Privacy

What the phone app collects

• Your name, and if you add them, your role, call sign and equipment.
• Your status (available, on task, need help, injured) and when you check in and out.
• Your location, only while you are checked in and an incident is open, including when the app is in the background or the phone is locked, so your team leader can send help to where you are. It stops when you check out, and whenever no incident is open: checked in with no incident open, your position is not shared. Before you check in, your position is sent only once, with what you send: a request to check in from where you are, or a report.
• What you send: reports (with a photo if you take one, and your location), messages, and updates on your tasks.
• Your feature requests, bug reports and votes, if you send any.
• Technical identifiers: a key created on your phone that identifies it to your team, and a notification token from Apple or Google so the app can notify you.

The app has no advertising and no analytics or tracking services. Nothing is sold or shared for marketing.

Who sees it

• Your team leaders see everything above for their own team, including your location while you are checked in during an incident.
• The members of your team see your name, status and the team's tasks and messages.
• The county emergency operations center (EOC) sees each team's readiness and counts (how many members are checked in, need help or are injured), and the team's reports with the reporter's name, location and photo.
• County administrators of the server can export a team's record, for example for an after-action report.

You join a team only in person, by scanning your team leader's code, or with a personal invitation from your leader that they approve. Other teams do not see your information.

Where it is kept

• On your phone, encrypted, so the app keeps working without signal, and only until it is sent: what the phone cannot send for 10 days is deleted from it. When you check out, your team's information and the app's notifications are removed from your phone. If you forget, the phone checks you out itself: when your team leader closes the incident (after sending what it still has), or when you do not answer “Still on duty?” for a day.
• On the county's CERT Command server (in the United States), as the team's activation record.
• On your team leader's computer, encrypted, so the dashboard keeps working offline.

Services that help deliver it

• Apple and Google deliver notifications to your phone. They see the notification's text, not the rest of your team's information.
• OpenStreetMap turns a position into a street address for reports and the leader's map. It receives coordinates only, never your name.
• DigitalOcean hosts the server. Brevo sends the email to people who join our mailing list or are invited as team leaders.

Deleting your information

• On your phone: check out (⋯ > Check out), or delete the app. Both remove your team's information from the phone. Without either, the phone removes it by itself when the incident closes or after a day without an answer to “Still on duty?”.
• On the server: ask your team leader to remove you, or email privacy@certcommand.org with your name and team. Your records are deleted within 30 days, except what the county must keep for an active emergency, which is deleted when it ends.

Age

CERT Command is for adult CERT volunteers and is not directed at anyone under 18.

Questions

CERT Command is run by Frank Gadot (W6FGC), Manatee County, Florida. Email privacy@certcommand.org. If this policy changes, this page says so, with the date.

Using CERT Command is also covered by the Terms of Use.