What this privacy policy covers
This privacy policy pertains to the use of the EMAssistant website at emassistant.com, the EMAssistant web application, and all EMAssistant mobile applications including the EMAssistant app (formerly FRAssistant) for iOS and Android (collectively, the "Service" or "Services"). This privacy policy covers how EMAssistant ("EMAssistant", "We", "Us", or "Our") treats personal information that we collect and receive. It also describes the choices available to you regarding our use of your personal information and how you can access, update, and delete this information.
Personal information is information about you that is personally identifiable, such as your name, address, email address, phone number, or location data. Children under 13 are not permitted to use the Service, and so this privacy policy makes no provision for children's use of the Service.
Information we collect
Account Information
When you create an account, we collect:
- Name - To identify you within your organization and on ICS forms
- Email address - For account authentication, notifications, and communications
- Phone number (optional) - For emergency alerts
- Organization membership - To connect you with your department(s)
- Role and qualifications - For ICS position assignments and certifications
EMAssistant Mobile App
Our EMAssistant mobile application for iOS and Android collects the following additional information:
- Location data - When you grant permission, we collect your location to show nearby incidents, coordinate with team members during emergency response, and provide location-aware alerts. You can disable location access at any time in your device settings.
- Continuous location sharing during an incident - Separately, and only when you switch on "Location sharing" for an incident you are signed in to, the app records your position approximately every 5 seconds and sends it to your organization. This continues while the app is closed and your screen is off, so that incident command can see where responders are; your device shows an ongoing notification for the entire time it is active. Your live and recorded positions for that incident are visible to incident command and to other responders on the same incident. Sharing is off by default, is chosen per incident, and stops as soon as you switch the toggle off, sign out of the incident, or sign out of the app. We do not track your location when sharing is off.
- Photos and camera - When you grant permission, we access your camera and photo library to capture incident documentation, attach images to ICS forms, and upload certification photos. Photos are only uploaded when you explicitly choose to attach them.
- Push notification tokens - To deliver emergency alerts, incident updates, and important notifications to your device.
- Device information - Basic device identifiers for push notification delivery and crash reporting.
Usage and Analytics Data
We collect analytics and crash reporting data to improve our services:
- App usage patterns - Which features you use and how you navigate the app
- Crash reports - Technical information when the app encounters errors
- Performance metrics - App load times and responsiveness
This data is collected through Firebase Analytics and Crashlytics.
Website Analytics
The emassistant.com website records how it is used. This is our own software, running on our own servers — there is no Google Analytics, no advertising network, and no third-party analytics or tracking service on this site. We do not need your visit to be tied to a name, and we do not try to make it one. What we record is:
- An anonymous visitor ID - A random identifier we generate and keep in your browser's local storage (not a cookie), plus a separate ID for the current visit. It contains nothing about you; it only lets us tell "one person came back three times" from "three people came once." Clearing your browser's site data for emassistant.com erases it, and your next visit gets a brand-new ID.
- Pages you viewed - Which pages you opened, when, and roughly how long each one was in front of you.
- How you arrived - The referring website or search engine, and any campaign tags (utm_source and similar) in the link you followed.
- Coarse location - Country, state or region, and city, looked up from your IP address. We do not collect GPS or precise location on this website. The lookup runs against a database file on our own server; your IP address is not sent to an outside geolocation service.
- Network operator - The organization that owns your IP address block (your internet provider, or an agency's own network). This helps us understand what kinds of organizations are interested in EMAssistant.
- Your IP address and browser details - The IP address itself, your browser's user agent string, screen size, and language. The IP address is kept so we can tell real visits from bots and automated scanning.
- JavaScript errors - If a page breaks in your browser, we record the error message and stack trace so we can fix it.
We use this to understand how the site is being used and what people are looking for, and to keep it working. When you send us a message through our contact form, we also attach the visitor ID stored in your browser to that message, so we can see which pages you were reading before you wrote to us and respond with that context.
Website analytics data is deleted after 13 months. When a visit is deleted, its pages, timings, and IP address go with it, and the link between your message and that browsing history is cleared — your message itself is kept, as described under "Information You Provide" below.
Information You Provide
Through your use of our Services, you may provide:
- ICS form data and incident reports
- Activity logs and personnel tracking information
- Certification and training records
- Communications with other users
This information remains your property as between EMAssistant and you (User Information). You grant EMAssistant a non-exclusive, royalty-free license to store, process, and transmit this information for the purpose of providing our Services.
When you send us a message through our contact form, we link that message to the anonymous record of your visits to this website from the same browser, as described under "Website Analytics" above, so that we can respond with an understanding of what you were looking for. We keep your message and our correspondence with you for as long as we are in contact; the browsing history it is linked to is deleted on the 13-month analytics schedule, after which the message stands on its own.
How we use your information
We use your information to:
- Provide, maintain, and improve our Services
- Authenticate your identity and manage your account
- Connect you with your organization(s) and team members
- Deliver emergency alerts and notifications
- Generate ICS forms and incident documentation
- Provide location-based features during emergency response
- Analyze usage patterns to improve our products
- Diagnose and fix technical issues
- Communicate with you about your account and our Services
- Comply with legal obligations
Information sharing and disclosure
EMAssistant does not rent, sell, or share personal information about you with other people or nonaffiliated companies for promotional purposes.
We may share your information in the following circumstances:
- With your organization - Organization administrators can see member information, activity logs, and ICS form data as necessary for emergency management operations.
- With others on an incident - While you have location sharing switched on for an incident, your position is shown to incident command and to other responders participating in that incident.
- With service providers - We use third-party services to help operate our platform (see "Third-Party Services" below).
- For legal reasons - We may disclose information to comply with subpoenas, court orders, or other legal requirements, or when your actions violate our Terms of Service.
- For safety - To investigate, prevent, or take action regarding illegal activities, suspected fraud, or situations involving potential threats to physical safety.
- In a merger or acquisition - If EMAssistant is acquired or merged, we will notify you before your information is transferred to a different privacy policy.
Certain non-personal data may be used in an aggregated or anonymized fashion for research to improve our services and provide improved information for the emergency management community. For example, analyzing anonymized incident data to improve response time predictions.
Third-party services
We use the following third-party services to operate our platform:
- Amazon Web Services (AWS) - Cloud hosting and data storage (us-east-2 region)
- Firebase (Google) - Push notifications, analytics, and crash reporting
- Email service providers - For sending notifications and alerts
These services have their own privacy policies and are contractually required to protect your data. We only share the minimum information necessary for each service to function.
Data storage and security
Your data is stored within the United States in Amazon Web Services' cloud hosting environment (us-east-2 region). All data is encrypted in transit using TLS and encrypted at rest using AES-256.
On mobile devices, authentication tokens are stored securely using:
- iOS - Keychain Services
- Android - EncryptedSharedPreferences
While we follow industry-standard security practices, no method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your information.
Data retention
We retain your personal information for as long as your account is active or as needed to provide you services.
Due to the nature of emergency management, most operational data must be retained for legal compliance and record-keeping purposes. When you delete your account:
Data that will be deleted
Personal data that has not been shared with an organization will be removed:
- Your login credentials and authentication data
- Personal mileage log entries
- Emergency contact information
- Notification preferences and personal settings
Data that will be retained
The following data is retained for legal compliance and organizational record-keeping:
- Audit logs - All system activity records are retained for compliance
- Certifications - Training and certification records that were shared with an organization
- Media files - Photos, documents, and other files shared with an organization or attached to an incident
- ICS forms and incident records - Any information you provided on forms attached to incidents, including your name and role assignments
- Incident location history - Positions recorded while you had location sharing switched on are part of that incident's operational record and are retained with it
We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.
Your rights and choices
Access and update your information
You can access and update your personal information at any time through your account settings in the app or web application.
Delete your account
You can request deletion of your account at any time:
Account deletion removes your login access and personal data not shared with organizations. See "Data retention" above for details on what data is deleted versus retained for legal compliance.
Control permissions
You can control what data our mobile app can access through your device settings:
- Location - Enable or disable in device settings. Location sharing during an incident has its own in-app switch on the incident screen, which you can turn off at any time without changing your device permissions
- Camera and photos - Enable or disable in device settings
- Push notifications - Enable or disable in device settings
Disabling certain permissions may limit functionality. For example, disabling location will prevent location-based incident alerts.
Withdraw consent
You can withdraw consent for data collection at any time by adjusting your device permissions or deleting your account.
Single Sign-On
You can log in to EMAssistant using supported single sign-on providers. These services authenticate your identity and may share certain information with us (such as your name and email address) with your permission. We do not receive or store your password from these services.
Links to other sites
Our Services may contain links to third-party websites. We are not responsible for the privacy practices of these sites. We encourage you to review the privacy policies of any site you visit.
Children's privacy
Our Services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete it.
Changes to this policy
We may update this policy at any time. We will notify you of significant changes by posting a notice on our website or sending you an email. We encourage you to periodically review this page for the latest information on our privacy practices.
Contact us
If you have questions about this privacy policy or our data practices, please contact us through our Contact page.