Privacy Practices

Plain answers about your data.

ResponderOS is built by a first‑line responder, for front‑line responders. The personnel records you put into it — counseling logs, evaluations, station notes — are operationally sensitive. This page explains exactly what we collect, what we do with it, and what we never will. We do not sell or monetize personal data. Ever.

Effective: October 28, 2026 · Last updated: October 28, 2026

Privacy at a glance

The whole policy, in eight cells. Full detail below.

We collect
What the app needs, plus what you or your org choose to enter
We don't sell
Your data to advertisers
We don't track
You across apps or websites
We don't use
Your records for ads or AI training
We use
Crash reports & performance timings to fix bugs & improve the app
Your org owns
The department records you enter in its account
Encryption
In transit (TLS) and at rest
You can
Delete your account or request a copy of your data

01Who we are

ResponderOS is a product of 911Command LLC (referred to as "we," "us," or "ResponderOS" in this policy), a Virginia limited liability company established in 2024. The app is designed for front‑line public safety personnel — fire, EMS, and law enforcement — to document and manage shift‑level operational work.

Contact for any privacy question: Privacy@ResponderOS.App.

02What we collect

Here's what we collect, why, and whether it is linked to you:

Data Why we have it Linked to you?
Email address Account identifier; how you sign in Yes
Profile & role info Your name, rank, shift, station and role identify you to colleagues inside your org: every member of your organization can read them, along with your email address, who your supervisor is, the credentials recorded for you and when they expire, and the training assigned to you and how far along you are with it. If your organization records them, your profile can also hold your phone number, date of birth, home address, demographic details (gender identity, race or ethnicity, veteran and disability status, marital status, education), driver's license number and any other profile fields your organization adds, which your organization's supervisors, managers and administrators (and its training and supply officers) can see Yes
Password (hashed) Sign‑in. Stored only as a hash, by Firebase Authentication — we never store the original. A password you choose when you redeem a claim code (from your department or from us), or one a ResponderOS platform administrator sets or generates for you and gives you, passes through our server once on its way to Firebase and is not saved Yes
Personnel content you create The records you choose to document (counseling logs, evaluations, observations, 1‑on‑1s, coaching notes, station visits, scene notes, etc.), and any written response you add on your own file to a counseling record, a negative observation or an evaluation rated "Does not meet", or your "I have read this" on a negative observation. You can send one response per record, within your organization's response window (30 days unless it sets another, from 7 to 90). A response becomes part of that record: everyone who can read the record sees it, the record's author and the supervisor named on it are notified that you responded unless they have turned those notices off, and the fact that you responded, and when, is recorded in your organization's activity log, which its administrators can read. Once sent, a response cannot be edited or withdrawn in the app Yes
Coaching notes, coaching profiles, pass‑overs, tags and Patterns (leaders only) Records leaders keep about a member. Coaching notes are notes a supervisor, manager or org administrator writes about a member. Your organization's managers and org administrators can read them, and a note is also shared with the member's current supervisor — and, if the supervisor changes, with the next one — while its author leaves sharing on (it is on by default for new notes). Unless your organization switches it off, coaching notes can inform the member's evaluations, including an AI evaluation summary where your organization has turned that on (see Section 3). A leader can start an official record on the member's file from a note; the member sees that record, not the note. Leaders can also keep a coaching profile on a member (strengths, growth areas, an impression of the member's morale, leadership potential and reliability, development goals), which moves to the member's new supervisor when the supervisor changes, and an outgoing supervisor can write a pass‑over, which the member's later supervisors, managers and org administrators can read. Burnout‑risk ratings recorded before October 27, 2026 are kept but no longer shown or used. If your organization turns tagging on (it is off by default), supervisors, managers and org administrators can tag observations, counseling, commendations, 1‑on‑1s and coaching notes with the people, stations, apparatus, policies, protocols, training outlines, incidents or topics involved. A tag is visible only to the leader who added it and to managers and org administrators, and nobody is notified of one. When three or more different leaders tag the same person as a concern (or three tag them as affected) on records from the last 90 days, your org administrators get an item to review. Managers and org administrators also see Patterns, per‑person counts drawn from these and other records (see Section 3). A coaching note marked as containing health, family or leave information is not shared with the supervisor, cannot be tagged (marking a note this way clears any tags it had), and is left out of AI summaries, Patterns and the other counts described in Section 3 Yes. Not shown to the member they concern
Patient care content you create Triage, trauma, cardiac arrest and patient-tracking records your organization documents during incidents. If your organization runs community paramedicine or File of Life, also records about the people it serves (such as name, date of birth, address, phone, conditions, medications, allergies, DNR/POLST status, doctor and pharmacy, emergency contacts, screening answers and signed consent), and the name, relationship, email and phone number of family members it invites to the File of Life family page, with the updates they send there and when they view it. Entered by you, or by the family member for family-page updates; owned by your organization (see Section 5) Linked to the entering responder; patients are documented operationally, not account-linked
Health, pay and ID information about you (only if entered) If you or your organization use the features that hold it: rehab vitals, symptoms and exposures recorded on an incident, and resting baseline vitals for rehab; injury, exposure, safety counseling, physical‑exam, fit‑test and agility‑test records in SafetyKit; blood type, allergies and medical notes for tactical and dive team members, kept on their team profile with their phone number and emergency contacts (and, for tactical teams, date of birth); the reason recorded for an absence on the schedule, which can be medical (see the next row); pay rate and salary in PayrollKit; wellness check‑ins in WellnessKit, which your leaders cannot read (managers and administrators see only department, station and shift‑type averages and counts, with no averages for a group of fewer than five check‑ins or three people); and documents you keep in your own Locker, such as a DD‑214 (which includes your Social Security number) or medical records, which only you can read unless you submit one to your department for verification (see Section 5) Yes. Rehab records and tactical and dive team profiles, including their medical details and contact information: any member of your organization. SafetyKit records: you and your organization's managers, administrators and health and safety officers. Pay: you and your organization's managers and administrators
Schedule, leave and time records Your shifts, leave requests, absences and time‑clock entries, used to staff your organization's schedule and run its payroll. Every member of your organization can read the schedule, including who is absent or on leave, the leave type, the absence reason (call‑out, medical or other) and any absence note recorded on a shift, and your administrators cannot narrow that. Leave requests and their notes are visible to you and your organization's supervisors, managers and administrators, not to other members. Time‑clock entries are visible to you and to those same supervisors, managers and administrators. If your organization turns it on, your supervisor also sees counts of your call‑outs and late clock‑ins (see Section 3) Yes
Location (while using the app) Collected only with your permission to use your location while you are using the app (see below). Used to show your position on the app's maps; on a phone or tablet, while you have an incident open in CommandKit, to share your live position with members of your organization whatever screen you are on, until you leave the incident; to record where you clocked in or out, if your department uses the time clock (kept on your time entry; see Schedule, leave and time records above); to show local weather on your Home screen (your coordinates are sent to Open‑Meteo, a weather service); to find the nearest hospitals in MedKit's destination finder (sent to our server and, for an AI search, to Anthropic, as Section 3 describes; not stored by ResponderOS); to fill in a point you are recording, such as a search find or a casualty collection point, when you tap to use your position; and, while you have vessel tracking turned on in MarineKit, to share the vessel's position with your organization Yes, to members of your own organization
Microphone (push‑to‑talk) Real‑time voice on incident channels. Transmitted live to your team; not recorded or stored by us Heard live by your organization's channel members
Device push token To deliver push notifications you opt into Yes
Photos & files you attach Photos you take or attach and files you upload (for example, incident and scene photos, which can show patients or triage tags; inspection and pre‑plan photos; task and planner attachments; continuing‑education certificate photos; Locker documents; policy documents), stored in Firebase Cloud Storage and linked from the record they belong to. Except for policy documents, each file opens through an unlisted link saved on its record, and anyone who has that link can open the file. Policy documents open only through links that expire after five minutes Yes
Purchases & subscriptions If you buy a subscription: your subscription status and purchase history, used to give you what you paid for. How payments are processed is described in Section 5 Yes
Website forms (only if you use one) If you send an inquiry, book a demo, redeem a code from a ResponderOS mailer, or share a note from the field on responderos.app: your name, email, role or title, department or agency, state, your message and, for a demo booking or an organization code, your phone number (and, for a demo booking, the date and time you pick). To limit spam, we also record the network (IP) address each form is sent from. We use them to reply to you and, for a note you agree to share, to post it on responderos.app with only the details you chose. Your email address is never posted. Redeeming an individual trial code from one of our mailers also records on your account which mailing it came from Yes. A posted note shows only the name and details you chose
Crash & diagnostic info To fix bugs and slow screens: crash reports Apple provides, anonymized by the OS, and, in the app on phones and tablets and in the browser version of the app, Firebase Performance Monitoring's app‑start, page‑load, screen‑rendering and network‑request timings with basic device and connection details, tied to a Firebase installation ID rather than to your account No, though a timed web address can contain an internal account ID (see Section 5)

What we explicitly do not collect

  • "Always" location access — the app asks only for permission to use your location while you are using it, and collects it only for the uses listed in the table above; in the iOS and Android app, Mapbox's map software can also send your location to Mapbox, as Section 5 describes. Your shared position on an incident map is removed when you leave the incident or close the app. MarineKit vessel broadcasts are the exception: if the app closes or is left in the background while a vessel's position is being broadcast, the vessel's last position stays on your organization's marine map until the broadcast is stopped, the vessel comes off the water, or it is taken off the incident
  • Contacts, or camera/photo access beyond what you explicitly initiate (scanning a tag, attaching a photo to a record) — captured content goes only into that record
  • Advertising identifiers (IDFA) or cross‑app identifiers. ResponderOS's own code sets no advertising or analytics cookies. Google Analytics, which we use on some pages of our public website, sets analytics cookies, and Google reCAPTCHA, which the browser version of the app uses, sets its own Google cookies (see Section 5)
  • Full payment card details — payment processors handle those directly (see Section 5)
  • Anything from other apps on your device
Patient & health information (PHI)

ResponderOS may be used by your organization to document patient care (triage, trauma assessments, cardiac arrest care, transport tracking and, if your organization runs them, community paramedicine and File of Life records). Organizations that handle Protected Health Information are responsible for their own compliance with HIPAA, state privacy law, and local regulation, including executing any required agreements with us. ResponderOS never uses patient data for advertising, marketing, or model training.

03How we use it

We use the data above only for the following purposes:

  • To operate the service. Authenticating you, storing and syncing the records you create, the other uses Section 2 gives for each kind of data, supporting you and your organization, investigating security problems, and sending you notifications and email notices (most notification types are on until you turn them off in the app's notification settings).
  • To show leaders reminders and counts about the people they lead (People features). For the members each supervisor, manager or organization administrator supervises (and, while one is covering for another supervisor, that supervisor's members' training, credential, skill‑evaluation and policy‑acknowledgment items), ResponderOS counts items such as overdue training, expiring credentials, late policy acknowledgments, past‑due follow‑ups, upcoming evaluations, failed skill evaluations, repeated negative observations within 90 days and positive observations not yet recognized, and notes when the leader last logged contact; the app calls these considerations. The counts are rebuilt every night, within the hour after an observation, counseling record, commendation, 1‑on‑1 or coaching note about the member changes or the member's supervisor changes, and whenever the leader refreshes. They are shown only to that leader, on My Team and beside an evaluation the leader is writing. Call‑outs and late clock‑ins are counted (three or more in 90 days) only if your organization turns that on, and medical absences and leave never count. Your organization's managers and organization administrators also see Patterns, a view that shows, over the last 90 days or year and for each person ranked below them, how often that person is the subject of negative observations, counseling or coaching notes marked as a concern, how often they are tagged on others' records (if your organization has turned tagging on; tags already placed keep counting after it is turned off), and by how many different people. A person is listed when three or more different people wrote or tagged those records, and anyone with fewer can be looked up by name. The viewer can open the list of records behind a person's count, which shows who wrote or tagged each one. Every Patterns view, lookup and record list is recorded in your organization's activity log. These are counts, dates and links to existing records, never scores. They are never built from the text of a record, from anyone's Private Notebook (the private notes a person keeps for themselves about their supervisors and peers; see Section 5), or from WellnessKit or SafetyKit records. The member they concern does not see them.
  • To improve the app. We may review crash reports and performance timings (described in Section 2) in aggregate — for example, which screens are slow to load — to fix bugs and prioritize improvements. We do not read or analyze the content you create (counseling logs, station notes, evaluations, etc.) for this purpose. That content is processed only to provide the service to you and your organization, including the People features above and the optional AI features below, and to comply with the law.
  • To draft patient care narratives and find receiving facilities (optional MedKit AI features). Each runs server‑side, only when you ask, after you agree the first time (with the one exception noted below for the destination finder). For a trauma clinical summary, ResponderOS sends Anthropic's Claude API the trauma session's data (patient age and weight, mechanism of injury, vitals, GCS, physical exam and ultrasound findings, MARCH interventions, medications, injuries, burn assessment, trauma alert criteria, destination and times), the notes you typed, the provider's name, and the names, ranks and roles of the crew recorded on the session; it is off unless your organization's administrator turns it on, and ResponderOS does not save the draft. For a cardiac arrest narrative, it sends the arrest record's event timeline with its notes, intake details (age, gender, initial rhythm, and whether the arrest was witnessed and whether bystander CPR or an AED was used before arrival), the outcome and times, the provider's name, the names, ranks and roles of the crew, and the exam, scene, history and medication details you type into the narrative form; it has no organization switch, is available to organization members and Individual Plan subscribers once the arrest record is completed, and the draft is saved on the arrest record. Neither sends the call address or a patient name field, but anything typed into a note or form is sent with it. For burn, stroke and STEMI patients, and for other needs when the verified directory finds fewer than three facilities, the emergency destination finder can send your current location (rounded to about 11 meters) and the patient's need category (airway, trauma, burn, stroke or STEMI) to Anthropic, whose web search tool looks for nearby facilities. It asks for your agreement before your first AI search, and our server will not run one until you have agreed. This search is available only while ResponderOS has it switched on, facilities it finds are marked unverified, and ResponderOS does not save its results. The narratives are a documentation starting point, not clinical advice. This data is never used to train AI models.
  • To help a leader write an evaluation (optional AI record summary). If your organization's administrator turns it on, a supervisor writing an evaluation for one of their direct reports, or a manager or org administrator writing any member's evaluation, can ask for a draft summary of that member's record for the evaluation period; each leader agrees before first using it. ResponderOS platform administrators can also run it (see Section 8). When someone asks, ResponderOS sends Anthropic's Claude API, server‑side: the member's name, rank, position and start date; up to three prior signed evaluations (rating and narrative) and the member's self‑evaluation for the period; the period's counseling records, commendations, observations and completed 1‑on‑1s, with any written responses the member added to that counseling and those observations; probation and development‑plan progress; any counts from the member's record that the leader ticks (for example, overdue training); and, unless your organization switches this off, the coaching notes and shared pass‑overs that leader can open and the strengths and growth areas in the member's coaching profile, none of which the member can see. Authors' names are included. Coaching notes marked as containing health, family or leave information, unshared pass‑overs, morale ratings and notes, wellness check‑ins and anyone's Private Notebook are never sent. At most 20 records of each kind are sent, and each passage of text is cut at 600 characters. The summary is shown to the leader and not saved by ResponderOS. Each summary generated is recorded in your organization's activity log: who ran it, for whom, how many records of each kind went in and which counts were ticked, not their text. The member is not notified. With an Individual Plan, you can run it for the direct reports you keep in your own account; your own coaching notes from the period are included, with no setting to leave them out, and no activity log entry is written. This data is never used to train AI models.
  • To summarize your own Private Notebook notes (optional). If you ask for a summary of the notes you keep about one of your supervisors, ResponderOS sends Anthropic's Claude API, server‑side, up to your 300 most recent notes about that supervisor. For each note it sends the type and date, where it happened, who was present, what happened, your response, follow‑ups and any addenda. It also sends that supervisor's rank and position, the period they supervised you, whether they still do, and your standing notes about them. The name you saved for them is not sent, but your notes go exactly as you wrote them. You agree each time, only you can request a summary, and your department does not receive the notes or the summary. ResponderOS does not save the summary. We record only that you agreed, when, which supervisor and focus you chose, and how many notes were sent, plus a monthly count of your summaries. This data is never used to train AI models.
  • To match spreadsheet columns (optional). If your organization's administrator turns it on (roster import and incident‑file import each have their own switch), an org administrator importing a roster or an incident file can ask for suggested column matches. From the file, only its first row, which the importer reads as the column headings, is sent to Anthropic's Claude API, server‑side, together with the names of the fields they could match. No other row of the file is sent, and each suggested match still needs the administrator's confirmation.
  • To help your department manage its policies (optional PolicyKit AI features). If your organization's administrator turns them on, PolicyKit sends policy text to Anthropic's Claude API, server‑side, only when someone asks: for a plain‑language change summary, the policy's type, number and title, its version numbers, the author's own change summary and the text a revision changes, before and after — the draft is kept on the revision, where its reviewers and the officers who manage it can read it, and members see it only after the publisher edits and approves it; and, for the legal and standards scan, the full text of one policy (or, for a policy kept as a PDF, the PDF file itself), with web searches for laws, regulations and standards that may apply in your department's state. To answer a question asked of the manual, the question and the text of the policies the person asking can read that best match it — matching sections, or whole PDF files — and never a policy they cannot read; the answer cites the sections or pages it came from, and ResponderOS does not keep the question (one the manual could not answer is counted only as anonymous keywords, which your department's policy officers see). For draft checks, the text of a draft and of the policies it references or shares a topic tag with, among those the person running the check can read. For quiz drafting, the text of a revision — what it changed, or the whole text of a first version. For AI import, the text of an uploaded Word document, or an uploaded PDF with a text layer (or, to convert a policy kept as a PDF, that PDF), sent through Anthropic's Files API and deleted from Anthropic's file storage when the run ends; nothing imported is saved until an officer accepts it. Each feature is off unless your administrator turns it on, each person agrees before first using one (the legal scan asks every time), and scan findings are not legal advice. This data is never used to train AI models.
  • To communicate with you. Sign‑in confirmations, password resets, security notices, invitations and notification emails.
  • To comply with the law. If we receive a valid legal request, we will comply with it. We'll notify your organization administrator unless legally prohibited.

04What we don't do

This section exists because it's the part most worth being clear about.

  • We do not sell, rent, or monetize personal data. Not to advertisers, not to data brokers, not to anyone.
  • We do not run advertising in the app. No banner ads, no native ads, no sponsored content.
  • We do not track you across other apps or websites. ResponderOS does not use Apple's App Tracking Transparency framework because we do not track.
  • We do not use the personnel content you create for our own purposes. Your counseling logs, evaluations, station notes, and other records are stored encrypted, and who can read each one depends on the reader's role and relationship to the record (see Section 8). ResponderOS processes them only to provide the service you and your organization use (for example, the counts and AI summaries described in Section 3) and to comply with the law. We do not use them to train models, to advertise, to improve features, or for any other purpose of our own.
  • We do not share your data with anyone outside of the providers and your organization, as listed in Section 5, except to comply with a valid legal request (see Section 3) or when you ask us to, such as posting on responderos.app a note from the field you agreed to share.

05Sharing & processors

To operate the app, we rely on a small number of trusted infrastructure providers. They process data on our instructions to provide the service named, except where this section says a provider collects data under its own privacy policy (Mapbox's map software, Google Analytics and Google Fonts on our public website, Apple's iOS diagnostics, and Apple's and Google's in‑app purchases, which you make with your own Apple or Google account) or is one of the free public services described under Weather and address lookups.

Google (Google LLC)

ResponderOS runs on Google Firebase and Google Cloud, and sends email through Google Workspace. Google provides these services to us:

  • Firebase Authentication — handles sign‑in and sends the email‑verification and forgot‑password emails. Receives your email address and password, and stores the password only as a one‑way hash.
  • Cloud Firestore — stores the records you create. Encrypted at rest in Google's US‑based data centers.
  • Firebase Realtime Database — carries live positions on incident maps and vessel tracking while they are being shared.
  • Cloud Storage for Firebase — stores photos and files attached to records, and files the app generates, such as payroll and policy exports.
  • Cloud Functions — runs ResponderOS's server code, including its requests to Anthropic, Expo, Stripe and RevenueCat.
  • Firebase App Check — in the browser version of the app, confirms requests come from the genuine app using Google reCAPTCHA Enterprise, which collects information about your browser and device and sets its own Google cookies.
  • Firebase Hosting — serves this website, the browser version of the app and ResponderOS's web portals.
  • Firebase Cloud Messaging — on Android, delivers the push notifications Expo hands to it (see below). Receives your device push token and the contents of notifications we send.
  • Gmail (Google Workspace) — sends the email our servers send, such as invitations, account and credential notices, notification emails, demo‑request confirmations, and website‑form submissions forwarded to us. Receives each recipient's address and the message. We receive website inquiries, notes from the field, demo requests and organization‑code requests from our mailers in our own Google Workspace mailbox.

Google's processing of this data is governed by the Firebase Data Processing and Security Terms and, for its Google Cloud and Google Workspace services, Google's data processing terms for those services. We do not use Firebase Analytics or Crashlytics. We use Firebase Performance Monitoring for app performance timings (described in Section 2). It does not receive the stored content of your records, but it records the web address of each network request it times (without the part after a question mark), and some of those addresses contain an address being looked up on the map, the location of a weather check, or the name of a file being loaded and the internal ID of the record or account it is attached to.

Apple Inc. & Expo

Push notifications are sent through Expo's push service (Expo, Inc.), which receives your device push token and notification contents in transit and hands each notification to the Apple Push Notification service (APNS) on iOS, or to Firebase Cloud Messaging on Android, for delivery to your device. Apple may also collect anonymous diagnostic information through iOS itself, governed by Apple's own privacy policy. Neither Apple nor Expo receives the stored content of your records.

LiveKit (voice)

Push‑to‑talk voice on incident channels is carried in real time by LiveKit's infrastructure, which also receives your account ID and display name, to identify you on the channel, and the internal IDs of your organization and the incident, which name the channel. Audio is transmitted live to your channel and is not recorded or retained by us.

Anthropic (optional AI features)

When someone uses one of the AI features described in Section 3, the data that section lists for that feature is processed by Anthropic's Claude API to produce the requested output. Depending on the feature, that can include a named member's personnel records, the names of the people who wrote them and, unless your organization has turned it off, the coaching notes, shared pass‑overs and coaching profile leaders keep about that member (the evaluation summary); your own private notes about a supervisor (the Private Notebook summary); patient care data and crew names (MedKit narratives); or your current GPS location (the destination finder). Anthropic processes it as a service provider and, under our API usage, keeps API inputs and outputs only for the limited period its commercial terms allow and does not use them to train models.

If your organization enables PolicyKit's AI features, the policy text described in Section 3 — and, for a question asked of the manual, the question — is processed by Anthropic's Claude API on the same terms. For the legal and standards scan, Anthropic's web search tool runs searches that the AI writes from the policy's text, using your department's state as the search location; the pages it returns are listed as sources with the findings. For AI import, a PDF is held in Anthropic's Files API only for the run that reads it and is deleted from there when the run ends (if a run stops early, a scheduled cleanup deletes it afterwards).

Payments (Stripe, Apple, Google, RevenueCat)

Individual subscriptions purchased on iOS/Android are processed by Apple or Google through in‑app purchase, with entitlements managed by RevenueCat; web and organizational purchases are processed by Stripe. We never see or store full payment card details — payment processors handle those directly.

Mapbox (maps)

Maps, map tiles and address lookups are served by Mapbox, which receives the map area your device requests, the addresses the app looks up (what you type into an address search, and the saved addresses of stations, hospitals, occupancies and pre‑plan buildings that the app converts to map coordinates), and, for a pre‑plan's aerial image export, the building's location and the positions of its map markers. In the iOS and Android app, Mapbox's map software may also send Mapbox its own usage and diagnostic data, which can include an anonymous identifier and, when you have allowed location access, your device's location, under Mapbox's privacy policy. Mapbox says it uses this data, de‑identified, to improve its maps and its traffic and movement data products, and that it does not sell personal data. From app version 1.3.9 you can turn this off on your Profile screen (“Share map usage with Mapbox”); maps work the same either way, and Mapbox still receives the map requests described above and, for billing, a count of active app users that includes an anonymous identifier.

Weather and address lookups

Some features look things up with free public services. The Home screen's weather comes from Open‑Meteo, which receives your device's location if you allow location access. Weather and weather alerts for planned events and rehab scenes come from the U.S. National Weather Service, which receives the event's or scene's location. Addresses in imported incident files that have no coordinates (only when the person importing starts that step), and incoming CAD incidents that arrive with an address but no coordinates, are matched to map locations by the U.S. Census Bureau's geocoder, which receives those addresses. None of these services receives your name or account. Open‑Meteo, the Weather Service and, for imports, the Census Bureau are contacted from your device, so like any website they also see its network (IP) address.

Google Analytics and Google Fonts (our public website)

Some pages of our public website, responderos.app — including the home page, the app download page and the demo booking page — use Google Analytics to measure visits and how those pages are used, such as which pages are viewed and which app store button is tapped. Google receives your IP address, browser and device details, the page that referred you and the pages you view, and Google Analytics sets its own cookies in your browser so it can recognize return visits. We use it only to understand traffic and how the website performs; its advertising features are turned off, and we don't use it for advertising. Most pages of our website, including this one, also load fonts from Google Fonts, which receives your IP address and browser details. Google Analytics is not used in the ResponderOS app or the browser version of the app.

Your organization (if applicable)

If you use ResponderOS through an organizational license — for example, your fire department or EMS agency — the data you create within the app is accessible to other members of that organization according to their role, designations and reporting relationship to you, as Section 8 describes, and to the organization's administrators. Your Private Notebook (your own notes on your supervisors and peers) and your Locker (your personal career records) are exceptions: no one in your organization can read them, and they stay with your account if you leave the organization. The one way your organization sees a Locker record is if you submit it for verification: your organization's training officers, managers and administrators then see a copy of that record and its attachments while it is under review. Your WellnessKit check‑ins are another exception: no one else in your organization can read them, and its managers and administrators see only the group averages and counts described in Section 2. ResponderOS's own access to these records is described in Section 8. Your organization is the data controller for personnel and patient care records; ResponderOS is a data processor acting on the organization's behalf. Organizations handling Protected Health Information are responsible for their own HIPAA and state-law compliance, including executing any required Business Associate or Data Processing Agreement with us.

What this means in practice

The only external parties involved in your data are these providers — Google (backend, email, app verification and, on our public website, analytics and fonts), Apple/Google/Expo (notifications and purchases), LiveKit (live voice), Mapbox (maps), Open‑Meteo, the National Weather Service and the U.S. Census Bureau (weather and address lookups), Stripe/RevenueCat (payments), Anthropic (only when someone uses one of the optional AI features, such as AI summaries or PolicyKit's AI features) — and, if applicable, your own organization. No advertisers, no data brokers, and no analytics in the app beyond the performance timings and Mapbox's own map diagnostics described above.

06Data retention

We retain data as long as it serves the purposes described in this policy, or as long as your organization keeps it, as set out below:

  • Account data. Retained for as long as your account is active. If you delete your account, we delete the associated authentication record within 30 days.
  • Personnel records. Records in an organization's account — evaluations, counseling, observations, commendations, probation and development plans, 1‑on‑1s, coaching notes, coaching profiles and pass‑overs, and members' responses to records — are kept until someone your organization permits deletes them; ResponderOS does not delete them on a schedule. They stay with the organization when their author, or the member they concern, leaves it or deletes their account. If you leave an organization or delete your account, you can still appear in its Patterns, whether or not tagging is on. If your organization had tagging on while you were a member, your name also stays on the list its leaders tag from, marked as a former member: its leaders can still tag you on its records while tagging is on, and its administrators can still place a legal hold on your records there. ResponderOS also keeps its own copy of each member's response, which it uses to put the response back if anyone changes it on the record; that copy is kept even after the record is deleted. If you use ResponderOS individually (without an organization), records you create are retained until you delete them or, while you have no organization, delete your account. If you have since joined an organization, deleting your account leaves them in place; email us to delete them (see Section 7).
  • Tags. If your organization turns on tagging, the tags on a personnel or coaching record are cleared about 36 months after the record was created, or after a different period your organization sets (6 to 120 months), unless your organization has placed a legal hold on the records of the person the record is about. Clearing runs only while tagging is turned on: if your organization turns tagging off, existing tags stay as they are until it is turned back on. Clearing a tag does not erase its history. A log of every tag change (the tags themselves, who placed or removed each one, and when), and any review opened because of tag patterns, is kept with your organization's records and is not deleted automatically.
  • Website forms. Inquiries, demo bookings, mailer codes you redeem and field notes are kept so we can follow up with you; they are not deleted on a schedule. A posted note stays up until you ask us to take it down; email Privacy@ResponderOS.App and we will delete the note and the details we stored with it. Copies of the email notices sent when you wrote to us, and the spam‑protection counters keyed to your email address and IP address, can remain in our email systems and records after that.
  • Backups. Encrypted backups may retain data for up to 90 days after deletion before being permanently overwritten, as part of normal disaster recovery.
  • Legal holds. Where required by law, we may retain specific records longer. If this happens to your data, we'll notify you unless prohibited. Separately, your organization's administrators can place their own legal hold on a member's observations, counseling, commendations, 1‑on‑1s and coaching notes. While it lasts, a covered record that is deleted is put back. That hold is your organization's decision, and ResponderOS does not notify the member of it.

07Your rights

Regardless of where you live, you can do the following at any time:

  • Access — request a copy of the data we have about you.
  • Correct — ask us to correct inaccurate data we hold about you (for records your organization keeps, see below).
  • Delete — delete your account in the app, or ask us to. Deleting it in the app removes your sign‑in, your profile and your Private Notebook — right away if you have no organization, or after a 7‑day waiting period (which you can cancel) if you belong to one. Without an organization, it also removes the records you keep on your own direct reports, such as their evaluations, counseling and coaching notes. An organization administrator has to hand that role to another member and step down before deleting in the app, and a legal hold on your Private Notebook blocks deletion until it is released. Records kept in your organization's account, including ones you wrote and ones about you, stay with your organization (see Section 6). Email us to delete anything else in your account, such as your Locker documents and their attachments.
  • Export — receive your data in a portable format (JSON or CSV).
  • Withdraw consent — for any optional processing you previously opted into.
  • Object — to any processing you believe is unnecessary or excessive.

Records kept in your organization's account, including the leaders‑only records described in Section 2, are your organization's to manage: it decides how to answer a request to access, correct, delete, export or object to them. We refer such requests to your organization, and we do not release those records to you without its instruction unless the law requires it.

To exercise any of these, email Privacy@ResponderOS.App. We'll respond within 30 days. We do not charge for these requests.

Residents of California, Virginia, Colorado, Connecticut, and Utah

You have additional rights under your state's privacy laws (CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA), including the right to opt out of the "sale" or "sharing" of personal information. ResponderOS does not sell personal information. Some pages of our public website use Google Analytics, with its advertising features turned off; it sets its own cookies (see Section 5). You can still exercise any of the rights listed above by contacting us.

08Security

We take security seriously because the records you put into ResponderOS are operationally sensitive. Our practices include:

  • Encryption in transit using TLS 1.2 or higher for all communication with ResponderOS and the providers in Section 5 (push‑to‑talk voice is encrypted with WebRTC's DTLS‑SRTP). One exception: an aircraft video feed your department adds in AirKit plays straight from the stream address it enters — an aircraft downlink, decoder or camera — not through ResponderOS, and that connection may not be encrypted (RTSP, RTMP, UDP and plain http:// feeds are not).
  • Encryption at rest for the data ResponderOS stores in Google Firebase, using Google's default AES‑256 encryption. What the app keeps on your phone, tablet or browser — copies saved for offline use, such as pre‑plans and MedKit protocols, and the cardiac arrest records of someone with no organization and no Individual Plan, which are kept only on that device — is protected by the device's own security, such as its passcode.
  • Role‑based access controls at the organization level — ResponderOS sets what each role can see, and your organization decides who holds each role and designation, who reports to whom, and which optional features are on. Some information, such as the schedule and incident maps, is visible to every member of your organization.
  • Org access is admin‑controlled — anyone can create an individual account, but joining an organization (and seeing any of its data) requires an invitation from that organization's administrators, an account they create for you, or a join request they approve. ResponderOS platform administrators can also invite or add an account to any organization.
  • Audit logging of administrative actions within your organization.
  • Platform administrator access — a small number of ResponderOS platform administrators can read, and in most cases change or delete, the records kept in ResponderOS, for organizations and individual accounts alike, including personnel records, the records leaders keep (such as coaching notes), and safety, wellness check‑in and patient‑care records. We use this access to operate and support the service, investigate security problems and meet legal obligations. Your organization does not grant or control it. Platform administrators can also run the AI evaluation summary described in Section 3 for a member of any organization that has it turned on; each summary they generate is recorded in that organization's activity log. In the app they cannot read your Private Notebook or your Locker, except a copy of a Locker record you submit to your department for verification, while that review is open. They can place a legal hold on a Private Notebook themselves, giving a case reference and a reason, and can export the notebook only while that hold is active; its owner is told when the hold is placed and each time the notebook is exported, and every export is logged.
  • No password storage on our end. Firebase Authentication hashes passwords; we never store them in plain text.

No system is ever fully secure. If you become aware of a vulnerability, please report it to Security@ResponderOS.App. If a breach affects you, we'll notify you within 72 hours of becoming aware of it.

09Children's privacy

ResponderOS is a professional tool for adult public safety personnel. It is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13 years of age. If we learn that we have collected information from a child under 13, we will delete it promptly. This does not cover records your organization keeps about the people it serves, such as patient‑care records, which can describe children; those belong to your organization (see Section 5). If you believe a child has provided us with personal information, contact us at Privacy@ResponderOS.App.

10Where data is stored

ResponderOS stores its records in the United States, in Google Firebase data centers. Copies held elsewhere, such as email in our mailboxes and the AI requests Anthropic keeps for a limited period (see Section 5), and what the app saves on your own device, are kept wherever those systems keep them, which may be outside the United States. If you access the app from outside the U.S., your data will be transferred to and processed in the U.S. By using ResponderOS, you consent to this transfer. We do not currently support data residency in other jurisdictions; if your organization requires it, contact us to discuss options.

11Changes to this policy

If we make material changes to this policy, we'll notify you by email and/or by an in‑app notice before the changes take effect. The effective date at the top of this page reflects when the current version was published. Continued use of ResponderOS after a change indicates acceptance of the updated policy.