached to a team in your own notes.
• Scanning a printed match schedule (for example a sheet printed from RECF’s event software) so the matches can be added to your schedule.

Photos and scanned data stay on your device. We do not receive them. The App does not record video or audio, and it only reads the photo or file you pick.

Schedule scanning runs on the device. On phones it uses Google ML Kit text recognition. The photo is not uploaded, though the ML Kit library may report basic technical diagnostics to Google as described in Google’s ML Kit data disclosure. In the desktop and browser versions, the first scan downloads the text-recognition engine and its English data (about 10 MB) from a public content delivery network. The photo itself stays in the app or browser.

07Notifications and reminders

If you enable notifications, the App schedules them locally on your device: match reminders, agenda alerts for an event you open, registration-closing reminders, pre-match checklist reminders, and notices that a manual or Q&A changed. They are created and delivered on-device. We run no push notification server and learn nothing when one fires.

08Language and translations

You can pick the App’s language in Settings (English, Spanish, Chinese, Portuguese, French, Arabic, Korean, Japanese and Hindi). The choice is stored on your device. Translations are built into the App, so no text is sent to a translation service. Dates and times follow the language you picked. Content that comes from RECF, such as manuals, event pages and Q&A, stays in the language RECF published it in.

09Bug reports

Settings includes a Report a bug form. If you send one, we receive only the text you type in the form (up to 1,000 characters per field), plus the same technical details crash reports carry: App version, operating system version and device model. It is delivered to Sentry’s feedback inbox. The form does not ask for or attach a name or email address, so please do not type personal information into it.

If you write a report while offline, it is saved on your device and sent when you are back online. Up to five reports are held, and they are removed from the device once sent.

10Crash reports (Sentry)

In installed builds, the App sends crash and error reports to Sentry, a third-party error-monitoring service, so we can find and fix bugs. A report contains technical details only: the error and where in the code it happened, the App version, your device model and operating system version, and anonymous session information used to measure how many sessions end in a crash.

We configure the SDK so it does not attach screenshots or screen layouts, does not attach any user identity, and does not collect personal information by default. Reports are not designed to include your notes, ratings, photos or anything else you enter. Development builds send nothing. Because a report is an internet request, Sentry’s servers may see your device’s IP address with it. We do not use it to identify you. To ask about a specific report, email us.

11Availability check

When the App opens, and about every 30 seconds while it stays open, it fetches a small public file from our website (capitalhighrobotics.us/omniscout-status.json). The file lets us show an update-required notice or switch off a single section if something is broken. The request carries nothing you entered. As with any web request, our host sees standard technical information such as an IP address. The App keeps the last response on your device, and if the check fails it simply carries on.

12Third-party services the App uses

When the App loads content from the services below, your device talks to them directly, as if you visited their sites in a browser. That includes standard network information such as your IP address. Their own privacy practices apply, and we do not see or store that traffic.

Some links open outside the App, in your browser, maps app or messaging app: RECF event pages, Google Maps directions for an event venue, the RECF engineering notebook rubric on kb.roboticseducation.org, and the text-message export. We send nothing to those destinations beyond what the link contains, and their own policies apply.

13Other device features

• Network status: the App checks whether you are online to decide whether to refresh cached content. This is not recorded or sent anywhere.
• Low-power mode: the App reads it to offer a battery-saving display. This is not recorded or sent anywhere.
• Screen wake: the App can keep the screen on while the match timer runs.
• File access: when you import a notebook, pick a schedule photo or restore a backup, the App reads only the file you pick.

14Desktop and browser versions

The desktop and browser versions work like the mobile App. Their data is kept in the app’s own storage on your computer, or in your browser’s storage for the browser version, and is cleared the same ways (Delete my data, or clearing app or site data). The desktop installers are downloaded from our Website; see Part 2 for what that involves.

15What we do not collect

• The Website has no accounts, no login and no forms that submit personal information to us. You can reach us by an email link, and the Support Us page links out to PayPal.
• We do not run analytics or advertising software, and we do not use tracking or advertising cookies.
• We do not sell or share visitor data, because we do not collect any.

16Hosting and standard server logs

The Website is hosted on Cloudflare Pages. Loading a page, or downloading an OmniScout installer, sends Cloudflare’s servers standard technical information needed to deliver it, such as your IP address, browser type and the page requested. This is generated by the hosting infrastructure, and we do not use it to track or profile visitors. It is governed by Cloudflare’s privacy policy.

17Information stored in your browser

The Website uses your browser’s local and session storage, not cookies, to remember a few small things on your own device: whether you dismissed the current announcement banner, and whether you liked a news post or were already counted as a view in this browser session. None of it identifies you, none of it is sent to us, and you can clear it any time in your browser’s site-data settings.

18Third-party services the Website loads

To display and run correctly, the Website loads a few third-party resources. Your browser talks to them directly when a page loads:

The Website also links to our Instagram, YouTube, GitHub and email. Those sites have their own privacy policies.

19Accounts, data and access

The IMS is a private, login-restricted tool at manager.capitalhighrobotics.us that the team uses to track parts, place and receive orders, and print bin labels. There is no self-service sign-up. Accounts exist only for team members, coaches and mentors, and an administrator creates and removes them.

Sign-in and session cookie

Signing in needs a username and password. Passwords are never stored in plain text: each is hashed with a unique random salt before it is saved. When you sign in, the IMS sets one cookie named session holding a random session token, not your username or password. It is strictly necessary to keep you signed in, is HttpOnly and Secure (page scripts cannot read it, and it is only sent over HTTPS), and expires automatically after 12 hours, or 30 days if you choose “Remember me.” It is the only cookie used by the App, the Website or the IMS, and it is not used for tracking or advertising.

What the IMS stores

• Usernames and hashed passwords for authorized accounts
• The parts inventory: item names, SKUs, quantities, bin locations and notes
• Purchase orders: vendor, items, cost and status
• A usage log of each quantity change, which signed-in account made it, and an optional reason. It exists for internal accountability, not to monitor anyone.

None of this is sold, shared outside the Program or used for advertising. A small number of administrator accounts have extra tools, including creating and removing accounts.

Hosting

The IMS runs on Cloudflare Pages with a Cloudflare D1 database, under Cloudflare’s privacy policy. The label-printing page loads the bwip-js barcode library from a public CDN (jsDelivr) to draw barcodes in your browser. No inventory data is sent to it.

20Children and students

The federal Children’s Online Privacy Protection Act (COPPA) covers personal information collected from children under 13. We do not knowingly collect personal information from children under 13 through any public feature of the App, the Website or the IMS. The App and the Website have no accounts. The App’s only outbound data is technical crash reports, the availability check and bug reports you choose to send, and the bug form asks for no name or contact details. IMS accounts are created by an administrator for known team members, coaches and mentors, and no one can sign up on their own.

RECF programs include participants under 18, and some IMS accounts may belong to students. The App is built for students and teams, so we keep it free of accounts and advertising on purpose. If you are a parent or guardian with a question or a removal request, email us.

Capital High School Robotics is a school-affiliated program, and student names and photos tied to a school program can be education records under FERPA. The App and Website do not collect or store education records. We publish team rosters, photos and names on the Website only as the school’s directory-information and photo-release practices allow, and we will remove a student’s name or photo on request.

21Accessibility

We want the Website and the App to be usable by everyone, including people who use screen readers or other assistive technology. The App supports system text sizing and screen readers, and offers nine languages. If a page or feature is not accessible to you, email us and we will work to fix it.

22Data security

App data stays on your own device, so its security depends on your device’s protections (passcode, encryption and so on). A backup file you export is a plain file under your control, so store and share it carefully. The Website and the IMS are served over HTTPS. The IMS requires sign-in for any access, stores passwords only as salted hashes, and uses an HttpOnly, Secure session cookie that expires automatically.

23Changes to this policy

If this policy changes, the “Last updated” date above changes with it. If we add a new kind of data collection to the App, we will update this page before the App version that does it is released. Continued use after an update means you accept the revised policy.

24Contact

Questions about this policy, or a request about a crash or bug report: [email protected]