Privacy policy

Last updated 25 July 2026

Fit Scout is a small independent site that indexes menswear by real garment measurements. This page describes what it actually does with data — not a template. If something isn't listed here, the site doesn't do it.

The short version

• No analytics, no advertising network, no tracking pixels, no third-party scripts. None.
• You can browse and search the entire catalog without an account.
• An account stores your email address, an optional name, a password hash, and the fit windows you save.
• Fonts, stylesheets and scripts are served from this site's own servers, not a CDN that would see your visit.

If you just browse

• Server request data. Like any web server, ours handles your IP address, user agent, the URL you asked for and a timestamp. It is used to serve the page and to notice abuse.
• A CSRF cookie (ff_csrf) is set on pages that carry a form. It holds a random token used only to check that a submission came from this site. It is not looked up against any profile and identifies nothing about you.
• Nothing else. There is no analytics cookie, no advertising cookie, and no third-party script running on the page.

If you create an account

• Your email address — needed to sign in and to send verification and password-reset messages.
• A display name, if you sign in with Google and Google supplies one.
• Your password as a bcrypt hash, never in plain text. Accounts created through Google have no password at all.
• The fit windows you choose to save, per category.
• Session records — a hashed session token and its expiry — so you stay signed in. The session cookie (ff_session) is HttpOnly, SameSite=Lax, marked Secure over HTTPS, and expires after 30 days.

If you use "Sign in with Google"

We ask Google for the openid, email and profile scopes. From the response we keep your Google account's subject id, your verified email address, and your name if one is present. We never receive your Google password, and we don't request or receive your contacts, calendar, Drive, or anything else — nor do we write anything to your Google account.

Stored in your browser, not on our server

Your light/dark preference is kept in your browser's localStorage under fs-view. It is never sent to the server. Clearing site data removes it.

Who else sees anything

• Cloudflare — the site is served through Cloudflare (DNS, TLS and tunnel), so it handles the request metadata for every visit.
• Resend — sends the two transactional emails this site can send (verify your email, reset your password). It receives your address and that message. There is no newsletter and no marketing email.
• Google — only if you choose "Sign in with Google", and only for that sign-in.
• The brand or retailer you click through to — following an outbound product link is an ordinary web request to their site, and they see it like any other visitor's. Some of those links are affiliate links, so the retailer or its affiliate network can tell the click came from Fit Scout. Your price is unchanged.
• Product images — most are re-hosted on our own storage (Cloudflare R2). Where an image hasn't been copied across yet, the card loads it straight from the brand's own CDN, so your browser makes a request there. Those requests are sent with referrerpolicy="no-referrer", so the brand isn't told which page you were on.

That is the complete list. No advertising network, no data broker, no analytics vendor.

What we don't do

• We don't sell, rent or trade personal data.
• We don't build advertising or behavioural profiles.
• We don't email you anything you didn't ask for.
• We don't run third-party trackers.

How long things are kept

• Session records until they expire (30 days) or you log out, whichever comes first.
• Email-verification links expire after 24 hours; password-reset links after 1 hour.
• Account data for as long as the account exists.
• Deleting your account (Account → Delete my account) really deletes the account row; your sessions, saved fit windows and email tokens are removed with it. Disabling keeps the row but blocks sign-in.

Your choices

• Browse the whole site without ever making an account.
• Delete your account yourself, at any time, from the account page.
• Ask what we hold about you, or ask us to correct or remove it — email the address below and we'll do it by hand.

If you're in the EU or the UK

This is a one-person project, and we're not going to claim a formal compliance programme we don't have. What we can tell you is exactly what's above: the data collected is the minimum needed to run accounts and serve pages, it isn't sold or shared with advertisers, and you can have it deleted on request or by pressing the delete button yourself. If you need the controller identity for a formal request, use the contact address below. OWNER TO FILL IN: registered controller name / postal address, and an EU or UK representative, if you decide you need one.

Where the product data comes from

The catalog is compiled from information published on brands' and retailers' own storefronts — product titles, prices, stock, images and published size charts. If you are a brand or retailer and want your catalog removed, email us and we'll take it down.

Children

Fit Scout isn't directed at children under 13 and we don't knowingly collect their data.

Changes

If this policy changes, the date at the top changes with it. A material change to what is collected will be called out on the site rather than slipped in quietly.

Who runs this and how to reach us

Fit Scout is an independent project, not a registered company. OWNER TO FILL IN: legal entity or trading name, if one is ever registered. Questions about anything on this page: [email protected].