WATCHDESK

This Privacy Statement describes how WATCHDESK LLC (“WATCHDESK”) collects, uses, stores, shares, and protects personal information through the WATCHDESK application (“the Application”), a web-based management platform for volunteer fire departments and emergency services organizations.

1. Member profile information. Member’s full legal name and nickname; email address; mobile and home phone numbers; date of birth; mailing address; driver's license information; Social Security Number; PGFD identification number; membership type and status; join and termination dates; organizational rank and role; race (visible only to station administrators, not to general users); apparel sizing; administrative notes; and personnel history records (awards, promotions, leave of absence, and disciplinary actions).
2. Emergency contact information. Name, relationship to the member, address, phone number, and email address of the member's designated emergency contact.
3. Activity and service records. Emergency response records (call details, unit assignments, crew roles); meeting attendance; drill participation; training records; learning management records (course enrollment, module progress, and assessment results); collateral duty hours; standby and duty crew hours; positions held; and military service periods.
4. Authentication and session data. Email address used for OAuth sign-in (Google Workspace or Microsoft 365); session identifiers; and, for stations using local authentication only, username and hashed password. WATCHDESK does not store passwords for OAuth users.
5. Uploaded files. File attachments (PDF, images, documents) associated with training records, member profiles, response records, and other entities.
6. Messages and notifications. If your station enables messaging or notification features: message content, delivery status, mobile phone numbers and SMS opt-in and opt-out records (see the SMS Terms & Conditions), and push notification device tokens for devices on which you enable push notifications.
7. Polls and voting. If your station uses the voting feature to poll members on station matters: poll configuration and results. Polling and voting procedures are dictated by the Customer, and WATCHDESK has no role in implementing any polling or voting procedures, or verifying any results.
8. Ambulance billing data. Ambulance billing data is collected if your station enables the ambulance billing feature.
9. Station billing information. Business contact and invoicing information for the station officers responsible for a station's subscription to WATCHDESK. Payment card or bank account details, if collected, are processed by a payment processor and are not stored by WATCHDESK.
10. Audit and activity logs. WATCHDESK automatically logs administrative actions within the Application, including the email address of the user performing the action, a timestamp, and a description of the action taken.

1. WATCHDESK may generate aggregated or de-identified statistics that do not identify any station or individual, to operate, improve, and benchmark the Application.
2. No commercial use: WATCHDESK will not sell, rent, or trade personal information to third parties for marketing or any other commercial purpose. Mobile data will not be shared with third parties. Mobile phone numbers, opt-in records, and consent data are used solely to deliver the messages you have opted in to receive.

Full SSNs are encrypted at rest using AES-256-GCM authenticated encryption, with encryption keys stored in Google Cloud Secret Manager, separate from the database. Full SSNs are decrypted only when generating official LOSAP or state tax credit forms as required by county or state agencies. Access to SSN data is rate-limited and individually logged, and SSNs are never displayed in standard application views; only a masked format (for example, ***-**-1234) is shown.

The Application is hosted on Google Cloud Platform and uses Google App Engine, Google Cloud SQL, Google Cloud Storage, and Google Cloud Secret Manager. All connections are encrypted in transit (TLS/HTTPS). Access requires authentication via OAuth (Google or Microsoft) or local credentials; role-based access control limits functionality by assigned role; multi-tenant architecture isolates each station's data; file attachments are served through authenticated endpoints only; and sessions expire after 4 hours of inactivity. The Security Overview at watchdesk.org/security describes these controls in detail.

1. Information Access Within the Application: Station Administrators (station personnel with full station-level control) can view and edit member records, activity data, and reports for their station, and can reveal full Social Security Numbers on a rate-limited, individually logged basis (certain demographic information, such as race, is visible only to Station Administrators); Data Entry users (station personnel who can create and edit records for all station members but cannot delete them and have no administrative access to full SSNs) can add and edit records but cannot delete them; Certifiers (station personnel who review and certify annual LOSAP and state tax qualification status, a role kept separate from Station Administrator to allow segregation of duties) can review and certify LOSAP and state tax qualification status; System Administrators (WATCHDESK personnel) can access all stations for technical support and system administration; and Members (the default role) can view and submit their own profile and activity data.
2. External disclosure: WATCHDESK may share information collected by WATCHDESK when required by law, subpoena, court order, or government investigation; and with service providers that process data on our behalf, including Google Cloud Platform (infrastructure), SignalWire (SMS delivery, processing mobile numbers and message content), and payment processors we might use (station subscription payments).
3. Customer information isolation: Each customer’s data is maintained separate from all other customers’ data. Members of one customer cannot see or access data from any other customer. All database queries are automatically scoped to the logged-in customer’s member.

Active member records are retained for the duration of a member's service and thereafter to support historical reporting, LOSAP credit verification, and audit requirements. Terminated member records are retained with a termination date but are not automatically deleted; Social Security Numbers of terminated members are retained only as long as reasonably needed for pending or anticipated LOSAP or tax credit filings and verification, and are then securely deleted. Activity logs are retained for audit and accountability purposes. Session data is purged automatically after expiration. File attachments are retained until deleted by an authorized administrator. If a station's subscription ends, the station may export its Customer Data for ninety (90) days after termination (except in the case of termination for the station’s material breach), after which WATCHDESK will delete the station's Customer Data from its active systems within sixty (60) days, using secure deletion methods for Social Security Numbers, and will confirm deletion upon the station’s written request, in accordance with the Customer Agreement. Volunteer fire department records may be subject to state or local retention requirements. As provided in the Customer Agreement, the station determines what Customer Data it retains and is responsible for complying with any retention requirements applicable to it.

A member whose data is stored in the Application may: access their personal information on the Application, unless otherwise suspended or prohibited from use; request correction of inaccurate personal information by contacting your station administrator; request deletion of your personal information input into the WATCHDESK application by contacting your station administrator, subject to the retention limitations in this Statement and the Customer Agreement; request information about what member data is maintained; and raise concerns about how member data is handled by contacting us at the address below.

The Application uses a single session cookie (connect.sid) for authentication. It is strictly necessary for the Application to function, contains only a session identifier, is not used for tracking, analytics, or advertising, and is deleted when the session expires or the browser is closed. WATCHDESK does not use third-party tracking cookies, analytics services, or advertising technologies.

The Application is intended for use by volunteer fire department members and administrative personnel, and all use is subject to applicable federal and state laws. No minor (any individual under 18 years of age) is permitted to use the Application without the consent of a parent or guardian, obtained through the minor's station, which consent includes platform communications such as SMS where applicable.

WATCHDESK maintains safeguards designed to protect personal information. If WATCHDESK experiences a breach of the security of a system involving personal information, WATCHDESK will conduct a prompt, good-faith investigation and will provide notification in accordance with applicable law, including the Maryland Personal Information Protection Act. Because your station determines what information is entered into the Application, WATCHDESK will notify your station of a breach affecting personal information that WATCHDESK maintains on the station’s behalf, and will share the information the station reasonably needs to meet any notification obligations it has as the owner of that information.

This Privacy Statement may be updated from time to time to reflect changes in privacy practices or applicable laws. Material changes will be communicated through the Application or by other appropriate means. The “Last Updated” date at the top indicates when the most recent revisions were made.

WATCHDESK LLC
11831 Scaggsville Rd., PO Box 153, Laurel, MD 20723
410-417-8309
admin@watchdesk.org

For security controls, see the Security Overview; for platform features, see the Platform Overview.