Privacy and analytics information
This page describes the current public website behavior, including local storage and optional analytics.
Browser preferences and support
Filters, language choices, saved news and workspace preferences use browser local storage. Supported preferences also sync to a signed-in account for use on other devices. Messages and screenshots you send to support are stored with your account on the server and visible to protected administrators. System announcements and your read status are stored with your account across devices while announcements are available. An administrator can set their display period or delete them for everyone.
Support replies remain available in your account conversation. Clearing browser data removes local preferences and can reset your filters and consent choice, but does not delete server-stored support messages.
Account sign-in methods
You can sign in with Telegram, Google, or a one-time code sent to your email address. Google supplies a verified account identifier, email address, name and optional profile image; Scalpy uses these to authenticate you and show connected methods. Email addresses and method links are stored with your UID. When available, an optional Telegram or Google profile image URL is stored with your UID so your avatar appears across devices; the Telegram image takes priority. Email codes expire after 10 minutes and are not stored in plain text.
Connecting a method while signed in keeps your existing UID, filters and saved settings. Scalpy does not merge separate accounts based only on a matching email address. Security rate-limit records and short-lived code challenges are used to protect sign-in.
First-party site measurement
The public page sets the scalpy_vid visitor cookie with a one-year expiry and creates a short-lived browser gate. Site measurement can record page visits, feature use, screen dimensions, timezone, load duration and error events.
The page bootstrap may record a referral host, campaign parameters and a country code supplied by a trusted proxy. When you are signed in, first-party measurement links new verified activity to your account UID so the protected admin panel can show account visits and recent activity. Older anonymous visits are not retroactively identified. The browser gate does not contain account credentials or exchange API secrets. Server infrastructure may separately maintain operational access logs.
Optional Google Analytics
Google Analytics loads only after you allow it through the privacy choice. The saved choice lasts up to 180 days before being requested again. Advertising storage and advertising personalization remain disabled in the site configuration.
Use the PRIVACY button to revisit the choice. Rejecting optional analytics prevents its loading on subsequent page visits; browser site-data controls can remove previously stored provider cookies.
Updates and questions
This description was reviewed on 6 October 2026. It documents observed website behavior rather than promising a fixed retention period for every infrastructure log.
Support conversations and attachments are retained with the account so you and administrators can revisit them. See Contact and Support for how to use the inbox. An operator identity, external privacy contact and detailed deletion policy should be published when those details are established.
