iCrew — Privacy Policy

Graham Murt, trading as iOnCall ("we", "us", or "our"), operates the iFire, iCrew and iRescue mobile applications (the "App"), the Station Dashboard web application at https://icrew.ifireapp.net/dashboard/ (the "Dashboard") and the crew board, a web page a station can show on a crew-room screen (the "Crew board"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services. By using the App you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

Personal information

When you use the App or the Dashboard, we may collect the following:

Name (first and last name) and nickname
Email address and phone number
Station, crew and rank assignments, qualifications and crew numbers configured by your station
Your availability: your current status, your availability plan (including leave and any repeating rota you set up with “Set my rota”), and the history of changes to it
Your responding status during a callout, and a log of each change to it (when it changed, to what, and from which device)
Contracted hours, if you set a weekly target
Your choice of line manager, if you choose one
A profile photo, if you or a station admin adds one
Resource markers you create (hydrants, defibrillators, site risk information) including any photos and notes you attach
Chat messages you send within station or crew channels, and callouts you send
Your settings, such as notification, geofence and status check preferences

Device information

We automatically collect certain information about your device when you use the App, including:

Device model, manufacturer and operating system version
A unique device identifier used to authenticate your device with the App
A push-notification token, so we can send notifications to the device
App version and build number
Device language and locale settings

Location information

With your permission, the App collects your device location to:

Display nearby resources (hydrants, defibrillators, risk markers) on the map and calculate distance and bearing from your current position
Show your station where you are while you are responding to a callout. While your responding status is set, the App sends your position to us at most once every 15 seconds. Members of your station can see it on the Dashboard’s en-route tracker, and it appears on Crew board screens a station admin has paired (see section 3). It is not shown on the open Crew board link
If you turn on geofencing, notice when you arrive at or leave your station area so the App can offer (or, if you choose, make) a change to your availability. This needs “Always” location access; the station area is watched by your device's operating system, and your location is not sent to us for it

Your responding positions are deleted when your responding status ends: when you clear it, or automatically after the time set in the App (15 minutes unless you change it, and 2 hours once you have arrived). You can disable location access for the App at any time in your device settings. Disabling it will limit the resource finder and responding-status features.

Camera and photo library

With your permission, the App may access your device camera and photo library so you can attach photos to resource markers, set your profile photo, or choose a station logo. We only access these features when you explicitly choose to take or select a photo.

Profile photos

If you add a profile photo, the App crops it and uploads a small square image, which we store on our own servers. Members of the stations you belong to can see it. A station admin can also add, change or remove the photo of a member of their station. Your photo appears on your station's Crew board only if you turn that on yourself; an admin cannot turn it on for you.

Bluetooth (Android)

If you turn on the “in the car” setting, the App asks for Bluetooth permission so it can notice when your phone connects to your car shortly after a callout, and then offer (or, if you choose, set) your responding status. When your phone connects to a Bluetooth device, the App checks only the type of device, to tell a car or hands-free kit from anything else. It does not store or send us the device's name or address. The setting is off unless you turn it on, and you can turn it off, or withdraw the permission in your device settings, at any time.

Siri (iPhone)

If you ask Siri to tell the App you're responding, Apple handles your voice request under its own privacy policy. The App receives only the instruction to set your responding status.

Dashboard sign-in

To sign in to the Dashboard you use your email address with either a password or a one-time code we email to you. We store your password only as a salted hash (PBKDF2), never the password itself. Your browser keeps your sign-in in its own storage, and forgets it when you close the browser unless you choose “Keep me signed in on this computer”. We keep a record of each signed-in browser and sign it out after 12 hours, or after 30 days if you chose to stay signed in. After 5 wrong passwords in a row, password sign-in is paused for 15 minutes.

Our website

If you send us a message through the contact form on our website, we keep your name, email address and message, so that we can reply and follow up. Ask us and we will delete it.

2. How We Use Your Information

We use the information we collect to:

Provide the App's availability, alerting and incident-response functionality, and show your station who is available and whether it has enough crew
Send mobilisation and incident push notifications to your device, including a notice when a callout is stood down
Send status check prompts asking you to confirm your status, at times your station or you choose, if they are switched on for you
Tell you how close you are to your contracted hours each week, if you set a target
Email you a weekly summary of your own availability, if you are on our mailing list. Each email has an unsubscribe link
Email your line manager a weekly report of the hours you were available, but only if you chose them as your line manager and your station subscribes
Verify and authenticate your device and identify you within your station and crew
Communicate with you about your account, the App or critical safety updates
Diagnose and improve App performance and reliability
Comply with legal and regulatory obligations

3. Who at Your Station Can See What

We provide the service to stations. Your information is shown to the people at the stations you belong to, as described below, and on your station's Crew board.

Everyone at your station can see your name, rank, current availability and your availability plan from yesterday onwards, your responding status during a callout, your profile photo and the chat messages you send.
Your history (older availability plans, the record of changes to your availability, and your hours totals) can be seen only by you and by the line manager you choose in the App. You can change or remove that choice at any time, and the access stops straight away. Someone at your station can ask you to choose them as your line manager, but nobody can choose one for you.
Your line manager can also export a spreadsheet (CSV) of the weekly hours of the members who chose them. The export contains nobody else.
Station admins can edit members' details and availability, set crewing rules, and see the station's responding log: who changed their responding status during each callout, and when. Admins can also stand a callout down.
Line managers can edit the availability of members who chose them.
Keep my plan off the dashboard: if you turn this on in the App, station admins no longer see your planned hours on the Dashboard. You and your line manager still can, and your crew still see your plan in the App.

Systems your station connects

Your station can ask us for an API key so that another system it uses can read from iOnCall through our Developer API. A key belongs to one station and can only read that station. It gives the system the station's details and, for each member, their name, nickname, rank, callsign, current availability and responding status. It never gives out your email address, phone number, location, history, planned availability or photo. The key is read-only, and we can revoke it at any time. The station decides which system holds the key and is responsible for how that system uses the data.

The Crew board

A station can show the Crew board on a screen in its crew room. It is a web page at a link unique to the station (/app/crewboard/ followed by the station's identifier). Anyone who has the link can open it without signing in, so stations should treat the link like a key. The board shows:

members' names, ranks and crew numbers, grouped by role, with their current availability and when they are next due on or off call;
whether the station has enough crew under its crewing rules;
the latest callout: when it was sent, by whom, and its title;
during a callout, who is responding, delayed or has arrived;
profile photos, only of members who have chosen to show theirs on the board;
live tide heights and wind, if the station has set them up. These come from Associated British Ports' weather stations and say nothing about you.

During a callout, a map of where responding members are, with the route each has taken so far, is shown only on screens a station admin has paired with the station on the Dashboard, using a code shown on the screen. It is never shown on the open link. An admin can unpair a screen at any time.

4. Third-Party Services

The App, the Dashboard and the Crew board rely on the following third-party services that may process your information:

Amazon Web Services

Our application servers, database and stored files are hosted on AWS in its London region (eu-west-2), in the UK. AWS acts as a data processor on our behalf. Their privacy notice is available at https://aws.amazon.com/privacy/.

Firebase Cloud Messaging (Google)

Firebase Cloud Messaging delivers push notifications, including critical mobilisation alerts. Your device token is shared with Firebase to route notifications to your device. Google's privacy policy applies to data processed by Firebase: https://policies.google.com/privacy

Postmark

Email we send, such as verification and sign-in codes, invitations, weekly summaries and account messages, is delivered through Postmark, with Amazon Simple Email Service as a fallback. They receive your email address and the message. Postmark's privacy policy applies: https://postmarkapp.com/privacy-policy

Stripe

Station subscriptions bought on the web dashboard are paid through Stripe. Stripe collects the payment card and billing details of the person paying. We never see full card details. We receive the subscription's status, plan, renewal date and the billing email address, and we tell Stripe how many active crew members the subscription covers. Stripe's privacy policy applies: https://stripe.com/privacy

Apple App Store / Google Play

If you have purchased a subscription via Apple or Google's in-app purchase systems, those platforms process your payment and provide us a receipt for verification. We never see your card details. Their respective privacy policies apply: Apple · Google.

Anthropic

We use Anthropic's Claude to translate English text that comes from our servers, such as status names, ranks and notification wording, into other languages. We send only that text, which contains no information about you. Anthropic's privacy policy applies: https://www.anthropic.com/legal/privacy

Maps: Apple and Google

The App's maps use Apple Maps on iPhone and Google Maps on Android. The Dashboard's en-route tracker and its other maps use Google Maps. When you search for an address, for example to set a station's location, the text you type is sent to Google's Places service to suggest matches. The map provider receives your device's IP address and the area of the map being shown. Their privacy policies apply: Apple · Google.

OpenStreetMap and cdnjs

On paired Crew board screens, the responders map is drawn with the Leaflet library, loaded from cdnjs (run by Cloudflare), using map tiles from OpenStreetMap's tile servers. They receive the screen's IP address and, for the tiles, the area of the map being shown. The OpenStreetMap Foundation's privacy policy applies: https://osmfoundation.org/wiki/Privacy_Policy

Google Fonts

This website and the Crew board load their typefaces from Google Fonts, which receives your device's IP address when a page loads: https://policies.google.com/privacy

Associated British Ports

Where a station has set it up, the Crew board shows live tide heights and wind from the Humber weather stations run by Associated British Ports (ABP). Our servers fetch these readings; no information about you or your station's members is sent to ABP.

5. Data Storage and Security

Your information is transmitted over HTTPS. Authentication data such as device identifiers is stored using encrypted storage on your device (iOS Keychain and Android Keystore). On our servers, data is stored in encrypted databases with restricted access, on AWS in London. We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction.

No method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We keep your personal information until you delete your account, except where a shorter period applies:

Responding positions are deleted when your responding status ends (see section 1). A check every half hour removes any that are left.
Dashboard sign-ins end after 12 hours, or 30 days if you chose to stay signed in.
Station joining codes are deleted 48 hours after they are made. Email invitations stop working after 14 days.
Crew board pairing codes expire after 15 minutes.
Server logs (IP address, time and the page or request) are kept only briefly, for security and abuse monitoring. Older logs are overwritten automatically as new ones are written.
Security audit log: we record security-related actions, such as sign-ins, viewing a member's history, hours or responding log, changes to members' details and permissions, callouts, data exports and API access, with who did it, when, and the IP address and browser or app version it came from. It never holds passwords, codes or message contents. We keep it for 12 months, so that we can investigate a security incident, then delete it automatically. It is kept for those 12 months even if you delete your account.
Billing records (app store receipts and your station's subscription) are kept as long as tax and consumer-protection law requires, typically 6 years in the UK.

You can delete your account at any time in the App (Settings, then Delete account) or by emailing us; see how to delete your account. When you do, we delete your personal data, including your profile, photo, devices, station memberships, availability and status history, responding log and positions. Some records also belong to your station, such as chat and callout messages you sent and callouts you stood down. We keep those but remove who you were: they are linked to a random identifier that cannot be traced back to you, and messages show as from a “Former member”.

7. Data Sharing

We do not sell, trade, or rent your personal information. We may share your information only in the following circumstances:

Within your station: as described in section 3. This is core to how the App works.
Systems your station connects: with a system your station has chosen to give an API key, limited to what section 3 describes.
Service providers: With trusted third-party service providers (AWS, Firebase, Postmark, Stripe, Apple, Google, Anthropic) and the map and font providers listed in section 4, who help us run the App, subject to their own privacy policies.
Legal requirements: When required by law, regulation, or legal process.
Protection: To protect the rights, property, or safety of iOnCall, our users, or others.

8. Your Rights

Under UK GDPR and equivalent regulations, depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you.
Correction: Request correction of inaccurate or incomplete data.
Deletion: Request deletion of your personal data.
Objection: Object to certain types of processing of your personal data.
Portability: Request transfer of your data in a machine-readable format.
Withdraw consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us using the email address listed below.

9. Children's Privacy

The App is not intended for use by children under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly.

10. Permissions

The App may request the following device permissions:

Internet: Required for communicating with our servers.
Location (while using the App): Used by the resource finder and, while you are responding, to show your station where you are. You can disable it in device settings.
Location (“Always”): Needed only if you turn on geofencing, so your device can notice you arriving at or leaving your station area while the App is closed.
Bluetooth (Android): Needed only if you turn on the “in the car” setting, to notice your phone connecting to your car.
Camera and photo library: Used when you take or choose a photo for a resource marker, your profile or your station's logo.
Face ID or fingerprint: Used, if you turn it on, to unlock the App. Your device checks it; we never receive any biometric data.
Push notifications: Used to deliver mobilisation alerts, incident updates, and crew messages. Critical alerts may override silent mode and Do Not Disturb on your device — this is intentional and core to the App's safety function. You can disable notifications at any time in your device settings.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Effective date" at the top. You are advised to review this Privacy Policy periodically. Continued use of the App after changes are posted constitutes acceptance of those changes.

12. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

Graham Murt, trading as iOnCall
Out Field Higher Mellingey, Mellingey Road, St Issey, PL27 7QU, United Kingdom
Email: hello@ifireapp.org
Website: https://ioncall.app