Privacy policy

Beacon Mid-Atlantic ("Beacon Mid-Atlantic," "we," "our," or "us") is a 501(c)(3) nonprofit organization that provides emergency communications and logistics support in the Mid-Atlantic region. This part of our Privacy Policy explains what information we collect through our website beaconma.org and through our nonprofit programs, including donations, membership and volunteer applications, our member and vehicle verification pages, training, the RapidCom Interoperability Network (RIN), and our work with partner agencies. It also explains how we use that information, who we share it with, how long we keep it, and the choices you have.

Our software products have their own sections on this page, because the information they handle and the people who use them are different. See the ReCAD, FireHUD & Turnout, FirePortal and Beacon ESS tabs above. If you have questions about any of it, you can reach us using the contact information at the end of this section.

1. Information We Collect

Most of what we know about you is information you give us directly. Some information is collected automatically when you visit the site. We do not buy information about people from data brokers.

Membership and volunteer applications

Our online membership application asks for the following:

• Your name, email address, phone number and date of birth.
• An emergency contact's name and phone number.
• Your home street address, city, state and ZIP code.
• Your occupation and, if you choose to give it, your employer and relevant work experience.
• Your amateur radio license class and call sign, if you have one, and any certifications or training you list (for example ICS, NIMS, CERT, ARES, SKYWARN or first aid).
• Your availability for deployments and meetings, and any limits you tell us about.
• Your reasons for joining, your volunteer experience and skills, and anything else you choose to add.
• Up to two references, with their names, relationship to you, phone numbers and email addresses.
• How you heard about us.
• Your consent to a background check and your consent to our use of your information for membership purposes.

If you list references or an emergency contact, please make sure they are comfortable with us contacting them. We use their details only to check your references or to reach them in an emergency involving you.

The application form only records your consent to a background check. The website does not run a background check or collect a Social Security number. Background checks are handled separately from the website, as required by your state of residence.

Donations

Donations are made through online donation processors, not on our website. When you click a donate button, you leave beaconma.org and enter your payment details on the processor's own site. We never see or store your full card or bank account number. The processor sends us a record of your donation, which usually includes your name, email address, the amount and date, and may include your mailing address or a note you add. We use this to thank you, send receipts and keep the records a nonprofit is required to keep. The processors handle your payment information under their own privacy policies, which we encourage you to read.

Member and vehicle verification

Our verification pages let agencies and the public confirm that a Beacon Mid-Atlantic credential is genuine. To check a member, you enter the member's first name, last name and region number. To check a vehicle placard, you enter the control number and license plate shown on the placard. What you type is sent to our credential registry, which is kept in an online spreadsheet and read through a script service, both from our business email and file storage provider. We do not ask who you are to run a check.

When the details match a record, the page shows limited information from our registry. For a member, that is the member's name, status (for example active, inactive, suspended or terminated), home region, position, unit, the date they joined, their certifications and any notes we have added for people checking the credential. For a vehicle, it is the status, make and model, assignment, assigned unit, expiration date and any notes. If our members have questions about what the registry shows about them, they can contact us to review it.

Email, phone calls and partner inquiries

If you email us, call us, or contact us about agency support, partnerships, sponsoring equipment or the RIN program, we keep what you send us, such as your name, organization, contact details and the content of your message, so that we can respond and follow up.

Information collected automatically

Like most websites, our site is delivered by a hosting provider that receives technical information with every request. Our site is hosted and delivered by our network and domain provider. When you visit, that provider receives your IP address, your browser and device type, the page you requested, the page that referred you, and the date and time. It uses this to deliver the site and to protect it from attacks and abuse. We do not run our own visitor analytics on the site and we do not build profiles of individual visitors.

Our pages also load some files from other services. These include our fonts (from a web font service), the library for our form delivery service on the membership application (from a public code library service), and video thumbnails on our training page (from a video platform). When your browser loads these files, the service that provides them receives your IP address and basic browser information in the same way. Our training videos are hosted on a video platform. Clicking one takes you to that platform, where its privacy policy applies.

2. Cookies and the Google Ads Tag

Our website does not set its own cookies. Most of our pages do include the Google tag for Google Ads (tag ID AW-17579334588). We use it to measure how well our advertising works, such as how many people visit the site or reach our donation pages after seeing or clicking one of our ads.

The Google tag may set cookies in your browser and may read cookies Google has already set. It sends Google information such as the page you visited, the referring page, your IP address, browser details, and an identifier stored in a cookie. Depending on your Google account and ad settings, Google may use this information to measure our ads, to show our ads to people who have visited our site (sometimes called remarketing), and for its own purposes as described in its policies. Google explains how it uses information from sites that use its services at policies.google.com/technologies/partner-sites.

The Google tag is not loaded on our member and vehicle verification pages or our training page.

You can limit this in several ways. You can block or delete cookies in your browser settings. You can turn off personalized ads from Google at myadcenter.google.com. You can also opt out of interest-based ads from many companies through the Digital Advertising Alliance at optout.aboutads.info. Blocking cookies does not stop the site from working.

3. How We Use Your Information

We use the information we collect to:

• Review membership and volunteer applications, check references, and arrange background checks.
• Manage our membership, including assigning members to regions and units, tracking training and certifications, issuing credentials, and keeping our registry current.
• Contact members about training, meetings, exercises and deployments, and reach an emergency contact if something happens to a member while working with us.
• Let agencies and the public confirm that a member or vehicle credential is valid.
• Process donations, send receipts and thank-you messages, and keep financial records.
• Answer questions and follow up with agencies and organizations that contact us.
• Measure how our advertising performs.
• Keep the website and our records secure and prevent fraud or misuse, including misuse of our credentials.
• Meet our legal, tax and insurance obligations, and respond to lawful requests.

4. How We Share Your Information

We do not sell personal information, and we do not rent or give our member, volunteer or donor lists to other organizations for their own use. We share information only in the situations below.

Service providers

We use outside companies to run our website and our operations. They handle information for us, for the purposes we describe here. Each one receives only the information needed for its part of the service and must protect it at least as well as this policy does. They include:

• Our network and domain provider, which hosts and delivers our website.
• A form delivery service, which takes the membership application you submit on our site and delivers it to our email inbox.
• Our business email and file storage provider, which provides our email and document storage and the registry behind our verification pages.
• Google, which provides the Google Ads tag described in Section 2.
• Online donation processors, which process donations.
• Any company or agency we use to perform background checks, which receives the information needed for the check.

We can tell you which companies we use on request.

Agencies we support

When our members train with or deploy to support a public safety agency, emergency management office or relief organization, we may give that agency information it needs to check our people in and keep track of them, such as names, unit, contact information and credentials.

Public verification

As described above, anyone who enters the matching details on our verification pages can see a member's or vehicle's registry record.

Legal requirements and safety

We may disclose information if we believe in good faith that the law requires it, such as in response to a subpoena, court order or other legal process, or when it is needed to protect the safety of any person, to investigate fraud or misuse of our credentials, or to protect our rights and property.

Changes to our organization

If Beacon Mid-Atlantic merges with another organization, or transfers its programs or assets, information we hold may be transferred as part of that change. If that happens, the information will stay subject to this policy or to a policy that protects it at least as well.

5. How Long We Keep Information

We keep information only as long as we need it for the purposes above, or as long as the law requires.

• Membership applications and member records are kept while you are a member and for a reasonable time after you leave, so we can answer questions about past service, training or deployments. If we do not accept an application, you may ask us to delete it.
• Registry entries are kept after a membership or vehicle placard ends, with an updated status, so that a former or revoked credential can still be checked.
• Donation records are kept as long as we need them for tax, accounting and audit purposes.
• Emails and other messages are kept as long as they are useful for the conversation or for our records.

6. How We Protect Your Information

Our website is served only over encrypted HTTPS connections. Access to membership records, the credential registry and donor records is limited to the people in our organization who need it, using accounts protected by passwords. The companies we use to store information also protect it with their own security measures. No website, email system or storage service is completely secure, so we cannot promise that information will never be accessed without permission. If we learn of a security breach involving your personal information, we will notify you as required by law.

7. Your Choices and Rights

You can ask us to:

• Tell you what personal information we have about you and give you a copy.
• Correct information that is wrong or out of date.
• Delete your information.
• Stop sending you emails or other messages that are not required for your membership. Donation receipts and messages about an active deployment are not optional.

To make a request, email privacy@beaconma.org or call us. We may need to confirm your identity before we act on a request. We will answer within 45 days, and we will not treat you differently for making a request. Some information cannot be deleted right away, such as donation records we must keep for tax purposes, registry entries showing that a credential is no longer valid, or information we need to resolve a dispute or meet a legal obligation. If we cannot fully honor a request, we will tell you why.

Several U.S. states have consumer privacy laws. Some of these laws, including the California Consumer Privacy Act, generally do not apply to nonprofit organizations. Others can apply to nonprofits in some cases. We honor the requests described above for everyone, wherever you live. We do not sell personal information or share it for cross-context behavioral advertising in exchange for money, and we do not share it with third parties for their own direct marketing.

If you are a California resident, California Civil Code Section 1798.83 lets you ask whether we disclosed personal information to third parties for their direct marketing purposes in the past year. We do not make those disclosures, but you may still send us a request using the contact information below.

8. Do Not Track and Global Privacy Control

Some browsers can send a "Do Not Track" signal or a Global Privacy Control signal. Our website does not currently change its behavior in response to these signals. You can still block cookies and turn off personalized ads as described in Section 2.

9. Children

Our website and our membership program are meant for adults. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.

10. Other Websites

Our site links to other websites, such as our donation processors, video and social media pages, partner organizations and beaconess.org. We do not control those sites, and this policy does not apply to them. Please read their privacy policies before giving them information.

11. Visitors Outside the United States

Beacon Mid-Atlantic is based in the United States and our programs serve the Mid-Atlantic region. Information you give us is stored and processed in the United States, where privacy laws may be different from the laws where you live.

12. Changes to This Policy

We may update this policy from time to time. When we do, we will post the new version on this page and change the "Last Updated" date at the top. If we make a significant change to how we use information we already have, we will make a reasonable effort to let affected members know.

13. Contact Us

If you have questions about this Privacy Policy or want to make a request about your information, contact us at:

Beacon Mid-Atlantic

privacy@beaconma.org (privacy requests)

info@beaconma.org (general questions)

(215) 999-8747

This section covers Beacon ReCAD, the computer-aided dispatch system that Beacon Mid-Atlantic provides to fire, EMS and other public safety agencies, and the ReCAD Respond and ReCAD CMD mobile apps. Beacon ReCAD is made up of the following:

• ReCAD Dispatch, the desktop program dispatchers use on Windows and Mac computers to take and manage calls.
• ReCAD Respond, the mobile data terminal used in agency vehicles. It runs on computers mounted in the vehicle, and as an app for iPad and Android tablets.
• ReCAD Admin, the website agency administrators use to manage their units, stations, users and settings.
• ReCAD CMD, the phone app for Android and iPhone used by chiefs and other command officers. It is described in detail in Section 3.

Beacon ReCAD is not a public service. Accounts are created by the agencies that use it, and the people who use it are dispatchers, responders and officers working for those agencies. Members of the public usually come into contact with Beacon ReCAD only because a dispatcher entered information about them while handling a call.

1. Our Role and the Agency's Role

Each agency or organization that uses Beacon ReCAD owns and controls its own dispatch records. The agency decides what goes into the system, who can see it, and how long its records are kept, subject to the laws and records rules that apply to it. Beacon Mid-Atlantic runs the system on the agency's behalf. We handle the agency's records only to provide, support, secure and improve the service, and as described in this section.

Because the records belong to the agency, questions about how a particular call, message or location record was used, and requests to see or change those records, are usually answered best by the agency. We will help the agency respond. Section 12 explains how to reach us directly.

2. Information in Beacon ReCAD

Call records

When an agency's dispatchers handle a call, Beacon ReCAD stores the call type, location and address, the times of each step, the units assigned, notes and narrative entered by dispatchers and responders, and the status history of each unit. If the dispatcher records them, a call can also include the caller's name and phone number and information about the people involved.

In ReCAD Respond, a crew can sign on to its unit with each member's name, certification level and role, and can record the vehicle's mileage and fuel at the start and end of a shift. Both are optional and are stored with the agency's records.

User accounts

Dispatchers and administrators sign in with a username and password. Units and officers sign in to ReCAD Respond and ReCAD CMD with a unit number and a PIN. Accounts are created and removed by the agency's administrators. Passwords and PINs are stored only as one-way hashes, so they cannot be read back, even by us. Sign-in sessions are also stored only in hashed form.

Deleting a ReCAD Respond account and data

ReCAD Respond units are created by the agency, so they are also removed by the agency. To have a unit or account deleted, ask your agency's administrator, or email us at privacy@beaconma.org and we will work with your agency to delete it. Deleting it removes the unit's PIN, its sign-in sessions and its notification tokens. Signing out of ReCAD Respond on an iPad or Android tablet ends the session on that tablet, stops location reporting and deletes its notification token, and uninstalling the app removes everything it stored on the tablet. Call records, messages, status history and location history are part of the agency's official records, so they are kept for the periods described in Section 6 even after the unit is deleted.

Vehicle and unit locations

On vehicle computers, ReCAD Respond reports the location of the vehicle it is installed in while the vehicle computer is running, including when no one is signed in. This is how the agency tracks its vehicles and recommends the closest unit to a call.

The ReCAD Respond app for iPad and Android tablets reports the tablet's location only while a unit is signed in on it. It keeps reporting while the screen is off or another app is open, such as a maps app on the way to a call, because dispatchers need to see where the unit is the whole time it is in service. For this, the iPad app asks for "Always" location permission. The Android app shows a notification for as long as it is sharing the unit's location and does not ask for background location permission. Signing the unit out stops location reporting, and the app does not report location when no unit is signed in. The location goes only to the agency's own Beacon ReCAD system.

ReCAD CMD reports the location of an officer's phone only when the officer turns location sharing on, as described in Section 3.

Messages

Beacon ReCAD lets dispatchers and units send each other short text messages. Messages are stored on our servers with the sender, recipients and time sent.

Device information

For each computer or phone that connects to Beacon ReCAD, we keep a device ID created by our software, the device model and operating system version, the version of our software it is running, the unit last signed in on it, its alert settings, and, on phones and tablets, a notification token. The ReCAD Respond tablet app uses its notification token, from the push notification service built into the tablet (Apple's on iPad, Google's on Android), only to tell the crew about a new dispatch while the app is in the background. For dispatch and vehicle computers, we also keep the computer's name and a hardware identifier so we can recognize the same computer if our software is reinstalled. We also keep a history of device events, such as sign-ins, updates and connection problems, and diagnostic logs that a device may upload so we can fix problems. We do not collect hardware serial numbers, IMEI numbers or advertising IDs from phones.

Security and audit logs

Beacon ReCAD keeps an audit log of important actions, such as changes to calls, units, users and settings, with the account that made each change and the time. Sign-in and security records include the IP address the request came from.

4. How We Use Information

We use information in Beacon ReCAD to:

• Run dispatch for the agency, including creating and tracking calls, assigning and recommending units, showing units and calls on maps, and sending alerts and messages.
• Let the agency's users sign in, and keep out people who are not authorized.
• Keep the agency's records, including call history, status history and location history, for its reports, reviews and legal obligations.
• Install updates on agency devices, find and fix problems, and keep the system running.
• Protect the system and its users, and investigate misuse.
• Comply with the law.

We do not use agency records for advertising, we do not sell them, and we do not combine them with information from other sources to build profiles of people.

5. Who Can See Information and Who We Share It With

Within the agency

Each organization that uses Beacon ReCAD, such as a dispatch center and the agencies it dispatches, has its own separate records. No organization can see another organization's calls, units, messages or locations. Dispatchers and vehicle computers see the calls and units of their own organization. In ReCAD CMD, an officer sees only their own agency's calls, units and messages. Administrators can see and manage their organization's users, devices and settings.

Service providers

We use the following kinds of companies and services to run Beacon ReCAD. They receive only the information needed for their part of the service, and they must protect it at least as well as this policy does.

• Our hosting provider, a cloud hosting company in the United States that hosts our servers and databases.
• Our network and domain provider, which provides our domain names, network protection and encrypted connections.
• The push notification services built into the phone or tablet (Apple's on iPhone and iPad, Google's on Android), which deliver alerts.
• Our business email and file storage provider, where copies of our databases are backed up every hour, and which sends the alert emails some agencies use to notify their stations.
• A second backup storage provider in the United States, which keeps a second copy of our database backups.
• An email delivery service, which sends those alert emails when our business email provider cannot.
• Google Play and the Apple App Store, which distribute ReCAD Respond and ReCAD CMD. What they collect when you download an app is covered by their own privacy policies.

To place calls and units on a map and work out routes, Beacon ReCAD sends addresses or map coordinates to public and commercial mapping, geocoding and routing services. Weather alerts come from a government weather service. The apps load map images directly from an open map tile service, which receives the device's IP address and the map area being viewed. If you tap a navigate button, the address is handed to the maps app on your device, such as Apple Maps or Google Maps, and that app's privacy policy applies.

We give agencies the current list of the companies we use on request.

Legal requests

Dispatch records are often public safety records governed by state law, and requests for them should normally be made to the agency. If we receive a subpoena, court order or other legal demand for an agency's records, we will refer it to the agency where we can, and we will tell the agency about the request unless the law does not allow us to. We may disclose information without first contacting the agency only if we believe in good faith that the law requires it or that it is needed to prevent death or serious harm.

Other situations

If an agency stops using Beacon ReCAD, or asks us to transfer its records to another system, we will provide its records to the agency or to whoever it tells us to. If Beacon Mid-Atlantic transfers the ReCAD service to another organization, agency records would go with it, subject to the same protections.

6. How Long Information Is Kept

Agencies keep public safety records for long periods, and Beacon ReCAD is built for that. Unless the agency arranges something different with us:

• Call records, notes, unit status history and the audit log are kept as the agency's permanent records for as long as the agency uses Beacon ReCAD.
• Messages are stored with the agency's records. The apps only display the last 24 hours.
• Location history from vehicles, from the ReCAD Respond tablet app and from ReCAD CMD is kept for 90 days. Locations recorded while a unit was assigned to a call are kept for 3 years, so the agency can review how the call was handled.
• Sign-in sessions are deleted after 30 days without use, and right away when a user signs out, a PIN is changed, a unit is deactivated or a device is blocked.
• Device event history is kept for about 13 months. Only the most recent diagnostic logs from each device are kept.
• Notification tokens are deleted on sign-out or when Google or Apple reports they are no longer valid.
• User accounts are kept until the agency removes them.

Our database backups are kept for up to several years. Information deleted from the live system can remain in older backups until those backups are removed on their normal schedule. Backups are used only to restore the system.

7. Security

All connections between the apps, the website and our servers are encrypted with HTTPS (TLS), and our sites require encrypted connections. Our hosting and backup providers encrypt stored data under their own security programs. Passwords, PINs and session tokens are stored only as one-way hashes. Every request is checked against the user's account and organization, so users can only reach their own organization's records. Access to the systems that run Beacon ReCAD is limited to the Beacon Mid-Atlantic staff who need it, and changes are recorded in the audit log.

No system is perfectly secure. If we learn that an agency's records have been accessed without authorization, we will notify the affected agency promptly and give it the information it needs to meet its own notification duties. We will also notify individuals directly when the law requires us to.

8. Your Choices and Rights

If you use Beacon ReCAD for your agency, you can ask your agency's administrator to correct your account details or remove your account. In ReCAD CMD, you control whether your location is shared and which alerts you receive, and you can sign out at any time.

If you are a member of the public and want to see, correct or delete information about you in a dispatch record, please contact the agency that handled the call. Those records are the agency's, and state public records and records retention laws may decide what can be released or deleted. If you are not sure which agency to contact, email us and we will help. We will not delete an agency's records without the agency's direction.

9. Children

Beacon ReCAD, ReCAD Respond and ReCAD CMD are for public safety personnel and are not meant for children. We do not knowingly create accounts for children under 13. A dispatch record may include information about a child when a call involves one. That information is handled like the rest of the agency's records.

10. Where Information Is Stored

Beacon ReCAD is operated in the United States, and agency records are stored in the United States. The service is meant for agencies in the United States.

11. Changes to This Section

If we change this section, we will post the new version on this page and update the date at the top. If a change affects how agency records are handled, we will also tell the agencies that use Beacon ReCAD.

12. Contact Us

Questions about Beacon ReCAD, ReCAD CMD or this section:

Beacon Mid-Atlantic

privacy@beaconma.org

(215) 999-8747

This section covers FireHUD and Turnout, two products Beacon Mid-Atlantic provides to fire departments through its Beacon ESS (Emergency Services Software) program. FireHUD is a station alerting system. It shows dispatch information on displays in the station, sounds tones and announcements, and controls station lights. Turnout is the mobile app that goes with it. It alerts a department's members when they are dispatched, lets them tell the department whether they are responding, and carries the department's messages, announcements and calendar.

FireHUD and Turnout are not public services. A fire department signs up for them, and the department sets up the accounts for its members. The department controls its own records, and we run the service on its behalf. Information shared by all Beacon ESS products, such as administrator sign-in and backups, is described in the Beacon ESS tab.

1. FireHUD

Where dispatch information comes from

FireHUD does not take calls itself. When a county dispatch center sends a department its dispatch notices by email, the department has those emails forwarded to an address we assign to it. Our network and domain provider passes each email to the FireHUD server, which reads it and creates an incident. An incident usually includes the dispatch time, call type, address, box or area, the units dispatched, a map link or map coordinates, and the full text of the original dispatch email, which we keep so the department can check what was received. Whatever the dispatch center puts in its email, which can include a caller's name or phone number or details about a patient, ends up in that text.

Station displays and hardware

FireHUD shows active incidents on screens in the station, with the address, units, a map and the clock. When nothing is happening, the screens show the time and the weather. A department can also have them show two things from Turnout: the subject and the start of its latest announcement to the whole department, for up to three days after it was sent, and the names of the members who have checked in at the station. Both are off until the department turns them on. The sender of an announcement can keep it off the screens, and the department can take one down in FirePortal. Anyone in the station who can see a screen can see what is on it, so each department decides where its screens go. FireHUD can also sound tones and spoken announcements through station speakers, switch station lights, and print run tickets on a station printer.

Our station hardware (the DisplayBox, AudioBox and AlertBox) has no cameras or microphones. It only displays, plays sound, and switches lights. Each device reports its serial number, software version and status to us so we can monitor it and install updates.

Spoken announcements are produced by a text-to-speech service. The text of an announcement, such as the call type and address, is sent to that service to create the audio, and the audio is stored on our servers for reuse.

Department information and the FireHUD console

For each department we keep its name, station addresses and map locations, and a contact person's name and phone number. The department's officers and administrators use the FireHUD console to manage incidents, members, apparatus, hydrants, station devices and settings. Console users sign in with a username and password. Passwords are stored only as one-way hashes. Each user has a role that limits what they can see and change.

Incident history

FireHUD keeps a record of every change made to an incident, such as when it was closed and by whom. These records are linked together so that a change made outside the normal software would be detectable.

2. Turnout

Turnout is a mobile app published by Beacon Mid-Atlantic for the members of departments that use FireHUD. It alerts you when your department is dispatched, lets you tell your department you are responding, shows who else is responding, and shows a map with hydrants. It also carries your department's messages, announcements, calendar and attendance, and lets you tell the department when you are at the station.

Your account

You cannot sign up for Turnout on your own. Your department creates your account. You sign in with your department's code and the username and password your department gives you. The account includes your name and the other details your department enters, such as your rank or station, and an email address if your department has one for you. In Settings you can turn on dispatch emails and email copies of announcements to your address. You can change your email address and phone number in Turnout, and the change is also made in your department's member records. You choose whether other members of your department see your phone number and email; both are off until you turn them on. Turnout does not text you. If you turn on Face ID or fingerprint unlock, your phone checks your face or fingerprint itself and the app is only told whether it succeeded. We never receive biometric information.

Groups and extra rights

Your department can give a member extra rights in Turnout, such as sending announcements, changing the calendar, changing apparatus status, managing groups or starting group chats. It can also put members into groups. A group can have its own chat, and announcements and calendar invitations can be sent to it. Who is in each group can be seen by the members who send announcements, change the calendar or manage groups, by the people your department allows to see Turnout in FirePortal, and, when the group has a chat, by everyone in that chat.

Responses

When you mark yourself responding to an incident, Turnout records whether you are going to the scene or to the station, and the time. If you then say you are not responding, the response is removed. Other members of your department can see who is responding in the app, and your department's station displays and console can show it too.

Availability

You can mark yourself unavailable until a time you choose. Every member of your department can see in Turnout that you are unavailable and until when. It clears itself when the time runs out.

Location

Turnout uses your phone's location in two ways.

First, if you have allowed location, Turnout's maps show where you are, and when there is no call to show and no station address on file for your department, the map opens on your location. That stays on your phone. If you turn on hydrants, the app asks our server for the hydrants around the middle of the map, which at first is where you are. Our server uses that point only to find the hydrants and does not keep it.

Second, when you mark yourself responding to an incident, Turnout tracks your location while you are on the way, including when the app is in the background or your screen is off. It uses this to estimate when you will arrive and to mark you as arrived when you come within about 250 feet of the scene or your station. Tracking stops as soon as you arrive, cancel your response, the incident is closed, you sign out, or a time limit passes. Turnout does not track your location at any other time. While tracking is active, Android phones show a notification and iPhones show the location indicator in the status bar.

For each incident you respond to, we store your most recent location and when it was taken, your estimated arrival time, when you arrived, and whether you were marked arrived automatically or by tapping the button yourself. Your department's officers and other members can see your estimated arrival and arrival status, and while you are on the way they can see where you are on the call's map. A position more than ten minutes old is not shown. Your location is cleared about a day after it was taken. Your response, estimated arrival and arrival are kept with the incident record. Your arrival time, whether you tapped Arrived or automatic arrival set it, is also used in the response statistics described below.

To allow this, Turnout asks for location permission, including permission to use location in the background. If you do not allow background location, you can still respond and mark yourself arrived by hand. You can change the permission at any time in your phone's settings.

Messages

Direct messages and group messages between members in Turnout are sent over encrypted connections (HTTPS) and stored on our servers for about 30 days, so they reach every member they are sent to, including a member whose phone was off or signed out when the message was sent. After that they are deleted from our servers. Your phone also keeps its own copy of your conversations. Messages are not end-to-end encrypted.

A message can carry up to four photos, taken with the camera or chosen from your phone's photos. We remove the location and other camera details from each photo before it is stored, and keep two copies of it, with a cloud storage company and with our business file storage provider. Photos are deleted from our servers with their message, about 30 days after it is sent, and a photo that is added but never sent is deleted after a day. Only members of the conversation who can see the message are given a link to its photos. Each link works for ten minutes, and anyone who has the link can open the photo during that time.

Turnout records when each message reaches your phone and when you read it. The sender sees how many people have received and read their message, so in a direct message the sender can tell whether you have. These records are deleted with the message.

If you report a message, a copy of it is kept with who sent it, who reported it and why, the conversation and the time, and it is emailed to your department's administrators, and to any contact address the department has given us for reports, so they can deal with it. If there are none, it goes to the department's officers. If the message has photos, the email says how many but does not include them, and the report keeps its own copy of the photos. Reports are kept for one year, photos included. The administrators can open a reported message's photos and remove them from the message. After that our servers no longer give them to members, but a phone that had already opened a photo keeps its copy until the member signs out or deletes that message, or until Turnout clears it after 30 days. Apart from reported messages, your department's administrators cannot read members' messages, and they cannot see groups that members start among themselves.

Announcements

Announcements are sent in Turnout by your department's officers and by members the department allows to send them. Each one goes to the whole department or to groups, and in Turnout only those members can see it. The people your department allows to see Turnout in FirePortal, and the department's administrators in the FireHUD console, can see every announcement. Announcements are not deleted on a schedule. They stay with the department's records, so a member who signs in on a new phone still has them. The sender can see how many people received and read an announcement, but not who. Announcements that are taken back, expire or are edited stay in the department's records.

A sender can ask everyone to confirm they have read an announcement. When you confirm, we record that you did, when, and from which of your phones. The sender, your department's officers and the people your department allows to see Turnout in FirePortal can see who has confirmed and when, and who has not. The sender or an officer can remind those who have not, up to three times. Confirmations are kept as long as the announcement.

A sender can attach up to five PDF files and photos to an announcement. Photos are taken with the camera or chosen with the phone's own photo picker, so Turnout only gets the photos the sender takes or picks. We remove the location and other camera details from a photo before it is stored. A photo or PDF chosen from the phone keeps its file name, which everyone who can see the announcement sees. PDF files are stored as they are. We keep two copies of each file, with a cloud storage company and with our business file storage provider, so a problem at one does not lose it. A file stays as long as the announcement it is on. A file that is added but never sent is deleted after a day, and so are the files on a scheduled announcement that is canceled.

Only members who can see the announcement, and the people your department allows to see Turnout in FirePortal, are given a link to its files. Each link works for ten minutes, and anyone who has the link can open the file during that time.

If your department shows announcements on its station screens, an announcement sent to the whole department can appear there for up to three days, unless the sender turned that off or the department took it down. The screens show its subject and the start of its text, not who sent it.

Email copies of announcements

You can get a copy of each announcement you receive by email. This is off until you turn it on in Settings, and it needs an email address on your account. Your department's administrators can also turn it on or off for you in FirePortal. The emails come from noreply@beaconma.org with your department's name on them, and are sent through our business email provider. Each one has the announcement's subject and text, who sent it, who it went to and when. Attached files are not included, but the email says how many there are so you can open them in Turnout. Every email has a link to stop them, and you can also turn them off in Settings. We keep a record of each email copy, with the address it went to and whether it was sent, for 30 days. Once an email reaches your inbox, your email provider keeps it like any other email.

Emails to your family

You can ask Turnout to email people you choose when you respond to a call, unless your department has turned this off. It is off until you add someone, and nothing is sent to an address until its owner says yes. The email says you are responding and, in general terms, where you are going and when. It never includes the house number, details of the call or your location. The person can stop the emails at any time, and you can remove them in Settings. The emails come from noreply@beaconma.org with your department's name on them and are sent through our business email provider. We keep the addresses you add until you remove them or your account is erased, and a record of each email for 30 days. If someone says no, we remember that so they are not asked again.

Calendar

Turnout shows your department's calendar. An event can be for the whole department or for the groups and members invited to it, and you can answer Going, Maybe or Not going. Every member of your department can see each event, who was invited, and who has answered and how, in Turnout and in FirePortal. Events and answers are not deleted on a schedule. When a date is taken off the calendar, its answers go with it.

You can add your department's calendar to your phone's own calendar app with a private link from Turnout. Anyone who has the link can see the events on it. If you add it to Google Calendar or another online calendar, that service fetches the events from us and keeps them under its own privacy policy. You can turn the link off in Turnout at any time.

Your department's officers, and others your department allows, can record who attended an event and for how long. You see your own in Turnout. It is kept as a department record.

Turnout only sends a calendar notification when someone who manages the calendar chooses to: an invite to a new event, a reminder before it starts, or a notice that it changed, was called off or is back on. Invites go to the members invited, or to everyone when the event is for the whole department. Reminders and change notices go to members who answered Going or Maybe and to invited members who have not answered. They never go to members who answered Not going. You can turn calendar notifications off in Settings.

At the station

You can tell your department you are on station for the next 2, 4, 8 or 12 hours, or until a time you pick. You do this by hand. Turnout does not use your location for it. While you are on station, members of your department can see in Turnout your name, your position, when you marked on station and until when. If your department has turned it on, the station screens show your name and when your time ends. They can also list members who are responding, with where they are going and a rough time to arrive. Your time on station ends when you say you have left, when it runs out, when you mark yourself unavailable, when an officer takes you off, or when your account is turned off. An officer taking you off station is noted in the department's activity log. Being on station does not change how you are alerted. We keep each record, with which of your phones made it, for 90 days after it ends.

Response statistics

Your department can see response statistics in FirePortal, worked out from the calls FireHUD received and the responses members gave in Turnout. For a period of up to a year, they show for each member how many calls they responded to and what share of all calls that was, how often they went to the station or straight to the scene, how often they arrived, and their typical time from the alert to tapping Responding and to arriving. Arrival times can come from automatic arrival, which uses your location while you are responding. The statistics are worked out each time someone opens the page, and can be downloaded as a spreadsheet. Only the people your department allows to see its records in FirePortal can view them. A member whose account has been erased appears as "a former member". You can also see your own totals in Turnout.

Notifications

To send alerts, Turnout registers your phone with the push notification service built into the phone (Apple's on iPhone, Google's on Android) and sends us the notification token it receives, along with your tone and alert settings and an ID for your phone. Each notification passes through Apple's or Google's service with a short text on it: for a dispatch, the call type, address and box; for a direct message, the sender's name and the message; for a group message, the sender's name, the group's name and the message; for an announcement, its subject, who it went to and its text; for a calendar notice, the event's name, time and place. A long text is cut short. A photo is never put in a notification: a message that is only photos says "Photo" or how many. The app gets the full details from our server over an encrypted connection. Tokens are removed when you sign out or when Google or Apple reports they are no longer valid. The record of each alert or message sent to your phone keeps its token until that record is deleted or your account is erased.

On your phone

Your copy of your conversations stays on your phone, under your account, until you delete the messages in Turnout or uninstall the app. Signing out does not remove it. Turnout also keeps a copy of the newest 100 announcements sent to you, so you can read them without signal, and any announcement you are still writing. Photos you have sent or opened in a conversation stay until you delete the messages they are on. Those more than 30 days old are cleared out the first time you open a conversation after Turnout starts. Photos and PDF files you take or pick are kept only until they are sent. All of these are removed when you sign out. A PDF you open from an announcement, or a photo you open outside Turnout, opens in your phone's own viewer or browser, which may keep its own copy. On Android, Turnout's data is left out of the phone's backups.

Maps and hydrants

Turnout's map loads its map images from an open map tile service, which receives your phone's IP address and the map area you are viewing. Hydrant locations come from public county GIS data. The app does not use Google Maps.

You can report a hydrant's cap color, whether it is in service, and a note. The cap color and whether it is in service show on other departments' maps too. Your note and your name are shown only to your own department. Hydrant reports are kept with your department's records.

Phone permissions

On Android, Turnout asks for permission to show notifications, to sound alerts when your phone is set to Do Not Disturb, to vibrate, to restart its alerts after your phone reboots, to be excluded from battery optimization so alerts are not delayed, and to use your location, including in the background while you are responding. On iPhone, it asks for permission to show notifications, including Time Sensitive notifications so that dispatch alerts come through when a Focus mode is on, and to use your location, including "Always" permission, which Turnout uses only while you are responding. You can refuse any of these or turn them off later in your phone's settings, although alerts may then be late or silent. Turnout asks to use the camera only when you tap Take photo to add a photo to a message or an announcement. Choosing a photo or PDF uses the phone's own picker and needs no permission.

What Turnout does not do

Turnout does not contain advertising, analytics or crash-reporting software from other companies, and it does not track you across other apps or websites. It does not read your phone's contacts or use the microphone. The only addresses of other people it keeps are the ones you type in for emails to your family. It uses the camera only when you tap Take photo, and it only sees the photos and PDF files you pick yourself to send in a message or attach to an announcement. We do not sell information from Turnout or use it for advertising.

3. How We Use Information

• To receive dispatch notices and alert the department's stations and members.
• To show the department who is responding and when they are expected to arrive.
• To deliver messages, photos, announcements and their files, calendar notices, and the email copies of announcements that a member or their department turns on.
• To show the department who has confirmed an announcement, who has answered a calendar event and who is at the station.
• To give the department response statistics built from its calls and its members' responses.
• To keep the department's incident records and response history.
• To monitor and update station hardware and keep the service running.
• To protect the service and its users and investigate misuse.
• To comply with the law.

4. Who Can See Information and Who We Share It With

Each department's information is kept separate from every other department's. Members of a department see their own department's incidents, responders and announcements, according to the role the department gives them. Every member can see who is at the station, who has marked themselves unavailable, and who has answered each calendar event and how. A member sees their own attendance. Other members see a member's cell number and email only if that member chose to show them. Who has confirmed an announcement is shown to its sender, the department's officers and the people the department allows to see Turnout in FirePortal.

We use the following kinds of companies and services to run FireHUD and Turnout. They receive only the information needed for their part of the service, and they must protect it at least as well as this policy does.

• Our hosting provider, a cloud hosting company in the United States that hosts our servers, databases and stored files.
• Our network and domain provider, which receives forwarded dispatch emails, provides our domain names, network protection and encrypted connections, and carries the connections between Turnout and our servers.
• The push notification services built into the phone (Apple's on iPhone, Google's on Android), which deliver alerts, messages, announcements and calendar notices to phones, with the short text described under Notifications.
• A text-to-speech service, which turns announcement text into audio.
• Our business email and file storage provider, where our databases and files are backed up, and which keeps one of the two copies of each photo sent in a message and each file attached to an announcement.
• A cloud storage company in the United States, which keeps the other copy of each of those photos and files, and a copy of our database backups.
• Google Play and the Apple App Store, which distribute Turnout. What they collect when you download an app is covered by their own privacy policies.
• An email delivery service and our business email provider, which send email from our service, such as dispatch emails, email copies of announcements, emails to members' families, and reports of messages to a department's administrators.
• A routing service, which receives start and end coordinates to estimate travel times and distances.
• An open map tile service, which provides map images, and county GIS services, which provide hydrant data.
• A government weather service, which provides weather information for the station displays.

We give departments the current list of the companies we use on request.

We may disclose information if we believe in good faith that the law requires it, or if it is needed to prevent death or serious harm. When we receive a legal demand for a department's records, we will refer it to the department where we can and tell the department about it unless the law does not allow us to.

5. How Long Information Is Kept

• Incidents, including the original dispatch text and responses, are kept for at least seven years by default. A department can choose to keep them longer. Responder locations are cleared about a day after they are recorded.
• Member messages and the photos on them are deleted from our servers about 30 days after they are sent, along with the records of when each one reached a phone and was read. A photo that is added to a message but never sent is deleted after a day.
• Announcements, the files attached to them, read confirmations and the records of who received and read them are not deleted on a schedule. They stay with the department's records. A file that is added to an announcement but never sent is deleted after a day.
• When a photo or file is removed, it can stay in our storage providers' trash for up to 30 days, and our record of it (its name, type, size and who added it) is deleted 7 days after it is removed.
• Calendar events and the answers to them are not deleted on a schedule. When a date is taken off the calendar, its answers go with it.
• On-station records are kept for 90 days after they end. Records of email copies of announcements, and of emails to members' families, are kept for 30 days.
• Attendance records are not deleted on a schedule. They stay with the department's records.
• The email addresses a member adds for emails to their family are kept until the member removes them or the account is erased.
• When a department turns off a member's Turnout account, it stops working at once on every phone. If it stays off for 90 days, the member's name, email address, phone number, position, password, phone registrations, dispatch alert settings, group and conversation memberships, extra rights, reactions and read records, family email addresses and their records, calendar link and contact sharing choices are erased, along with the notification tokens kept with past alerts and messages sent to the member, and which of their phones confirmed an announcement. The ID of the phone the member responded from stays with each incident record. The username is kept only so the department's records still show who responded to incidents, sent or confirmed announcements, added or answered calendar events, and attended events. A reported message that names the member is kept until its year is up.
• The department's activity log in the FireHUD console notes things like responses, announcements sent, times an officer took someone off station, reported messages and the reason given, and changes to groups, with the names of the members involved. It is a department record. It is not deleted on a schedule and is not erased with an account.
• Reported messages, with any photos on them, are kept for one year.
• Notification tokens are kept until you sign out or they stop working. The record of each alert or message sent to a phone keeps its token until that record is deleted or the account is erased.

Our databases are backed up every hour. We keep every backup for a week, one a day for two weeks, one a week for a year, and one from each year for the long term, as the Beacon ESS tab says. Information deleted from the live system, such as messages after 30 days or the details of an account erased after 90 days, can remain in those backups until they are removed on that schedule.

6. Security

Connections to FireHUD and Turnout are encrypted with HTTPS (TLS). Passwords are stored only as one-way hashes. Every request is limited to the user's own department. Software updates for station hardware are checked before they are installed. Access to the systems that run the service is limited to the Beacon Mid-Atlantic staff who need it. No system is perfectly secure. If we learn that a department's information has been accessed without authorization, we will notify the department promptly and give it the information it needs, and we will notify individuals directly when the law requires us to.

7. Your Choices and Rights

In Turnout, you decide whether to allow location, notifications and the camera, and you can change any of them in your phone's settings. You can sign out at any time. Uninstalling the app removes your copy of your messages and the other things it stored, except that on iPhone a few small items kept in the phone's secure storage, such as the phone's random ID and, if you did not sign out first, your sign-in, can stay behind. You can turn off email copies of announcements in Settings or with the link in any of the emails, turn off calendar notifications in Settings, and end a station check-in at any time.

To see, correct or delete information about you, or to have your account removed, contact your department's administrator. You can also email us at privacy@beaconma.org and we will work with your department on the request. Incident records belong to the department and may have to be kept under the records rules that apply to it.

8. Children

FireHUD and Turnout are meant for fire department members and are not directed to children under 13.

9. Changes and Contact

If we change this section, we will post the new version here and update the date at the top of the page. If a change affects how department records are handled, we will also tell the departments that use FireHUD and Turnout.

Questions about FireHUD, Turnout or this section:

Beacon Mid-Atlantic (Beacon ESS)

privacy@beaconma.org

(215) 999-8747

This section covers FirePortal, a records system Beacon Mid-Atlantic provides to fire departments through its Beacon ESS program. Departments use FirePortal to keep their roster, training and certification records, apparatus and equipment records, driver logs and incident reports in one place.

FirePortal is used by the members and officers of the departments that sign up for it. It is not open to the public. Each department controls its own records, and we run FirePortal on its behalf. Sign-in for department administrators and our backups are shared with other Beacon ESS products and are described in the Beacon ESS tab.

1. Information in FirePortal

Member records

For each member, a department can record the member's name, member ID number, rank, station, phone number, email address, whether the member is active, and notes. It can also add certifications and training records with their dates, documents such as certificates or licenses, and photos used for department ID cards. Members' user accounts include a username, full name, email address, role and job title.

Apparatus and equipment

Departments record their apparatus and the documents that go with them, and their equipment, including radios and radio IDs, protective gear and its date of manufacture, SCBA inspection checks and gas meter calibrations. Many of these records show which member performed a check or was assigned an item.

Driver logs and incidents

Members can fill out driver logs for apparatus runs, including the driver, mileage, fuel, alarm type and any problems found. Departments can also record incidents and which members responded to them. To report mileage for an incident, FirePortal may send the station and scene coordinates to a routing service to calculate the driving distance.

Uploaded files

Documents and photos uploaded to FirePortal are stored twice, with a cloud storage company and with our business file storage provider, so a problem at one does not lose them. They are only available to signed-in users of the department that uploaded them.

Turnout records in FirePortal

For departments that also use Turnout, FirePortal shows some of the department's Turnout records, which stay in FireHUD. Every signed-in user can see the Turnout calendar and who has answered each event. Users the department allows to see Turnout can see its announcements, who has confirmed them, and their files, through the same ten-minute links Turnout uses. Users who manage Turnout can read the messages members have reported, open and remove their photos, and the department's administrators can turn email copies of announcements on or off for a member. Users the department allows to see its records can view response statistics for each member and download them as a spreadsheet, and can see the attendance recorded at events. When a member changes their email address or phone number in Turnout, the change is made in FirePortal too. The FireHUD & Turnout tab explains what each of these contains.

Accounts and activity

Member accounts are created by the department's chief officers or other administrators. Members cannot sign up on their own. Passwords are stored only as one-way hashes. FirePortal keeps an audit log of changes to records, showing who made each change and when. When a department turns on Turnout for a member in FirePortal, the member's name and account details are shared with FireHUD through our Beacon ESS platform so the member can sign in to Turnout.

2. How We Use Information

• To keep each department's records and let its members and officers view and update them.
• To send email alerts that a department's officers choose to receive, for example when a driver log reports low fuel or an equipment problem, when an SCBA is checked in below pressure, or when protective gear reaches a set age.
• To produce the reports and exports a department asks for.
• To set up Turnout accounts when a department turns that on.
• To support users, fix problems and keep the service secure.
• To comply with the law.

3. Who Can See Information and Who We Share It With

Every record in FirePortal belongs to one department, and each department's records are kept separate from every other department's. Within a department, what a user can see and change depends on the role the department gives them. Officers and administrators generally see more than ordinary members.

We use the following kinds of companies to run FirePortal. They receive only the information needed for their part of the service, and they must protect it at least as well as this policy does.

• Our hosting provider, a cloud hosting company in the United States that hosts our servers, databases and file storage.
• Our network and domain provider, which provides our domain names, network protection and encrypted connections.
• An email delivery service, which sends FirePortal's email alerts.
• A routing service, which calculates driving distances from coordinates.
• Our business email and file storage provider, where our databases are backed up, and which keeps one of the two copies of each uploaded file.
• A cloud storage company, which keeps the other copy of each uploaded file.

We give departments the current list of the companies we use on request.

We do not sell FirePortal information or use it for advertising, and FirePortal does not contain advertising or analytics software from other companies. We may disclose information if we believe in good faith that the law requires it, or if it is needed to prevent death or serious harm. When we receive a legal demand for a department's records, we will refer it to the department where we can and tell the department about it unless the law does not allow us to.

4. How Long Information Is Kept

FirePortal records are the department's records. They are kept until the department deletes them or stops using FirePortal. Fire departments often have to keep training, equipment and incident records for many years, so we do not delete them on our own schedule. Audit log entries are kept as a history of changes.

Our databases are backed up every hour. We keep every backup for a week, one a day for two weeks, one a week for a year, and one from each year for the long term, as the Beacon ESS tab says. Information deleted from FirePortal can remain in those backups until they are removed on that schedule.

5. Security

Connections to FirePortal are encrypted with HTTPS (TLS). Passwords are stored only as one-way hashes. Every request is limited to the signed-in user's own department and checked against the user's role. Access to the systems that run FirePortal is limited to the Beacon Mid-Atlantic staff who need it. No system is perfectly secure. If we learn that a department's records have been accessed without authorization, we will notify the department promptly and give it the information it needs, and we will notify individuals directly when the law requires us to.

6. Your Choices and Rights

If you are a member of a department that uses FirePortal, ask your department's officers or administrator to see, correct or delete your records, or to close your account. You can also email us at privacy@beaconma.org and we will work with your department on the request. Some records, such as training or equipment records, may need to be kept under the rules that apply to the department.

7. Children

FirePortal is meant for fire department members and is not directed to children under 13.

8. Changes and Contact

If we change this section, we will post the new version here and update the date at the top of the page. If a change affects how department records are handled, we will also tell the departments that use FirePortal.

Questions about FirePortal or this section:

Beacon Mid-Atlantic (Beacon ESS)

privacy@beaconma.org

(215) 999-8747

Beacon ESS (Emergency Services Software) is a program of Beacon Mid-Atlantic that builds and runs software for fire departments, including FireHUD, Turnout and FirePortal. Beacon ESS is not a separate company. Beacon Mid-Atlantic is responsible for it and for the information it handles.

This section covers the Beacon ESS website, beaconess.org, and the shared platform that the Beacon ESS products run on. Each product also has its own section on this page: see the FireHUD & Turnout and FirePortal tabs.

1. The beaconess.org Website

No tracking

beaconess.org does not use analytics, advertising tags or tracking pixels, and it does not set cookies. It is hosted by our network and domain provider. When you visit, that provider receives your IP address, browser and device type, the page you asked for, the referring page and the time, and uses them to deliver the site and protect it from abuse.

Contact form

The contact form asks for your name, your agency or department, your role, your email address, your phone number if you want to give it, and your message. When you send it, the form is passed through our network and domain provider to an email delivery service, which emails it to our inbox at info@beaconma.org. Your email address is set as the reply address so we can write back to you. If the form cannot be sent, the site opens a pre-filled email in your own email program instead.

We use what you send only to answer your question, talk with you about our products, and follow up with your department. We do not add you to a mailing list or share your information with other organizations for their marketing. Messages are kept in our email as long as they are useful for the conversation and our records. You can ask us to delete them.

2. The Beacon ESS Platform

Behind FireHUD, Turnout and FirePortal is a shared platform we call ESS Core. It keeps track of the departments that use our products, which products each department has, the administrator accounts that manage them, and the station hardware we provide. It handles the following information.

Department records

For each department, we keep its name, the department number and code we assign, its address and contact information, and which Beacon ESS products it uses.

Administrator accounts

Chiefs and other department administrators have a single administrator account that signs them in to both FireHUD and FirePortal. This account includes the administrator's name, username, email address and the departments they manage. Passwords are stored only as one-way hashes. Ordinary members do not have platform accounts. Their accounts live in the product they use.

Beacon ESS staff accounts

Our own staff sign in to the platform with a password and a second verification step from an authenticator app. Staff access to department information is limited to what is needed to set up departments, support users and keep the service running.

Audit log

Every change made through the platform is recorded in an audit log with the account that made it, what was changed (including the values before and after), the department it affected, the time, and the IP address it came from. The audit log lets us and the department see who did what, and it is kept as a lasting record.

Station hardware

For the station devices we provide, the platform keeps each device's serial number, the department and station it belongs to, its software version and its update history. Software updates for these devices are checked before they are installed. The devices have no cameras or microphones.

Billing

Beacon ESS products do not take payments and do not collect card or bank information. Any billing between Beacon Mid-Atlantic and a department is handled separately, outside the products.

3. Our Role and the Department's Role

The records a department keeps in FireHUD, Turnout and FirePortal belong to the department. The department decides who gets an account and what is recorded, and is responsible for following the records and privacy rules that apply to it. Beacon Mid-Atlantic stores and processes those records on the department's behalf, to provide, support and secure the service. We do not use department records for our own purposes, sell them, or use them for advertising.

4. Service Providers

These kinds of companies help us run Beacon ESS. They receive only the information needed for their part of the service, and they must protect it at least as well as this policy does.

• Our hosting provider, a cloud hosting company in the United States that hosts our servers, databases and file storage.
• Our network and domain provider, which hosts beaconess.org and provides our domain names, email routing, network protection, access controls for our staff tools, and encrypted connections.
• An email delivery service, which sends email from our website and products.
• Our business email and file storage provider, where the databases and stored files of every Beacon ESS product are backed up every hour.
• The push notification services built into the phone (Apple's on iPhone, Google's on Android), which deliver Turnout alerts to phones.

We give departments the current list of the companies we use on request.

The FireHUD & Turnout and FirePortal tabs list the other kinds of services each product uses. We do not use text messaging (SMS) or voice calling services.

5. Backups and Retention

We back up every Beacon ESS database and file store each hour. We keep hourly copies for a week, daily copies for two weeks, weekly copies for a year, and one copy from each year, which we keep long term. Backups are used only to restore the service after a problem. Information deleted from a product can remain in older backups until those copies are removed on this schedule.

Department records, administrator accounts and audit logs are kept while the department uses our products. If a department stops using Beacon ESS, we will work with it to return or delete its records, subject to the backup schedule above and anything the law requires us to keep.

6. Security

All Beacon ESS websites and apps use encrypted HTTPS (TLS) connections. Passwords are stored as one-way hashes, and staff accounts require two-step verification. Each department's records are kept separate. Messages between our own systems are signed so they cannot be forged. Our hosting and backup providers protect stored data under their own security programs. No system is perfectly secure. If we learn that a department's information has been accessed without authorization, we will notify the department promptly and give it the information it needs, and we will notify individuals directly when the law requires us to.

7. Legal Requests

We may disclose information if we believe in good faith that the law requires it, such as in response to a subpoena or court order, or if it is needed to prevent death or serious harm. When a legal demand is for a department's records, we will refer it to the department where we can and tell the department about it unless the law does not allow us to.

8. Your Choices and Rights

If you contacted us through beaconess.org, you can ask us what we have from you, ask us to correct it, or ask us to delete it. If you use a Beacon ESS product through your department, contact your department's administrator first. You can also email us at privacy@beaconma.org and we will work with your department on the request.

The general information about state privacy laws, Do Not Track signals and visitors outside the United States in the Website & Programs tab applies to beaconess.org as well. beaconess.org does not set cookies, so there is nothing there to opt out of.

9. Children

beaconess.org and the Beacon ESS products are meant for fire departments and their members, not for children under 13. We do not knowingly collect information from children under 13 through beaconess.org.

10. Changes and Contact

If we change this section, we will post the new version here and update the date at the top of the page. If a change affects how department records are handled, we will also tell the departments that use our products.

Questions about Beacon ESS or this section:

Beacon Mid-Atlantic (Beacon ESS)

privacy@beaconma.org (privacy requests)

info@beaconma.org (general questions)

(215) 999-8747

This section covers ReCON, Beacon Mid-Atlantic's radio console software: the ReCON console for Windows and Mac computers, and the ReCON Go app for iPhone and Android. ReCON is used by Beacon Mid-Atlantic and the response organizations we set up on it. Beacon creates every account, and there is no way to sign up.

1. Accounts

Beacon creates every ReCON account. An account has a username, a display name and a password. Passwords are stored only as one-way hashes, so they cannot be read back, even by us. Each account has a radio configuration that Beacon assigns to it, with its radio ID and the talkgroups it can use. The parts of that configuration that are secret are encrypted so that only the signed-in device can read them.

2. Information We Collect

• Sign-in and device. When you sign in, the app creates a key on your device and sends us its public half, along with your device or computer name, its operating system, and the app version. We record each sign-in with its time and the IP address it came from.
• Who is on the air. While you are signed in, our servers know which account and radio ID are online, so the same ID cannot be used twice at once.
• Voice. When you hold the talk button, your voice is sent in real time through our radio network to the other radios and consoles on that talkgroup. Our servers relay it and do not record it. The radio network logs each transmission's radio ID, talkgroup and time. The app keeps a short replay of recent calls on your device only.
• Diagnostic logs. Only if you tap SEND LOG, the app's log is sent to us so we can fix problems.

ReCON Go uses the microphone only while you hold the talk button. It does not use your location, your contacts or your photos, and it contains no advertising, analytics or crash-reporting software from other companies. It does not track you across other apps or websites.

3. How We Use It

We use this information only to run ReCON: to sign you in, keep each radio ID to one user at a time, carry voice between users, keep the system secure, and fix problems. We do not sell it or use it for advertising.

4. Service Providers

We use the following kinds of companies to run ReCON. They receive only the information needed for their part of the service, and they must protect it at least as well as this policy does.

• Our hosting provider, a cloud hosting company in the United States that hosts our servers and databases.
• Our network and domain provider, which provides our domain names, network protection and encrypted connections.
• Our business email and file storage provider and a second backup storage provider in the United States, which keep copies of our database backups.
• Google Play and the Apple App Store, which distribute ReCON Go. What they collect when you download an app is covered by their own privacy policies.

We can tell you which companies we use on request.

5. How Long Information Is Kept

Accounts, radio configurations and the security log of sign-ins and changes are kept for as long as Beacon runs ReCON. When an account is deleted, its entries in the security log stay, because they are part of our security records.

Deleting a ReCON account

Because Beacon creates ReCON accounts, Beacon also deletes them. To have your account deleted, email privacy@beaconma.org or ask your Beacon contact. Deleting an account removes its password, its radio configuration and its access. Signing out of ReCON Go removes the session and the radio configuration from your device, and uninstalling the app removes everything it stored.

6. Security

All connections between the apps and our servers are encrypted. Voice travels through our network over an encrypted connection. Radio configurations are signed so the apps can check they came from us. Access to the systems that run ReCON is limited to the Beacon Mid-Atlantic staff who need it. No system is perfectly secure, and if we learn that information has been accessed without authorization, we will tell the people affected.

7. Children

ReCON is for Beacon Mid-Atlantic and the response organizations we set up on it, not for children under 13. We do not knowingly create accounts for children.

8. Changes and Contact

If we change this section, we will post the new version here and update the date at the top of the page.

Beacon Mid-Atlantic

privacy@beaconma.org (privacy requests)

info@beaconma.org (general questions)

(215) 999-8747

This section covers the Beacon Simulcast app for iPhone, iPad and Android. Simulcast plays radio calls recorded by scanner servers: Simulcast servers, which people run to record calls from sdrtrunk, and ThinLine Radio servers. The app has no content of its own, and there is no way to sign up in it. Accounts are made by the people who run each server.

1. Who the App Talks To

The app connects to:

• The scanner servers whose addresses you enter. These can be Simulcast servers or ThinLine Radio servers.
• Beacon's notification service, only if you turn on phone notifications.
• Beacon's link page, only when someone opens a link to a call that was shared with them.

The app has no ads, analytics or tracking. It does not use your location, microphone, contacts or photos. We do not sell any data from the app.

2. Your Scanner Servers

Each server is run by its owner, who is usually a person or group in your area and not Beacon. If you use a server that Beacon runs, we are that owner.

The app sends a Simulcast server:

• your email and password when you sign in, and your email if you ask for a password reset
• your phone's model name, such as "iPhone 15", to label the sign-in
• your phone's time zone, such as America/New_York, so alert times show in your local time
• the searches you type and the calls you play
• the scan lists, alerts and bookmarks with notes that you save
• a notification pass from Beacon's notification service, if you turn on phone notifications

The server keeps your account, your scan lists, alerts and bookmarks, your time zone, and a record of each sign-in with the phone model and when it was last used. Simulcast's server software does not keep your searches or a list of the calls you have played.

On a ThinLine Radio server, the app signs in with your email and password or your PIN, and sends the PIN with its requests for calls and alerts. Your ThinLine account, alerts and lists stay on that server. Bookmarks you make on a ThinLine server stay on your phone.

Anything else a server keeps, and for how long, is up to its owner, so ask them if you have questions.

3. Phone Notifications

Apple and Google only deliver notifications for an app through the company that publishes it, so phone alerts go through a small service Beacon runs at relay.beaconhear.org.

When you turn on phone notifications, the app sends the service your phone's push token (the address Apple or Google gives the app for notifications) and whether it is an iPhone or an Android phone. The service locks the token inside an encrypted pass that only it can open, and sends it back. The app gives that pass to your server, so your server never sees the token itself. When one of your alerts goes off, your server sends the service the pass and the alert (what set it off, the time, the radio, and a link to the call), and the service hands it to Apple or Google to deliver.

ThinLine Radio servers only send notifications to ThinLine's own app. So when you turn on notifications for a ThinLine server, the app also gives Beacon's service that server's address and your PIN. The service keeps them, with the PIN encrypted, and checks the server for your new alerts every 20 seconds so it can notify you. It deletes them when you turn notifications off or remove the server from the app, when your phone stops accepting notifications, or when the server keeps refusing the PIN.

The service does not save the alerts it delivers. Its web server keeps ordinary access logs (the time, your IP address and the address asked for), which roll over and are replaced as they fill up. To limit abuse it remembers IP addresses in memory for up to an hour.

On Android, notifications use Google's Firebase Cloud Messaging, which is built into the app and registers your phone with Google when the app starts.

4. Shared Calls

When you share a call, the link points to link.beaconhear.org and names the server and the call. If the person you send it to has the app, the link opens the call there, and they still need an account on that server to hear it. If they don't, they see a page from Beacon's service with where to get the app. That page does not look anything up; its web server keeps the same access logs as above.

5. Siri

On iPhone, the app gives Siri the names of your scan lists and channels so you can ask for them by name. Those names stay on your phone. Apple handles what you say to Siri under Apple's own privacy policy.

6. On Your Phone

The app keeps each server's address and your sign-in token or PIN in the phone's secure storage. It keeps your channel choices, stars, priorities, which calls you have played, and your settings in its own storage on the phone.

Removing a server in the app signs you out there, deletes what the app saved for it, and stops its notifications. Deleting the app removes everything it saved on the phone.

7. Your Account

Accounts are created and deleted by the people who run each server, outside the app. To have your account and everything saved with it deleted, ask them. On a Simulcast server's website you can also send them the request from your Account page. Beacon cannot delete accounts on servers it does not run.

8. Children

The app is not meant for children under 13.

9. Changes and Contact

If the app changes what it sends or to whom, we will update this section and the date at the top of the page.

Beacon Mid-Atlantic

privacy@beaconma.org (privacy requests)

info@beaconma.org (general questions)

(215) 999-8747