The short version
Scarecard is a US-focused scorecard for people age 13 and older. It collects a chosen display name, a generated public handle, ratings, private notes, and an optional recovery email. Scarecard uses cookie-free Cloudflare Web Analytics for aggregate traffic and performance information. It does not sell personal information, run behavioral advertising, or use notes for profiling.
Who operates Scarecard
Scarecard is operated as an independent project, not a registered business. Questions, privacy requests, and deletion requests can be sent to privacy@scarecard.app.
Information Scarecard collects
Account and profile information
Starting to rate requires only a name you type -- Scarecard creates an identity right away, held by a recovery token on your device. Setting up a passkey or adding a recovery email are both optional upgrades offered afterward, never required to use Scarecard.
- A display name or nickname you choose.
- A generated public handle and the avatar options you select.
- A recovery token held on your device until you set up a passkey, which replaces it there. Adding a recovery email on its own does not remove the token -- only a passkey does. Losing the device with no passkey or recovery email set up means losing access with no way to recover it.
- Passkey credential information, if you choose to set one up for signing in and recovering access. Setting up a passkey is optional. Scarecard does not receive the fingerprint, face scan, device PIN, or other method your device uses to approve a passkey.
- An email address, if you choose to add one for account recovery. Providing an email address is optional.
Ratings and notes
- Your attraction ratings and the dates associated with them.
- Information about repeated walkthroughs and who entered a rating.
- Notes you write for your own reference. Notes are private to their author and are not shared with group members or public visitors.
Technical and security information
- Limited request information used to operate the service, prevent abuse, enforce rate limits, diagnose failures, and protect accounts. This may include an IP address, timestamps, and request details.
- Session and device credentials stored in your browser so Scarecard can keep you signed in. These credentials can be removed by signing out or clearing this site's browser storage.
How Scarecard uses information
Scarecard uses this information to:
- operate ratings, rankings, personal views, and shared groups;
- authenticate accounts and recover access when requested;
- save and display your notes;
- prevent abuse, investigate failures, and secure the service;
- understand aggregate traffic and page performance; and
- maintain and improve Scarecard.
Who can see information
Public visitors
Public ratings use generated handles rather than display names. Public views may include ratings, rating dates, aggregate statistics, generated handles, and attribution showing which handle entered a rating. They do not include recovery email addresses or notes.
Group members
When you join a group, other members of that group may see your chosen display name and ratings within the group. They cannot see your recovery email or your notes.
You
Only you can see the notes you author through the ordinary Scarecard interface.
Service operation
The operator and service providers may be able to access stored information when necessary to host, maintain, secure, back up, or comply with legal obligations for the service. Scarecard does not claim that notes are end-to-end encrypted.
Optional recovery email
If you add an email address, Scarecard uses it only to verify the address and send account-recovery links you request. It is not displayed to other users or used for marketing. You can remove or replace it from your account settings.
Cloudflare Web Analytics
Scarecard uses Cloudflare Web Analytics to understand aggregate visits and page performance. According to Cloudflare, Web Analytics does not use cookies or local storage, does not fingerprint individual visitors for analytics, and does not track individuals across Cloudflare customers' sites.
Scarecard does not send names, email addresses, notes, group capability tokens, or passkey information to Cloudflare as custom analytics events, and this beacon is never loaded at all on a page reached through a group invitation, account claim, email verification, or account-recovery link, since those links carry a one-time access token of their own.
Learn more in Cloudflare's Web Analytics documentation and Cloudflare's privacy policy.
Service providers and external links
Scarecard uses service providers to host, secure, measure, and send requested recovery email for the service. These providers process only the information needed to perform those functions. Current providers include:
- NearlyFreeSpeech.NET: website and database hosting, and delivery of verification and recovery email.
- Cloudflare: aggregate website analytics (Web Analytics), and storage for an encrypted, off-host backup copy of Scarecard's database (Cloudflare R2). Every backup is encrypted before it leaves Scarecard's own server, so Cloudflare never has access to its unencrypted contents.
Every typeface Scarecard uses, including house/attraction wordmark styles for events with a themed look, is hosted directly by Scarecard. No font is fetched from a third party.
Retention and deletion
- Account information, ratings, and notes are kept until you remove them or delete your account.
- A recovery email is kept until you remove or replace it or delete your account.
- Expired email verification and recovery links are removed automatically as part of Scarecard's daily scheduled maintenance. Group and account-claim invitation links, and passkey authentication challenges, stop working once expired and are removed the next time a new one of that same kind is created, rather than on a fixed schedule.
- Security and rate-limit records are retained for up to 7 days.
- Backups are retained for up to 14 days, both on Scarecard's own server and in the off-host encrypted copy. Information you delete may remain in a backup until that backup expires and will not be restored to active use except as part of disaster recovery.
- Cloudflare retains and aggregates analytics information according to its service configuration and privacy policy.
Your choices
Depending on the information involved, you can:
- edit or delete your notes;
- change your public handle and profile appearance;
- remove or replace your recovery email;
- remove ratings you entered;
- leave a group;
- export a copy of your ratings, profile, passkeys, and group memberships as a file you keep;
- sign out of the current browser; and
- delete your account or ask the operator for assistance.
To make a privacy or deletion request, use the controls in Scarecard or contact privacy@scarecard.app. Scarecard may need to verify that the request concerns your account before acting on it.
People under 13
Scarecard is a general-audience service for people age 13 and older. It is not directed to children under 13. If the operator learns that Scarecard has collected personal information directly from a child under 13, the operator will disable the account and delete that information.
A parent or guardian who believes a child under 13 has provided information to Scarecard can contact privacy@scarecard.app.
No sale or behavioral advertising
Scarecard does not sell personal information, display behavioral advertising, or use ratings, notes, or account information to create advertising profiles.
Security
Scarecard uses technical and organizational measures intended to protect stored information, including encrypted connections, passkey-based authentication, access controls, and backups. No online service can guarantee absolute security.
Changes to this notice
This notice may be updated when Scarecard's features or information practices change. The date at the top identifies the latest version. Material changes will be explained in the service when appropriate.
Contact
Questions about this notice or Scarecard's information practices can be sent to privacy@scarecard.app.