Privacy Policy

1. Who we are

The Services are operated by [review: legal entity name and mailing address] (“Municy”, “we”, “us”). You can reach us about anything in this policy, including a privacy request, at support@municy.com.

This policy applies to municy.com, the agency websites we host at {agency}.municy.com and on connected custom domains, the Municy mobile app, and the Municy admin portal. It does not cover an agency’s own separate systems, or third-party sites we link to.

2. Your agency’s role and ours

Municy is a multi-tenant platform: each agency has its own space, and agencies cannot see each other’s members, records, or private content (with one narrow exception described in section 7).

• For agency content and member records — what an agency publishes, and the records it keeps about its members, applicants, and the people who contact it — the agency decides what to collect and how long to keep it. In data-protection terms the agency is the controller and Municy acts as its processor, handling that information on the agency’s instructions.
• For your Municy account and the platform itself — your sign-in credentials, the device tokens used to deliver notifications, security and audit logs, and the technical operation of the Services — Municy is the controller.

If you want an agency’s records about you corrected or removed, contact that agency first. If you cannot reach them, write to us and we will help.

Agencies’ community records

An agency that uses Municy’s Community CRM may keep a record that links your contact messages, service requests, RSVPs, applications and newsletter subscription and, if you follow the agency in the app, your name, email and phone from your account, plus its own notes and follow-ups about you. The agency controls that record and Municy processes it for them. Only the agency’s administrators can see it; its other members and the public cannot. Municy staff may also access it to support and operate the service, as the agency’s processor.

You can ask the agency to give you a copy of it or to erase it, and each is one action for them. Erasing removes the record, its notes and follow-ups, your newsletter subscription and your follow of the agency, and clears your name and contact details from the messages and forms it linked. How long that record is kept is up to the agency.

3. Information we collect

3.1 Information you give us

• Account information — your name, email address, and password (stored only as a bcrypt hash, never in readable form), plus a phone number if you add one. If you turn on two-factor authentication we also store the secret used to verify your codes and your recovery codes. An agency can additionally publish a photo of you on its team page; that photo belongs to the agency’s content, not to your account.
• Agency content — whatever you or your agency create in Municy: announcements, events and registrations, photo albums, apparatus and team profiles, safety tips, fundraisers, polls, forum posts, documents and standard operating guidelines, and messages you send in agency chat.
• Member records — if you are a member of an agency: your role in that agency, certifications and their expiration dates, training records, shift schedules, availability and time-off requests, attendance, acknowledgements of standard operating guidelines, equipment and vehicle checks, and any fitness or workout entries you choose to log.
• Building Size-Up records — what members capture about a structure in their response area: a name for the structure, the town or locality, its coordinates (with the accuracy of the fix), a category, free-form tags, and one or more photos with captions, plus any comments members add. The tags are free text chosen by whoever posts — they are notes, not a verified record of hazards or utilities.
• Incident reports — agencies record their own responses, and those records can describe people who are not Municy users: the location of the incident, a narrative description, the personnel who responded, and counts of injuries and fatalities. The agency decides what goes in them and is responsible for that content.
• Form submissions — when you use an agency’s contact form, volunteer application, event sign-up, or newsletter form, we receive what you enter: typically your name, email address, phone number, and your message or answers. A volunteer application also asks for your home address. Newsletter sign-ups and applications from an agency wanting to join Municy additionally store the submitter’s IP address, which we keep to trace spam and abuse. An agency may link these to one record about you (see agencies’ community records).
• Support correspondence — messages you send us and our replies.

3.2 Information we collect automatically

• Server logs — our servers record the requests they handle: the IP address they came from, the URL requested (including anything carried in the URL, such as the coordinates a Size-Up map search sends), and the time. We use these to operate the Services and to detect and slow down abuse.
• Sign-in records — each time you sign in we store a session record with your IP address, your browser or app’s user-agent string, and the time, so that sessions can be revoked. We also keep the date of your most recent sign-in.
• Push notification tokens — if you allow notifications, the app registers a device token and the platform it belongs to (iOS or Android) so we can deliver announcements and alerts. That is all a device registration holds. Note that the app currently asks for notification permission the first time it launches, before you sign in; nothing is registered with us until you do.
• Diagnostics — when something goes wrong we record the error and its technical context so that we can fix it. We do not attach your name, email address, or an account identifier to those error reports.

3.3 Information from other people

Nobody can create a Municy account for you: membership starts with you registering yourself. An agency administrator can only add you to an agency after your account exists. From then on, the agency maintains records about you — your role, certifications, training, schedules, and attendance — and it is responsible for the accuracy of what it records and for having the right to record it. Agencies may also enter information about people who have no Municy account at all, for example in an incident report or on a public team page.

3.4 What we do not collect

• We do not take payment card numbers through the Services.
• We run no analytics, advertising networks, or tracking pixels of our own anywhere in the Services, and we set no cookies of our own. An agency can, however, embed third-party content on its own website — see section 9.
• We do not sell personal information, and we do not share it for cross-context behavioural advertising.

4. Location, camera, and photos

• Location — the app asks for location access only while you are using it, and never reads your location in the background. It uses your position to find the agency nearest you and the advisories, such as burn bans and road closures, that cover where you are; to sort agencies by distance when you browse them; and to centre the “Find a station” map on you. In the members-only Building Size-Up feature, it is also used to place a structure at your current position when you capture it, and to find structures near you on the map. You can decline and still use everything else.
• What that leaves behind — we do not track you in the background and we build no profile of your movements, but three traces do persist. When the app looks up agencies, advisories, or Size-Up structures near you, it sends your coordinates to our servers in the request URL. Our servers use them to work out distances and what is nearby, and we do not save them to your account or to our database, but they do appear in our server logs next to your IP address for as long as those logs are kept. The app also keeps your most recent position on your device, with the time it was taken, so that it can sort by distance as soon as it opens; it stays there, and is still used, until a newer position replaces it or you delete the app — signing out or turning off location access does not remove it. And a Size-Up structure keeps the coordinates it was captured at, together with who captured it and when.
• Camera and photo library — used when you attach a photo, and the camera also starts as soon as you open the QR scanner members use to inspect, check out, and check in equipment. Nothing is uploaded until you choose to upload it. Photos can carry embedded metadata such as the time and coordinates of capture; please do not upload images containing anything you would not want stored.
• Maps — map tiles in the app and in the admin portal are requested by your device directly from the OpenStreetMap Foundation’s tile servers, so your IP address is visible to that service whenever a map is shown.

5. How we use information

• To provide the Services: create and authenticate your account, publish the content your agency creates, run the member portal, and keep your app in sync.
• To deliver notifications you have asked for — announcements, event reminders, shift and certification alerts — by push and email.
• To send transactional email: password resets, application and recruitment status updates, and other service messages about your account.
• To provide support and respond to your requests.
• To keep the Services secure: authentication, rate limiting, spam and abuse controls on public forms, audit logging of sensitive administrative actions, and investigating abuse.
• To maintain and improve reliability, including diagnosing errors and monitoring performance.
• To comply with law and to establish, exercise, or defend legal claims.

Where the EU or UK GDPR applies, we rely on these legal bases: performance of a contract (providing the Services to you or your agency), legitimate interests (security, abuse prevention, service improvement, and running our business), consent (push notifications, location access, and marketing email — each of which you can withdraw), and legal obligation.

6. What is public, and what is not

Municy is partly a publishing tool, so some information is public by design:

• Public — everything an agency publishes to its website or to the app’s public browsing: announcements, events, apparatus, safety tips, photo galleries, fundraisers, contact details, and team profiles. A team profile is published in full: the name, rank or title, photo, biography, and certifications an agency records on it are all served publicly once the team section is switched on.
• Not published — your account email address, your member records, schedules, documents and standard operating guidelines, chat messages, forum posts, polls and how you voted in them, incident reports, form submissions, and Size-Up records. These are not linked from any public page and the API requires a signed-in member of the agency to list them.

Whether the team section (and each other section) is published is an agency-level switch: there is no per-person opt-out today. If you do not want your profile or your certifications on the public site, ask your agency to remove you from the team page or to turn that section off. Public content is served over the open internet: search engines can index it, and copies may remain in caches or web archives after it is deleted from Municy.

7. Sharing between agencies

Municy has one feature that deliberately crosses agency boundaries. With Building Size-Up neighbour sharing, an agency can see read-only Size-Up records that other agencies created, and add comments to them.

The test is geographic, and it is worth being precise about which distance is measured: a record is visible to an agency when the structure sits within roughly 20 km of that agency’s own station. How far away the agency that created the record is does not enter into it — a distant agency that captures a building near your station will have that record visible to you, and the reverse. Sharing is reciprocal, and switching it off is a complete opt-out in both directions: a record crosses agencies only when the agency that owns it and the agency viewing it both have sharing enabled and are active. An agency with sharing turned off shares nothing and sees nothing. Police-type agencies are excluded from it entirely, on both sides. An administrator can turn sharing off at any time, and the person who posts a record can mark that individual record as not shared.

Sharing never grants another agency the ability to edit or delete your agency’s records, and it does not expose member records, documents, schedules, or chat.

8. Service providers

We use a small set of vendors to run the Services. They may process personal information only on our instructions and for the purpose described below.

Content an agency embeds on its own website

An agency can add embedded content to its website — a video, a map, a social feed, a podcast player. When a visitor opens a page containing one, the visitor’s browser contacts that provider directly, which gives the provider the visitor’s IP address and lets it set its own cookies, including advertising cookies. We do not control what those providers collect. The providers an agency may embed are: YouTube, Vimeo, Google Maps, Facebook (including the Page Plugin, which sets advertising cookies), Instagram, X, TikTok, SoundCloud, Spotify, Anchor, and Apple Podcasts. Which of them appear, if any, is the agency’s choice.

We also disclose information in these situations:

• To your agency — administrators of an agency you belong to or apply to can see the records and submissions associated with it.
• To other users — where you post publicly or into a shared space such as agency chat or a Size-Up record.
• For legal reasons — to comply with a law, subpoena, or lawful request, or to protect the rights, safety, and property of Municy, our customers, or the public.
• In a business transfer — if Municy is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction; we will give notice before your information becomes subject to a different privacy policy.

9. Cookies and local storage

Municy itself sets no cookies at all. There is no analytics cookie, no advertising cookie, and no tracking pixel of ours on municy.com, on any agency website, in the admin portal, or in the app. Instead of a session cookie, the admin portal keeps your session and refresh tokens in your browser’s local storage, and the mobile app keeps the same tokens, cached content, and your preferences on your device. Signing out or clearing the site’s data removes them.

Embedded content is the exception. If an agency has embedded a video, map, or social feed on its site (see section 8), that provider can set its own cookies in your browser when the page loads, and some of them — Facebook’s page plugin and YouTube’s standard player among them — use those cookies for advertising. Those cookies are the provider’s, governed by its policy, and you can block them in your browser settings.

10. How long we keep information

• Your account — kept while the account exists. See section 11 for what happens when you delete it.
• Agency content and member records — kept until the agency deletes them or closes its account, because the agency decides its own retention, subject to the soft-delete behaviour above.
• Uploaded files — a file stays on our storage after the record that pointed at it is deleted, and remains reachable at its address until we remove it. Ask us if you need a specific file taken down.
• Form submissions — kept for the receiving agency until it deletes them.
• Agencies’ community records — kept until the agency deletes or erases them; there is no automatic expiry (see section 2).
• Server logs, sign-in records, and audit logs — kept for a limited period so we can investigate incidents and meet legal obligations.
• Backups — we take a daily database dump and delete local copies older than 14 days. Where an off-site copy is configured it is pruned on a schedule set on that storage. Information you delete can persist in a backup until that copy ages out.

11. Deleting your account

You can delete your account yourself in the mobile app, under Profile → Delete Account, or by writing to support@municy.com. When you do:

• Your name, email address, phone number, password, and two-factor secret are removed or replaced with anonymous values, and your account is deactivated.
• Your follows, saved items, and notification inbox are deleted, and your agency memberships are closed.
• Your sessions are revoked and your devices are unregistered from push notifications.
• Content you contributed to an agency stays with that agency, but your name is replaced with “Deleted Member”. Agencies rely on those records operationally — who inspected a building, who signed an incident report — so the record survives without identifying you.

12. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you, and get a copy in a portable format;
• correct information that is inaccurate or incomplete;
• delete your information (see section 11);
• object to or restrict certain processing, and withdraw a consent you have given;
• not be discriminated against for exercising these rights.

If you are in the EEA or the UK, these rights come from the GDPR. If you are a California resident, the CCPA/CPRA gives you rights to know, delete, correct, and opt out of sale or sharing — we do not sell or share personal information for cross-context behavioural advertising, and we offer no financial incentives for personal information.

You can control push notifications in your device settings, and unsubscribe from marketing email using the link in that email. Transactional messages about your account and your agency’s activity are part of the Services and cannot be switched off separately while your account is open.

To make a request, email support@municy.com. We may need to verify your identity before we act, and we will respond within the time the law allows. Where we hold the information on an agency’s behalf we will pass your request to that agency and support them in answering it. You also have the right to complain to your local data protection authority.

13. Security

We protect information in transit with HTTPS/TLS and store passwords only as bcrypt hashes. Two-factor authentication is available and uses time-based one-time codes; your recovery codes are stored as bcrypt hashes too, are single-use, and cannot be read back by us or anyone else. Every request is scoped to a single agency, roles restrict what each member can see and do, authentication endpoints are rate-limited, sessions are recorded so they can be revoked, and sensitive administrative actions are written to an audit log. Access by our staff is limited to what is needed to operate and support the Services.

Two limits worth stating plainly: uploaded files are protected by having an unguessable address rather than by an access check (see section 6), and content an agency embeds on its own site runs under that provider’s security, not ours. No system is perfectly secure and we cannot guarantee absolute security — use a strong, unique password and turn on two-factor authentication.

14. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. Agencies running junior, cadet, or explorer programs must not enter a minor’s information into Municy without the consent required by law from a parent or guardian. If you believe a child has given us personal information, write to support@municy.com and we will delete it.

15. Where information is processed

Municy is operated from the United States and information is stored and processed there. If you use the Services from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection law may differ from your own. Where required, we rely on appropriate safeguards such as the European Commission’s standard contractual clauses for those transfers.

16. Changes to this policy

We may update this policy as the Services change. We will revise the “last updated” date above, and for material changes we will give notice in the app or by email before they take effect. Continuing to use the Services after a change means you accept the updated policy.

17. Contact us

Questions, requests, and complaints: support@municy.com.

See also our Terms of Service.