Privacy Policy

Last updated: October 14, 2026

Fireline Colorado, LLC (“stationOS,” “we,” “us,” or “our”) operates the stationOS platform, including bay, reports, charts, personnel, and Respond — the live dispatch board, the Respond apps for iPhone, Android, Apple Watch, CarPlay, and paired Garmin watches, and Respond Display for Apple TV — together with related services (collectively, the “Service”). This Privacy Policy explains how we collect, use, store, and protect your information when you use the Service.

Three kinds of data in the Respond apps deserve their own explanation, and they are covered in detail below: your location while you are responding to a call (Section 3), photos you take of a call (Section 4), and your heart rate if you turn on Exertion monitoring (Section 5).

1. Information We Collect

Information you provide:

• Account information (name, email address, department name)
• Data you enter into the Service (inspection records, incident reports, certification records)
• Communications you send to us (support requests, feedback)

Information collected automatically:

• Usage data (pages visited, features used, timestamps)
• Device and browser information (browser type, operating system)
• IP address and general location data
• Cookies and similar tracking technologies

Information collected by the Respond apps:

• Precise location while you are actively responding to a call — see Section 3 — and, when you photograph a call, where you were at that moment — see Section 4
• Photos you take of a call with Respond’s camera, with the time you took each one and any caption you add — see Section 4
• Heart rate, on Apple Watch, only if you turn on Exertion monitoring — see Section 5. This is processed on your device and never sent to us.
• Your response to a call: whether you are responding, where you are headed, your estimated arrival time, and when you arrived
• A push notification token for your device, so dispatch alerts can reach it
• Your rank and certifications, read from your department’s personnel records, to show your role on the responder roster

Information collected by station displays (the station board on a TV, a browser, or an iPad, and the alert boxes that drive a station’s lights and speakers): the credential the screen was paired with, its software version, and technical logs from the device — see Section 6.

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Deliver dispatch alerts to your device
• Show your department who is responding to a call, where they are headed, and how far out they are
• Process transactions and send related information
• Send technical notices, updates, and support messages
• Respond to your inquiries and provide customer support
• Monitor and analyze usage trends to improve user experience
• Detect, prevent, and address technical issues or security threats

We do not sell your information. Data from the Service and the Respond apps is never used for advertising. The only advertising use is the marketing website, described in Section 9.

3. Location Data in the Respond Apps

The Respond apps collect precise location so your department knows who is en route to a call and how far out they are. This section describes exactly when that happens and who can see it.

When we collect it. Only while you are actively responding to a call — from the moment you mark yourself responding until you arrive, stand down, or the call closes. Collection also stops automatically after 20 minutes. The app collects location in the background during that window, because you are usually driving. Outside that window, the only time we collect your location is when you take a photo of a call — the position at that moment, attached to that photo (Section 4). Never in the background, and never on its own.

Who can see it. Your live position and estimated arrival are shared with your department — your crew and incident command — on the live board and the incident screen. This is the purpose of the feature: it is how command knows who is coming. It is not shared with anyone outside your department, and it is not sold or used for advertising.

Arrival detection. The app uses an on-device geofence to notice when you reach the scene or your station, so your arrival is recorded even when you have no cell signal. The geofence runs on your device; only the resulting arrival is sent to us.

Gaps in coverage. If you lose signal, the app buffers your location on your device and sends the missed portion when you reconnect, so your track through a dead zone is not lost.

Apparatus devices. A device mounted in a rig reports the vehicle’s position while it is in service, so apparatus appear on the district map. This reports the location of the vehicle, not of a specific person.

Your control. You can turn off live location sharing in Settings › Responding at any time, and still respond to calls — your estimated arrival is shared, but your live position is not. The same setting stops a position being attached to photos you take; the photos still reach the report, without it. You can also revoke location access entirely through your device’s system settings, in which case the app cannot show your position or estimate your arrival.

How long we keep it. Your current position is stored on your response to that call. The short trail of points used to fill in signal gaps is kept for approximately 30 minutes and then deleted. Your response to a call — including your arrival time — is retained as part of that incident’s record, because it forms the personnel roster used for incident reporting.

4. Scene Photos in the Respond App

The Respond app for iPhone, iPad and Android has a camera for photographing a call you are on — the scene, the damage, what the report will need to show.

Where they go. Each photo goes to your department’s report for that call, credited to you, with the time you took it, any caption you add, and — unless you have turned off location sharing (Section 3) — where you were standing when you took it. We remove the other information a camera normally stores in an image file, such as the make and model of your phone.

Where they do not go. Respond cannot read or write your photo library at all, so a photo taken in Respond is never saved there by the app, never appears in iCloud Photos, Google Photos or a shared album, and is not included in your device’s backups or carried across when you set up a new phone from an old one. A photo of a call can show a patient or the inside of somebody’s home; it belongs in your department’s report and nowhere else.

One exception, on Android. Respond does not ask for camera permission; it hands the shot to your phone’s own camera app and takes the picture back. Some manufacturers’ camera apps keep a copy of everything they take in your gallery before handing ours over. That copy is your camera app’s, not Respond’s — we cannot see it and cannot remove it. If pictures you took in Respond turn up in your gallery, that is where they came from, and deleting them there is up to you.

On your phone. A photo stays inside Respond only until it has been sent. If you have no signal, it waits on your phone and sends itself when you do. Once it has been received, the copy on your phone is deleted.

Who can see them. In Respond, a photo can be seen by you and by your department’s officers. Once it is on the report, it can be seen by anyone in your department who can open that report. Photos are not shared outside your department, not used for advertising, and not sold.

How long we keep them. Respond holds a photo only until your department’s report has taken its own copy, and deletes the image seven days after that — or after 90 days, if no report ever collects it. A record that the photo was taken — who took it, when, where, and its caption — stays with the call, like the rest of your response to it. The copy on the report is part of that incident’s record and is kept with it, under your department’s own retention of its reports. You can delete a photo you took from the call screen in Respond.

5. Health Data in the Respond App

The Respond app includes an optional feature called Exertion, which uses your Apple Watch to show you what a call takes out of you.

It is off unless you turn it on. Exertion is opt-in. Your department cannot enable it for you, and cannot see whether you have it on.

What it reads. With your permission, and only while you are actively responding to a call, Respond reads your heart rate from Apple Health on your Apple Watch. If you allow it, Respond also reads your date of birth, used solely to personalize the heart-rate threshold at which the app will tap your wrist.

Where it goes: nowhere. Your heart rate is read on your watch, evaluated on your watch, and stays on your devices. It is never transmitted to stationOS servers, never stored by us, never logged, and never visible to anyone in your department — not your officers, not incident command, not your chief. We do not receive it, so we cannot share it.

What we do with it: nothing. We do not use health data for advertising or marketing, we do not sell it, we do not disclose it to any third party, and we do not use it for data mining or any use-based analysis. Health data is used only to provide the Exertion feature to you, on your device.

Saving to Apple Health. If you leave the “Save to Health as a workout” setting on, each call you respond to is written to Apple Health on your own device as a workout, so you can look back at it alongside the rest of your activity. That record lives in your Apple Health data, under your control and your device’s settings — not in ours. You can turn this off in Settings › Responding.

Withdrawing permission. You can turn Exertion off at any time in Settings › Responding, which stops monitoring immediately, including during a call in progress. You can also revoke Respond’s access to health data at any time in iOS Settings › Privacy & Security › Health. Health data already written to Apple Health stays there until you delete it in the Health app.

Exertion is not a medical device. It cannot detect a heart attack, cardiac arrest, or any other medical condition, and it does not diagnose, treat, or monitor any illness. Not receiving an alert from it does not mean you are well. It is not a substitute for medical care or for your department’s rehab procedures. If something feels wrong, act on that.

6. Station Displays

A department can put its board on screens in its stations — a TV running Respond Display, a browser, or an iPad — and run alert boxes that drive the station’s lights, speakers, and doors. These are devices, not people, and this section describes what they send us and what they show.

No personal account. A display is paired by scanning a code with a phone signed in to stationOS. It then holds a credential issued by the department that identifies the screen to us. Nobody signs in on the display, and it holds no password.

What a display sends us. The credential it was paired with, its software version, and technical logs from the device — for example, whether an alert played and how long it took — so we can keep the board working and find out why when it doesn’t. It does not use a camera or microphone, and does not record who is in the room.

What a display shows. The calls and information of the department that paired it, to anyone who can see the screen. A department can mark a screen as public-facing, for a lobby or a front window; a public-facing screen shows each call only as its type and street, with no house number, map, names, or other detail. That reduction happens on our servers, so the full detail never reaches the screen.

Displays that belong to a member. If a department allows it, a member can pair a display of their own, such as a TV at home, which shows their station’s board. That display, and the logs it sends, are associated with that member. It stops working when they leave the department, and the member can limit it or remove it at any time.

Who can see it. A display’s logs are seen by stationOS staff to support and fix the Service. They are not shared outside stationOS, not used for advertising, and not sold.

How long we keep it. Technical logs from displays are kept for 30 days and then deleted. A display’s pairing is kept until the department removes the screen.

7. Data Storage and Security

Your data is stored on secure cloud infrastructure within the United States. We implement industry-standard security measures to protect your information, including encryption in transit (TLS) and at rest. For more detail on our infrastructure, encryption, and compliance posture, see our Security & Data Handling page. While we take reasonable steps to protect your data, no method of electronic storage or transmission is 100% secure.

8. Data Sharing and Third Parties

We do not sell your personal data to third parties. We may share your information with:

• Your department. Your response to a call — including your live location and estimated arrival while responding — is visible to other members of your department, as described in Section 3. Photos you take of a call go to your department’s report for it, as described in Section 4. This is the core function of the Service.
• Service providers who assist in operating the Service (hosting, payment processing, analytics, and ad measurement on our marketing website — see Section 9), bound by confidentiality obligations
• Payment processor: We use Stripe as our payment processor. When you make a purchase, Stripe collects and processes your payment information in accordance with their own privacy policy
• Legal requirements: When required by law, regulation, or legal process
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users

Health data is never included in any of the above, because it never leaves your device (Section 5).

9. Cookies

We use cookies and similar technologies to maintain session state, remember your preferences, and understand how you use the Service. You can control cookie settings through your browser. Disabling cookies may affect the functionality of the Service.

Website analytics. Our marketing website uses Umami, a self-hosted, privacy-focused analytics tool. It sets no cookies, does not track you across other websites, and collects only aggregate visit data — page viewed, referring site, general region, and browser type. Nothing it records identifies you personally, and none of it is sold or shared with advertisers. It runs on our own infrastructure rather than a third party’s.

Advertising pixels. Our marketing website, stationos.io, uses the Meta Pixel and the TikTok Pixel so we can see whether our ads on Facebook, Instagram and TikTok are working, and show our ads again to people who have visited. They record the pages you view and a few things you do on the site: requesting a demo, starting or submitting a department signup (with the plan you picked), and tapping the App Store or Google Play links. Meta and TikTok also receive your IP address and browser details, may set cookies, and may connect this to an account you have with them, under their own privacy policies. We do not send them your name, email, phone number, or anything you type into a form. These pixels run only on the marketing pages of stationos.io. They are not on our Respond support or account-deletion pages, and never in the stationOS app, the Respond apps, or station displays. They also stay off a signup page opened from a link we email you, so the code in that link is never sent to Meta or TikTok.

To opt out, use an ad blocker or your browser’s tracking protection, block third-party cookies, or change your ad settings with each platform: Meta’s Ad Preferences (facebook.com/adpreferences) and TikTok’s ad settings (in the app, Settings and privacy › Ads).

10. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Upon account termination, we will make your data available for export for a reasonable period and then delete it from our systems within 90 days, unless retention is required by law.

Location data follows the shorter schedule described in Section 3, scene photos the schedule described in Section 4, and technical logs from station displays the schedule described in Section 6. Health data is not retained by us at all, because we never receive it.

11. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a standard format
• Opt out of non-essential communications

To exercise any of these rights, contact us at hello@stationos.io.

12. Children’s Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

14. Contact

If you have questions about this Privacy Policy, please contact us at hello@stationos.io.