Data Access Policy

In short

• Scout data comes in four classes. Public is what anyone meeting you in-game already sees. Sensitive is your build information (mod levels, raw mods, last-20 results, mode breakdown).
• Access is decided by identity, never by the browser or bot name a request claims. Anonymous visitors and anonymous scripts get exactly the same thing: Public data only.
• Registered community tools (for example Discord bots) use a named, revocable key. They may read Sensitive data only for pilots who keep External tools access on, and every such read is recorded.
• You have the last word: Private hides you everywhere; External tools access off limits tools to Public data. Both are in Settings and take effect immediately.

Data classes

Who sees what

A Private pilot is invisible to every caller, including their own token, on the public surfaces: passport, threat intel, season recaps, leaderboards, sitemap, squadron and team rosters. Your own data stays available on your dashboard.

Your controls

• Private (Settings → Passport): you disappear from every public surface. Live reads and the passport cache change immediately; derived pages such as leaderboards and season movers follow on their next refresh (at most about 12 hours), the share image within an hour.
• External tools access (Settings → Comms Control): on by default. Off means registered tools receive only Public data for you. Public data is public regardless. Each change is timestamped.

For tool builders

Building a Discord bot or another community tool? Ask the maintainer on Discord for a key. One key per integration; we record a name and a contact. The key is shown once and stored only as a hash on our side.

Authorization: Bearer msk_…

GET https://api.metalstormscout.com/api/v1/public/pilot/<name>
GET https://api.metalstormscout.com/api/v1/player/<name>/threat-intel

Responses have the same shape as anonymous responses; Sensitive fields are filled in instead of nullwhen the pilot's consent is on. A 429 tells you your own limit. Please identify your tool in the User-Agent header.

Terms

1. Present pilots in the spirit of the site: no ridicule, no "worst pilot" lists, no bulk export.
2. Respect Private and External tools access as you find them; never cache around them for longer than 5 minutes.
3. Stay under your rate limit.

Revocationis immediate and permanent: an upheld player complaint, a leaked key, a breach of these terms, or the maintainer's discretion. Audit: every Sensitive read by a registered tool is recorded (tool, pilot, endpoint, time) before the data is served and kept for 90 days. If the record cannot be written, the request gets Public data only.

Principles

• Identity, not User-Agent.
• Deny by default.
• The player owns visibility.
• Named access is accountable: a name, a contact, a revocable key, an audit trail.
• No personal information is stored and no live game APIs are called; all data originates from each player's own extension capture.

Contact

Questions about this policy, a key request, or a complaint about a tool: scout@metalstormscout.com