Privacy policy

In short

• You sign in with your Online Scout Manager (OSM) account. We keep your OSM user number, name and email address, and which groups and sections you chose to share with the site.
• We only ask OSM who you are and which sections you lead. We never read anything about young people from OSM, and the tool has nowhere to record it.
• A group’s risk assessments are seen only by that group’s leaders, and by anyone they send a share link to. A share link never shows an email address.
• No adverts, no analytics, no tracking cookies. We never sell or share your information for marketing.

Nothing about young people

The tool has no place to record a young person’s name, age, contact details, health or needs. Where an activity has been adapted for someone, the risk assessment describes the control (“a quiet space is available throughout”), not the person.

When you sign in, OSM asks you to let the site read the programme of the sections you pick. The site uses that only to learn which sections and groups you lead. It never reads the programme, members, events or anything else, and OSM’s permission is used once and then thrown away.

Please keep it that way. Don’t type young people’s names or medical details into any box, and don’t attach files that contain them. If you spot any, edit them out and tell an administrator of your group.

What we keep

About you, as a leader

• From OSM when you sign in: your OSM user number, your name and your email address, and the groups and sections you shared (their names and OSM numbers). This is brought up to date each time you sign in.
• The name you choose to show (it starts as your OSM name), whether you’re an administrator of each group, and when you first signed in and last used the tool.
• Your name and email address against what you do: the risk assessments you write, edit, approve and review, the on-the-day changes you record, the files you attach and the share links you make.
• When a leader asks someone to review a risk assessment: the reviewer’s email address (or which leader they picked), any message, who asked and when, whether the email went, when the reviewer opened it, and their answer and comments. Any comments the reviewer leaves on single hazards, the leaders’ replies to them, and who marked them done and when. If the reviewer is asked to look again, their earlier answers are kept too. The link’s key is kept only in a scrambled form.
• A record of each change: what kind of change it was, which risk assessment it was to, when you made it on your device and when it reached us. Those two times differ if you were working without a connection.
• For each device you sign in on: a random sign-in key (we keep only a scrambled form of it that can’t be used to sign in), when it was made and when it was last used.

In the risk assessments

• Everything typed into them: the activity, where and when it is, the sections, expected numbers of young people and adults, hazards, controls, what would make you stop, safeguarding arrangements and notes.
• The names of adult volunteers where you type them: who wrote it, the leader in charge, who is responsible for a control, who reviewed it and who decided an on-the-day change.
• Each approved version exactly as it was approved, the review history, and the log of on-the-day changes. These are a safety record, so they can’t be edited or removed once written.
• Files you attach, such as a site map or a venue’s own risk assessment.

For running the site

Each group’s settings (name on documents, logo, lists of sections and categories) and its risk library. Our host, Cloudflare, keeps logs of requests to the site (including IP addresses) for a few days, which we use only to find faults and stop misuse.

What stays on your device

So the tool works with no signal, on a campsite or in a hall, your browser keeps:

• a copy of the risk assessments, the risk library and the settings of the group you’re working in;
• any changes you’ve made that are waiting to be sent, each with the time you made it;
• a copy of the tool’s own files;
• your choice of Light, Dark or Auto.

There are two cookies, both needed to sign in. One keeps you signed in: it lasts 30 days from when you last used the tool, and 90 days at most, after which you sign in with OSM again. The other lasts ten minutes while you are on OSM’s sign-in page, so the site knows the sign-in was started here. Neither is used for tracking or advertising, so we don’t ask for cookie consent.

Signing out (in Settings) ends the sign-in and removes the copy on the device. On a shared or borrowed device, always sign out when you’ve finished.

Why we use it

Only to plan Scout activities safely: writing risk assessments, showing who wrote, approved and reviewed them and when, reminding leaders when a review is due, and sharing approved assessments with the people who need them. The Scouts’ rules ask for risk assessments to be recorded, to show who was involved and to be reviewed, and this is how groups do that here. We use your OSM details only to sign you in and to give you the groups you lead.

Under UK GDPR, our lawful basis is legitimate interests: Pegasus ESU and the groups that use the tool have a legitimate interest in running their activities safely and being able to show how they did so, and we only keep what that needs.

How long we keep it

• Risk assessments are kept while they’re in use and afterwards as a record of how activities were planned, in case of a later question, accident report or insurance claim. One that was never approved can be deleted by any leader of the group. An approved one is archived instead, and stays in the record until it is removed from the database at the group’s request.
• Attached files are deleted from storage as soon as a leader removes them.
• Share links stop working on the date chosen when they’re made, when a leader switches them off, or when the risk assessment is archived.
• Your access to a group ends when you no longer share any of its sections from OSM (at your next sign-in), or when an administrator of the group removes you.
• Your name and email address stay against what you wrote and approved, because that is part of the record. You can ask us to remove your account and details.
• Sign-in keys are deleted once they run out.
• Cloudflare’s request logs are kept for a few days.

Who can see it

• Leaders of the same group, after signing in, can see and edit every risk assessment of that group, see who changed what, and see the names of the group’s other leaders and the sections they shared. Leaders of other groups can’t see any of it.
• Administrators of a group can also see the email addresses of its leaders, change who is an administrator, take a leader out of the group, and download a backup of the group’s records.
• Anyone with a share link can read the latest approved version of that one risk assessment, download it as a PDF and download its attachments. That is how a nights away risk assessment reaches the District or County, or a parent where that’s appropriate. They see the names typed into it and the names of the people who approved and reviewed it, never an email address, the edit history or any other risk assessment. Links are long and random, so they can’t be guessed.
• Someone asked to review a risk assessment signs in with OSM through the link they were sent, and can then read that one risk assessment as it stands, download it as a PDF and its attachments, comment on single hazards, and send their answer. They see the names typed into it, the leaders’ replies to their comments and the name of the leader who asked, not the edit history, email addresses or any other risk assessment. The first person to sign in through a link becomes its reviewer, and nobody else can use it after that. The group’s leaders see the reviewer’s email address, their answer and comments, and can reply to their comments on hazards.
• Anyone you give a PDF or printout to sees what’s on it.
• Pegasus ESU volunteers who run the site can reach the database when they need to fix a fault. They don’t look at it otherwise.

Who else handles it

• Online Scout Manager checks who you are on its own sign-in page, and tells us your name, email address and the sections you chose to share. Your OSM password never reaches us.
• Cloudflare hosts the site, its database and the attached files, and sends review emails (the reviewer’s email address, the risk assessment’s name, the group’s name, the name of the leader who asked and any message, and the answer and comments going back). Cloudflare may handle data outside the UK, under the safeguards in its data processing terms.
• Google (Gemini), only for leaders the site owner has given AI help, and only when they press one of its buttons:
  • “Suggest a combined version with Gemini”, when combining two library hazards: the text of those two hazards (the hazard, who might be harmed, how, and the controls) is sent, and nothing else.
  • “Suggest hazards with AI”, when writing a risk assessment: the description the leader types, any reference documents they choose to attach, and the risk assessment’s type, name, details (such as location and dates), the kinds of section involved and the names of the hazards it already has. No names or email addresses of leaders are sent. Leaders are asked not to name young people or include medical details, and Gemini is told not to repeat any.
  • “Sort into groups with AI”, when organising a risk assessment’s hazards: the names of the groups the leader made, each hazard’s name, how people might be harmed and its controls, and the risk assessment’s type, name and notes. Nothing else is sent.
  • “Review with AI”, when checking a risk assessment for repeats, contradictions and uneven wording: each hazard’s name, how people might be harmed and its controls, and the risk assessment’s type and name. Nothing else is sent.
  Google processes this to give its answer. The documents aren’t kept here.
• Fly.io runs a small relay of ours in London that passes the site’s two sign-in requests to OSM from one fixed address. It forwards them as they are and logs only the time, the kind of request and whether it worked: never your details, OSM’s replies or sign-in keys.

Nobody else. The tool sends nothing to The Scouts or any other service, emails only the people a leader asks to review something (and the leader, with their answer), and we don’t sell or share your information or use it for marketing.

How it’s protected

• Every connection uses HTTPS, and browsers are told never to use plain HTTP for the site. The database and files are encrypted at rest by Cloudflare.
• Nothing can be read or changed without signing in with OSM. The sign-in cookie can’t be read by the page’s own scripts, and is only sent over HTTPS to this site.
• Every request is checked against the groups you lead, so one group can never reach another group’s records.
• Share links carry a long random key, show approved versions only, and can be switched off or given an end date.
• Attached files are checked to be a PDF, picture or Word document, limited to 10 MB, and only ever sent as downloads.
• The pages load no third-party scripts, can’t be framed by other sites, and run under a strict content security policy.

No system is perfectly secure. If something went wrong that put your information at risk, we would tell the people affected and, where the law requires, the Information Commissioner’s Office.

Your rights

Under UK GDPR you can ask us:

• for a copy of the information we hold about you;
• to correct it if it’s wrong (you can change the name you show yourself, in Settings, and your email address in OSM);
• to delete it, or to stop or limit how we use it;
• for a risk assessment in a form you can take elsewhere. You can do this yourself with Download PDF.

For any of these, speak to a Pegasus ESU leader, or ask an administrator of your group to pass it on to the volunteers who run the site. We’ll reply within one month.

If you’re unhappy with how we’ve handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk.