Privacy policy

1.1 This policy is published by FireMic LLC, a New Jersey limited liability company ("FireMic", "we", "us"). Section 18 says how to reach us.

1.2 FireMic is not a government agency and is not affiliated with, endorsed by, or acting on behalf of USFA, FSRI, FEMA or any state agency.

1.3 This policy covers fire-mic.com and its subdomains, the FireMic app at app.fire-mic.com, the anonymous trial, the free NERIS reference tools, the partner API and the hosted mic page.

1.4 Our role. For reports and records we hold for a fire department, we process information on the department's behalf, and the department decides who may use FireMic and what is recorded. For narrations sent through another company's software, we process them on that company's behalf (section 6). For the trial, our website, our analytics and our work to improve FireMic, FireMic decides how information is used.

1.5 What we collect depends on how you meet FireMic. Sections 2 to 6 cover each case: using the app for your department, using the trial, visiting our website, being named in a report, and using FireMic inside another company's software.

What you record and write:

• Your recording. Audio you record to describe an incident, or a typed account instead. Section 7 explains where the audio goes.
• The transcript of what you said, stored with the report. Narratives often contain the names, addresses and medical details of the people involved. We treat the transcript as the most sensitive thing in FireMic, and explicit rules keep it out of our error reports and our analytics.
• The report: incident type, times, location, units, actions, narrative, and any fire, medical, hazardous situation or exposure details, with who filed it and NERIS's response. Everyone on your department's roster in FireMic can read its reports.
• Your answers when the app asks a follow-up question, by voice or text.
• Photos you attach, in a private storage bucket with no public read access. Download links are signed and last up to one year.
• Station records you create, such as training and attendance, who responded to each call, pre-incident plans, apparatus checks, hydrant inspections and flow tests, monthly notes and exposure records. An exposure record can include symptoms.
• Review activity. If your department uses officer review, comments and a record of who approved, returned or changed a report, and when.

Who you are:

• Your name, role and squad on your department's roster, so a report can be attributed to whoever filed it.
• Your email address when you sign in. If you sign in with Google, we never see your Google password. Some older accounts sign in with an email address and password; that password goes to our sign-in service, and we no longer open new password accounts.
• A PIN for officers and admins, stored only as a one-way hash. We cannot read it back.
• Your department and its NERIS identifier, which is public federal data, or the name you typed if you could not find it in the directory.
• Invitations. If you invite a colleague, who invited whom and when, so the invitation can be credited.
• Approvals. When an officer or FireMic support approves a member, a record of who did it and when.

Technical data:

• An anonymous identifier, a random value stored in your browser so that a visit to our website and a later visit to the app count as one person. It is not derived from anything about you. Our analytics service uses it to count visits, and if you sign in, we link it to your account. It is never sold or used for advertising.
• Usage events, if analytics is turned on: which steps of the app you reached and how long they took, never the content of a report. Properties whose names look like personal details are removed before an event is sent, and long text is dropped. Some events sent from our server include your IP address, so our analytics service can place the event roughly on a map.
• A usage log in our own database: each sign-in, transcription, draft and submission, with the member, department and time, and no report content.
• Page view counts in the app, without cookies.
• Error reports, if error reporting is turned on: a technical description of the error and the page it happened on, with request bodies, cookies, sign-in headers, transcripts, report contents and email addresses removed.
• Rate-limit counters, keyed on a hash of an IP address or anonymous identifier. We do not store raw IP addresses for this purpose.

3.1 What we hold. Your recording, transcript and draft, stored apart from every department's records. A random identifier in your browser, and a separate secret key in a cookie your browser's scripts cannot read; both are needed to open your drafts. If you file a trial report to NERIS's test system, the report as filed, NERIS's response and the time. A one-way hash of your IP address, used only to limit how often the trial can be used.

3.2 Rule 1. Trial drafts you don't file are deleted after 30 days; trial reports you file to NERIS's test system are kept until deleted. A job that runs every day deletes unfiled trial drafts more than 30 days old, unless you have signed in and claimed them, and between runs an expired draft cannot be opened, because every read checks the date. We keep the trial reports you file so we can see how FireMic handles real calls, and our team reads them for that, including their transcripts. To have one deleted, email us through the contact links. A report filed to NERIS's test system is also held by NERIS, and we can delete only our copy.

3.3 Rule 2. A trial report is never filed to a real department's NERIS record. Filing it sends it to NERIS's test system under FireMic's own test department. Our server chooses that destination, and nothing your browser sends can change it. Filing to your own department requires signing in, and a department that has authorized FireMic. A department's dispatch lookup in FireMic leaves out every incident a trial filed, so a trial report can never be merged into a department's report.

3.4 Rule 3. Every trial screen tells you it is a trial and shows the date your draft expires.

3.5 Rule 4. Anonymous trial recordings are never used as training data.

3.6 During the trial, your recording is not saved to your device's storage.

3.7 If you sign in and claim a trial draft, it is kept for you and is no longer deleted after 30 days.

3.8 The identifier that groups your trial drafts does not unlock them. Opening a draft also needs the secret key in your browser's cookie, which we store only as a hash.

4.1 When analytics is turned on, we collect the pages you view and for how long, the buttons and links you click, how far you scroll, which sections you see, and click heatmaps. In the search boxes of the free tools (the NERIS incident type list and the NERIS ID lookup), we also record the words you search for and how many results came back, so we can see what is missing. These boxes are for codes and department names, so please don't type personal information into them. Nothing you type in the FireMic app is recorded by analytics.

4.2 We see roughly where visitors are (country, state and city), which our analytics service works out from the IP address.

4.4 When analytics is turned on, the website also stores the anonymous identifier described in section 2, and shares it with the app so that a website visit and a later app visit count as one person.

4.5 We also count page views on the website without cookies.

4.6 Some pages load their fonts from a public font service, which sees your IP address.

4.7 The website has no database of its own, and apart from the free-tool searches in 4.1 it records nothing you type. The contact links open your own email, phone or messaging app.

4.8 We do not respond to Do Not Track or Global Privacy Control signals today. A content blocker stops our analytics, and we do not work around it.

5.1 Reports can include information about people who never use FireMic, such as patients, occupants, owners, witnesses and other responders. That can include names, addresses, ages, injuries and medical care.

5.2 We hold this information for the fire department that made the report, as part of its records. If you want to see, correct or remove information about you, contact that department, and we will help it respond.

5.3 Information about a child that appears in a report is part of the department's record and is handled the same way.

6.1 Some software companies build FireMic into their products through our partner API or our hosted mic page. On that path we store: the company and the key it used, the department, the company's own reference for the incident, the transcript, the draft we returned, the gaps and timings, a one-way hash of the caller's IP address, and the outcome the company reports back.

6.2 We keep the audio for the period the company sets: 30 days unless it chooses less, including not at all. A daily job deletes it. The transcript, the draft and the outcome are kept, as the API reference describes.

6.3 Each company sees only its own narrations, and narrations are never shared with another company.

6.4 On this path the company, not FireMic, files to NERIS, and FireMic never receives the company's or the department's NERIS credentials.

6.5 The hosted mic page runs no analytics and no error reporting.

6.6 The company's privacy policy also applies to you, and the company is the first place to take a request. We act on its instructions, and we will help it answer a request from a department or a firefighter.

7.1 On our servers. In the FireMic app, your audio goes to our servers and on to the service that turns it into text, and is then discarded. We do not write it to our database or our file storage, and there is no recording history to browse.

7.2 At our service providers. The service providers that turn audio into text receive it to do so, and may hold it on their own systems while they work.

7.3 On your device. While your recording is processed, the app keeps a copy in your browser's storage on your device, so it can be recovered if the tab closes or the signal drops. The copy is deleted when your report is ready or when you discard the recording. A recording made without signal waits on your device and uploads when the app is open and connected; if that fails, it stays on your device until you discard it. If processing fails, you can download your recording. The trial does not save recordings this way (section 3.6).

7.4 Length. A single recording in the app stops at 5 minutes.

7.5 Spelling help. To spell local names correctly, the service that makes the transcript also receives your department's name and location, and local street, place and other names we have for your department. For training and station recordings, it also receives your department's roster names. It does not receive roster names for incident narrations, and in the trial it receives none of these.

7.6 Audio sent through another company's software follows section 6.

We use information to:

• turn your recording into a draft report, and file it to NERIS when you choose to;
• place an incident on a map and note its weather;
• let your department review, export and manage its reports and records;
• sign you in and keep each department's data apart;
• improve FireMic;
• prevent abuse and limit how often the Service can be used;
• find and fix errors;
• understand how people use our website and app, so we can make them better;
• answer you when you contact us, and send notices about the Service and these policies; and
• comply with the law and protect people's rights and safety.

Anonymous trial recordings are never used as training data. We do not sell personal information, share it for advertising, or use it to build profiles that make decisions about people. We send no marketing email, and we do not build or buy lists of chiefs' email addresses.

9.1 Your department. Everyone on your department's roster in FireMic can read the department's reports. Officers can approve members and, if your department uses officer review, review and return reports. Your department can export its reports.

9.2 Service providers. We use a small number of service providers to run FireMic: turning your recording into a report, hosting, storing data, sign-in, and the error reporting and usage analytics described above. Most of them are US-based companies, and each receives only what its part of the job requires. We do not publish the list here. If your department needs it for a data agreement, ask us and we will send the current list in writing, with what each provider receives.

9.3 Address lookup, maps and weather. To place an incident on a map and note its weather, the app sends the incident's address or location to the US Census Bureau's address lookup and to public map and weather services. No name or narrative is sent to them. Some app screens also load their fonts from a public font service, which sees your IP address.

9.4 NERIS. NERIS, operated by USFA with FSRI, receives the reports you choose to file. A trial report you file goes to FireMic's test department in NERIS's test system. NERIS keeps what it receives, and we cannot delete it.

9.5 Other companies' software. If you use FireMic inside another company's software, the draft goes back to that company (section 6).

9.6 Our team. FireMic's staff can technically reach the database. They look at report content only to support you, fix a problem, review trial filings, or comply with the law. They read trial reports filed to NERIS's test system in an internal admin tool.

9.7 Legal requests and safety. We disclose information when the law requires it, such as a valid subpoena or court order, or when we believe in good faith it is needed to protect someone's safety. For a department's records, we refer the request to the department where we can, and tell the department before disclosing anything unless the law forbids it.

9.8 If FireMic changes hands. If FireMic is merged or sold, information may move to the new owner, who must keep the commitments in this policy. We will tell departments before that happens.

9.9 Never. We do not sell personal information, share it for advertising, or give it to data brokers.

We also count page views without cookies. There are no advertising cookies.

12.1 Department records. Reports, transcripts and station records belong to the department. Your department can export them, and a department admin can ask us in writing to delete the department's data, which we will do within 30 days. There is no delete button for a filed report in the app today; deletion is a request to us. A report filed to NERIS stays in NERIS, and corrections there go through NERIS.

12.2 Your own account. You can ask us to show you, correct or delete the information we hold about you as a user. We may keep a record that you filed a report, because it is part of the department's record.

12.3 The trial. You can wait 30 days, or sign in and delete a draft. To delete a trial report you filed to NERIS's test system, email us.

12.4 Wherever you live. Some states give their residents rights to access, correct, delete and port personal information, and to opt out of its sale, of targeted advertising and of certain profiling. FireMic does not sell personal information, does not do targeted advertising, and does not do that kind of profiling. We honor access, correction and deletion requests from anyone, wherever they live. We may need to confirm who you are before acting. You can use an authorized agent, and you can appeal a decision by replying to it. We respond within 45 days.

12.5 Analytics. A content blocker stops our analytics, and we do not work around it. We do not respond to Do Not Track or Global Privacy Control signals today.

12.6 We will not charge you more, or give you a worse service, because you used these rights.

13.1 FireMic does not claim HIPAA compliance.

13.2 Whether HIPAA, or a state law on health or medical information, applies to a department is for the department to determine.

13.3 We treat transcripts and medical details as the most sensitive information in FireMic. Explicit rules remove them from our error reports, and our analytics drop any property whose name looks like a transcript, narrative, address, name or patient detail.

13.4 Station exposure records can include health information about a department's own members, such as symptoms. The department handles it under its own policies.

13.5 If your department needs a business associate agreement, or has questions about how FireMic handles patient information, ask us and we will answer in writing.

14.1 Our security page describes how FireMic stores, separates and protects data. The database denies direct access, and every read goes through our API, which works out your department from your session on the server. Membership is re-read on every request, PINs are stored as one-way hashes, and attachments are kept in private storage.

14.2 FireMic does not hold SOC 2, ISO 27001 or any equivalent certification, and has not had a third-party penetration test.

14.3 If we confirm a security incident that exposed a department's data, we will notify the department without undue delay, and within 72 hours of confirming it, and we will help it meet any notice duties it has.

15.1 FireMic is not directed at children, and we do not knowingly collect personal information from anyone under 13. If we learn that we have, we will delete it.

15.2 Users must be at least 18, or members of a department's junior or explorer program whom the department has authorized to use FireMic. The anonymous trial is for adults only.

15.3 Information about a child in an incident report is part of the department's record (section 5).

Most of FireMic's service providers are US-based companies. Some of the public map and weather services in section 9.3 may be operated outside the United States. FireMic is built for use in the United States, and NERIS is a United States federal system.

The current version is the one on this page, with the date it was last updated. For a material change, especially to what we do with report content, we will give at least 30 days' notice by email to department admins and account holders, or in the app. A change required by law, or one that addresses a security risk, may take effect sooner, with notice as soon as practical.

Questions about this policy, requests under section 12, and requests for the provider list go to the email, phone or text contact links on this page. The party responsible for this policy is FireMic LLC, a New Jersey limited liability company.