Privacy policy
Lemon Lime Software LLC ("LLS") provides LLS Fire Operations to participating fire departments. Each department decides who it invites and what its members record in the app. LLS operates the service, including sign-in, storage, notifications, security and support.
LLS Fire Operations is supplemental software for operational coordination and recordkeeping. It is not a computer-aided dispatch, emergency-notification or 911 system, and it does not replace one. Creating an incident, sending an alert or posting a message does not contact 911 or a dispatch center.
What we collect
| Data | Why |
|---|---|
| Name (if one has been entered for you), email address, user and organization identifiers, role and membership | Sign-in, access control, showing who did what |
| Password (kept only as a hash by our authentication provider) | Sign-in |
| Email addresses that department administrators enter to invite people | Inviting people to join a department |
| Check-off, work, meeting, attendance, preplan, hydrant, form and incident records your department creates, including notes, descriptions, addresses, form answers, typed signature names and attached files | The service, and the department's records |
| Meeting details your department enters (title, type, time, place, agenda), invitee lists, each member's attendance status and notes, and later corrections with their reasons | Meetings and attendance records |
| Preplan records your department enters: building and occupancy details, address and map coordinates, hazards, access points and notes, and, for members your department authorizes, sensitive access information such as lock-box location, access instructions and codes | Building information for responders |
| Incident reports that authorized members create: incident type, reported address, description and instructions, scene location pins (placed on the map, typed, or taken from your device's location when you choose), corrections and verification notes, and the alert sent to your department | Coordinating a department's response. It does not contact 911 or a dispatch center |
| Chat messages in channels and direct conversations, earlier versions of edited messages, reports about messages or members, members you block, your acceptance of the community rules (recorded separately from your acceptance of the Terms of Service), channel membership and read position | Department communication and moderation |
| Photos you attach as check-off evidence (depending on your department's setup, a photo is optional, or is required when an item is marked as an issue), and photos and PDF files you attach to forms | Evidence for that check-off; supporting material for that form. Photos are re-encoded on your phone before upload and again on our servers, which removes embedded camera data such as location tags. Files are checked for malware and validity before anyone can use them. PDF files are stored as you upload them and may contain their own embedded information |
| Precise location, when you complete a location-verified check-off, ask for nearby hydrants or preplans, or choose to use your device's location as an incident scene pin: one reading at a time, only while the app is open. A reading that is captured is kept with the check-off, including when the check-off fails because the reading was too far away or too imprecise; if location is denied or unavailable, only a record of that attempt, without coordinates, is kept. A scene pin you save is kept with the incident | Verify presence at the apparatus; find nearby hydrants and preplans; mark a scene. The app does not collect location in the background or track it continuously |
| Push notification token and installation identifier, only if you turn notifications on | Deliver department alerts |
| Records of actions (audit log), including reasons administrators type for access changes | Security and accountability |
| Records that you accepted, or declined, our Terms of Service: the version, the time and whether it was the mobile app or the web application and, for an acceptance, a fingerprint of the text you were shown. If you accept department terms as your department's authorized representative, we also keep your typed name and title, the three confirmations you give, the commercial offer you accept (including the legal name of the contracting party), the subscription start date recorded for the department and the time of your most recent sign-in | Contract and audit evidence that a Terms version was accepted or declined |
| Technical logs kept by our hosting providers, such as IP addresses and request times | Operating and securing the service |
| Emails you send to our support address | Answering you |
When you ask for nearby hydrants or preplans, your current location, or the pin you placed on the map, is sent to our servers to find them. If you choose Directions, the destination is passed to your device's maps app, and if you share an address it goes to the app you pick. When you create an incident, the scene location you place, type or choose is sent to our servers and stored with the incident.
When you use address search, the address text you type, together with an approximate map area for your department (not your location), is sent through our servers to Geoapify, an address-search provider, which returns matching addresses. We do not save what you type in address search. If you choose a result for an incident, a map pin or a shared address, that location is handled as described above.
We have not added advertising, analytics or crash-reporting software to the mobile app, and we do not track you across other companies' apps or websites. Software components we use, such as push notification libraries and Apple's and Google's push services, and our hosting providers may send or keep technical information, such as logs and crash information, under their own policies. We do not sell personal information, and we do not share it with advertisers or data brokers.
Who can see your information
Your department's administrators, and other members according to their roles, can see the records you create, including check-off location and photos. People at LLS, including contractors, access department data only as needed to run, secure and support the service, or as required by law. Messages in a channel are visible to that channel's members and to your department's administrators. Direct messages are visible to their participants; department administrators cannot open them in the administration application, but if a participant reports a direct message, a copy goes to your department's chat administrators for review. Form submissions are visible to you and to the members your department authorizes to review them. Incident reports and the alerts sent for them are visible to your department's members. Sensitive preplan access information is limited to members your department authorizes. Each member sees the meetings they are invited to and their own attendance status; members your department authorizes can see more. The text of the Department Terms can be read by the active members of the department it is offered to. The commercial offer, including its price, is shown only to the department's authorized representative and to LLS.
Companies that host or deliver the service
- Supabase — database, sign-in, file storage and real-time messaging (United States, AWS us-west-2).
- Expo — app builds and the push-notification relay, with Apple and Google push services, only if you turn notifications on. They receive your device's notification token and a short generic notification.
- Resend — sends account emails, such as sign-up confirmation and password reset.
- Amazon Web Services — hosts the map tiles you download. It sees your device's IP address and the map area requested.
- Geoapify — finds street addresses when you use address search. It receives the address text you type and an approximate map area, but not your name, your account or your device. It keeps the requests it receives under its own privacy policy.
- Vercel — hosts the department administration web application and the LLS platform administration application.
- OVH — runs the notification dispatch server, which handles notification delivery data only (notifications never contain message, form or incident text), and hosts the road-route server we operate, which calculates routes to nearby hydrants. A route request carries only the start and destination coordinates (the start is the location you searched from, which may be your current location), not your name, your account or your device.
- Google (Gmail) — receives and stores the emails you send to our support address.
- Cloudflare — hosts this public information site and keeps technical logs such as IP addresses and request times.
LLS also runs servers that scan and process the photos and files you upload.
Map data
Maps use OpenStreetMap data © OpenStreetMap contributors. Address search is provided by Geoapify using OpenStreetMap and other open data. Further sources are credited in the app under About and policies.
Retention
We do not delete operational and audit records on a schedule, and we have not set an automatic deletion period for them. This includes the reasons administrators type for access changes. The service does clear some temporary data automatically, such as check-off photo uploads that were never completed, were rejected or were withdrawn. Files attached to forms that are unfinished or that fail our checks are not used, but they may remain stored.
We do not delete Chat messages on a schedule, and we have not set an automatic deletion period for them. When an account is deleted, that person's messages are removed as described under 'When an account is deleted'. A copy of a message attached to a report that is still open may be kept until the report is resolved; we have not set an automatic deletion period for open reports.
Incident reports, meeting and attendance records, preplans, form answers, typed signatures and attached files are kept like other operational records; we have not set an automatic deletion period for them. Text typed into them stays as it was typed.
Records that a person accepted or declined our Terms are kept as contractual and audit evidence, and remain after an account is deleted. We have not set an automatic deletion period for them.
Photos you upload for a check-off that finish processing but are never attached to a submitted check-off are kept. We have not set an automatic deletion period for them.
The department administration web application still includes administration tools for these records.
Copies in backups and provider logs are kept for the period set by the provider that holds them. We also keep backup copies ourselves and have not set a deletion period for them. Copies can remain for some time after an account is deleted. Emails you send to our support address are kept in our support mailbox.
When an account is deleted
See Request account deletion for how to ask and how long it takes. The following are removed or replaced with a neutral label:
- Your profile name (replaced with "Former member").
- The email address and phone number on your account. Your sign-in is disabled and the account email is replaced.
- Roster details such as an employee number, and invitation email addresses for your account.
- Your notification registrations and preferences. A notification registration that has delivery history is disabled and its device token overwritten instead of being deleted.
- Your Chat messages, in channels and in direct conversations, are replaced with a removed-message placeholder, and earlier versions of edited or removed messages are blanked. Copies of a message attached to a report are removed when the report is resolved.
We keep some records after an account is deleted, for operational and security purposes. Audit and authorization history is kept so that access changes and actions in a department can be reviewed. Records created for a department, such as check-offs, work and forms, stay available to that department so it can continue its own record-keeping. We have not set an automatic deletion period for them.
- Audit and authorization history (who had access and when), including the reasons administrators typed.
- Department operational records you took part in (such as check-offs, work, forms, meetings, hydrant reviews and alerts), including photos attached as check-off evidence and files attached to forms. They no longer carry your profile name; names typed into signatures or free-text fields remain.
- Anything typed into those records stays as it was typed: notes, form answers (including any email address or phone number you entered) and the location recorded with a check-off. A location reading captured on an attempt that failed because it was too far away or too imprecise is kept too; an attempt where location was denied or unavailable is kept only as a record with no coordinates.
- Invitations you created for other people, including the email addresses you entered, are kept.
- Incident reports, preplans, and meeting and attendance records your department created are kept like other department records. Anything typed into them, such as incident descriptions and addresses and attendance notes, stays as it was typed. We have not set an automatic deletion period for them.
- Chat: the placeholder for each message you posted stays in the conversation, linked to your account record (shown as "Former member"); the message text is not kept. What other members wrote about you or quoting you stays as they wrote it. A copy of a reported message may be kept until the report is resolved. Report, block, community-rules, channel-membership and read-position records involving you stay. Administrator-typed reasons and resolution notes stay as typed. Other members' devices may keep showing your name on messages they already have until their app refreshes.
- Your account record, with your name and contact details removed (shown as "Former member"), and your inactive membership records.
- Records that you accepted, or declined, our Terms of Service. An acceptance record shows which version, a fingerprint of its text and when; a decline record shows which version and when. These records are kept as contractual and audit evidence. If you accepted the department terms as your department's authorized representative, your typed name and title, the confirmations you gave, the commercial offer you accepted and the subscription start date recorded with it are kept too and are not removed. We have not set an automatic deletion period for these records.
- A record of the deletion request itself.
- Records that notifications were delivered to you, kept without the device token.
- Emails between you and us, such as your deletion request and our confirmation, in our support mailbox.
- Copies in backups and provider logs are kept for the period set by the provider that holds them. We also keep backup copies ourselves and have not set a deletion period for them. Copies can remain for some time after your account is deleted.
Your choices and requests
Ask your department administrator first about access to or correction of your information. You can also write to llsfireoperations@gmail.com about access, correction or deletion. You can ask us to review or remove a specific record we keep after an account is deleted; we decide each request individually and tell you our decision in writing, and we may not be able to remove every record. You can turn off location, camera, photo library and notification access at any time in your device settings. This stops future collection through that permission; it does not remove records already created. To request deletion of your account see Request account deletion.
Security
The app and our servers communicate over encrypted connections. We use database access rules designed to keep each department's data separate from other departments' data. No system is perfectly secure. If we learn of a security incident that affects personal information we hold, we will tell the affected departments and notify others as the law requires.
Sensitive information
The app is not designed to store patient health records. Do not enter patient health information or other people's sensitive personal information anywhere in the Service, including Chat, Forms, check-off notes, Work, meeting and attendance notes, preplans, hydrant records and incident reports.
Children
The app is for members invited by a fire department and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you think a child under 13 has an account, write to us. We review it promptly and remove the child's account and the personal information we can remove.
Changes
We post changes here. The effective date at the bottom of each page is the date this version was published.