Privacy Policy — Patchen Technologies LLC

1. Who we are

Patchen Technologies LLC is an independent software company based in Watertown, New York, USA. We build software for network infrastructure and public safety, including Cadre, an operations platform for fire departments that provides responder alerting, staffing boards, apparatus scheduling, and member management.

2. What this policy covers

This policy covers the patchentech.com website and the Cadre platform, including the Cadre mobile app and Cadre text alerts. If a subscribing fire department has a separate written agreement with us, that agreement controls where the two differ.

3. What we collect

Account information

A member's account holds their email address (which is the login identity), name, mobile phone number, department affiliation, and role or rank within the department. The name and mobile number can be entered by the member or by a department administrator; how a number gets enabled for text alerts is covered in section 5.

Device information

To deliver push notifications, we store a push token and the platform type (iOS or Android) for each device a member signs in on. We do not collect the device model or operating-system version.

Incident and dispatch data

Cadre ingests incident and dispatch information from county computer-aided dispatch (CAD) systems on behalf of subscribing fire departments. Much of this data describes people who are not Cadre users; section 4 covers exactly what it contains and who can see it.

Operational and security records

Signing in creates a session record that includes your IP address and a browser or device identification string. Each push notification we send creates a delivery record. Administrative changes — such as edits to a member's profile, role, or invitations — are written to an audit log that stores the values before and after the change, including names and phone numbers.

We do not collect app-usage analytics of any kind. There are no analytics, crash-reporting, or tracking components in the app or on this website, and this website does not require an account.

4. Information about people who are not Cadre users

Cadre ingests dispatch data from county 911 (CAD) systems on behalf of subscribing fire departments. That data is about members of the public who are the subjects of emergency calls — the people who call 911, the people who need help, and the people present at an address. They are not Cadre users. They have not consented to Cadre, most will never know it exists, they cannot see what it holds about them, and they cannot request its deletion. This section states plainly what the system stores about them, because they cannot check for themselves.

What is stored, verbatim and indefinitely: the incident address and coordinates; the nature and priority of the call, including medical determinant codes that describe the medical nature of the emergency; and the dispatcher's free-text narrative. That narrative can contain caller and patient names, callback telephone numbers, and medical detail. Automated alarm-company dispatches can include business names and alarm-subscriber telephone numbers. The original dispatch email is also retained in full.

Where it comes from and who owns it: this information originates with the county 911 center and the subscribing fire department. Patchen Technologies processes it on the department's behalf; the department is the source and the owner of the record. If you have questions or requests about information concerning you in a dispatch record, direct them to the fire department that serves the incident location or to the county 911 authority. We will refer you there, because the record is theirs, and we currently have no technical means to alter or delete it — see section 10.

Who can see it: inside Cadre, dispatch records — including the narrative — are visible to authenticated members of the subscribing department. Departments may also run a station-board display, a screen mounted at the fire station, which shows the call nature and full street address of active calls (but not the dispatcher narrative) to anyone physically able to see that screen.

What does not leave the platform: push notifications sent to members' phones carry only the call nature and the street address — never caller names, callback numbers, or narrative. This restriction is enforced by the structure of the code and checked by an automated test; see section 11.

5. Mobile numbers and SMS consent

A member's mobile number can get into Cadre two ways: the member enters it themselves, or a department administrator enters it when setting up the member's profile.

A number entered by an administrator is never enabled for text alerts. Text alerts stay off until the member personally verifies the number with a one-time code sent to it and gives affirmative opt-in consent by checking a consent box that is unchecked by default. No one can consent on a member's behalf.

Consent to receive text messages is never a condition of employment, department membership, or use of the app. A member who declines, or who later opts out, keeps full use of Cadre; they simply won't receive text alerts.

Cadre text alerts has not launched yet. Mobile numbers collected today are held for that upcoming program and are not used to send text messages until it launches and the member has completed the verification and consent steps above.

Separately from SMS: a member's duty status controls push notifications, and it defaults to "on duty" — a member who never opens their alert settings will receive push notifications for their department's calls until they change that setting. Duty status has no effect on text messages, which are strictly opt-in as described above.

6. SMS / text messaging

This section describes our privacy practices for the Cadre text alerts SMS program.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

In plain terms: your phone number and your opt-in consent are used only to deliver the Cadre text alerts you signed up for, and to route those messages through the telecom provider that transmits them. They are never sold, rented, or shared for anyone's marketing.

To stop receiving text messages at any time, reply STOP to any Cadre message. See Opting out of SMS below.

7. How we use information — and how we don't

We use the information described above to:

Deliver the service — incident alerts, staffing boards, scheduling, and member management for the subscribing department.
Send push notifications about the department's operations (controlled by duty status and alert settings — see section 5), and, once text alerts launch, SMS messages to members who have opted in.
Verify identity and secure accounts.
Diagnose problems, monitor delivery, and improve reliability.
Respond to support requests.

We do not:

Sell personal information — to anyone, for any purpose.
Use personal information for advertising.
Share personal information with third parties for their marketing.
Use incident or dispatch data for any purpose other than operating the platform for the department it belongs to.

8. Sub-processors

We use a small number of outside services to run Cadre. Here is each one and exactly what reaches it:

Cloudflare — receives every inbound dispatch email as it arrives, stores the full raw email at rest indefinitely, and stores our nightly database backups (kept for 30 days).
Expo — and through it Apple Push Notification service and Google Firebase Cloud Messaging — receive each device's push token plus the call nature and street address of the incident, and nothing else from the dispatch.
MapTiler — receives map-tile requests from the app. No address text is sent, but the requests necessarily reveal the map area being viewed.
Google Maps — receives an incident's coordinates only when a member taps "open in maps." Entirely user-initiated.
Telnyx — not yet active. When Cadre text alerts launches, Telnyx will receive member phone numbers and the content of text messages in order to deliver them.

Authentication email — sign-in and invite links — is sent from our own self-hosted mail server; no third-party email relay is used.

No sub-processor is authorized to use this information for its own purposes.

9. Who owns the data

Incident data and roster data in Cadre belong to the subscribing fire department. Patchen Technologies LLC acts as a processor of that data on the department's behalf and on its instructions. Members with questions about how their department uses Cadre data should contact their department; we will support the department in answering.

10. Retention and deletion

Most data in Cadre is kept indefinitely, and we would rather say that plainly than imply otherwise. Cadre is a public-safety records system: incident records document emergency responses, they are the subscribing department's agency records, and departments are generally obligated to retain such records. The platform is deliberately built append-only.

Incident records — incidents, incident events, comments, responder history, and notification delivery records — are append-only and permanent. Nothing in the platform deletes them.
Raw dispatch emails are stored indefinitely in object storage.
Member accounts are deactivated, never deleted. A member's response history remains after they leave the department.
The audit log keeps records of administrative changes — including changes to a member's name and phone number — indefinitely.
Sign-in sessions and expired tokens accumulate; there is currently no job that purges them.
Member location pings are deleted after 24 hours. This is the only time-based deletion in the platform.
Backups — the database is backed up nightly and backups are kept for 30 days. Anything removed from the live database persists in backups for up to 30 days.

What you can and cannot request

We do not currently offer data export, and we do not currently have the capability to erase data — for members or for anyone else. We will not promise a deletion we cannot perform.

What a member can do today: ask us or a department administrator to deactivate their account, opt out of text alerts, disable push notifications, and turn off location sharing. What no one can currently do: erase incident records, response history, or the dispatch information described in section 4. If we build export or erasure capability, this policy will change to say so.

11. How we protect information

Here is what the platform does to protect information. Each of these is verified in the code and its tests:

Push notifications are minimized by construction. The code that builds a push notification can see only the call nature and street address — it structurally cannot access caller names, callback numbers, or dispatcher narrative — and an automated test attempts to smuggle each of those into a notification and asserts that none appear.
No analytics, no trackers. There are no analytics, tracking, or crash-reporting components anywhere in the platform — not in the app, not on this website. No advertising trackers, no beacons.
Each department's data is isolated at the database level by row-level security, with no runtime role able to bypass it, covered by its own test suite.
Member location sharing is opt-in and off by default. The server rejects location data from a member who has not enabled it, and location pings are deleted after 24 hours. (Today the mobile app does not capture location at all; the controls exist ahead of the feature.)
Passwords are stored as one-way hashes. We cannot read them.
Outbound email carries only sign-in and invite links — never incident content, and no tracking pixels.
Web and app traffic is encrypted in transit, and files in object storage — including raw dispatch email and backups — are encrypted at rest by the storage provider.

And here is what we do not have, so you are not left assuming otherwise: there is no multi-factor authentication; dispatch content is not field-level encrypted in the database; our audit log records changes to data, not reads of it; we have not verified disk encryption on our own servers and do not claim it; and email to your mail provider uses opportunistic transport encryption, which is not guaranteed.

No system is perfectly secure, and we do not promise that ours is an exception. If we learn of a breach affecting your personal information, we will notify affected departments and users without unreasonable delay.

12. Children

Cadre accounts are for fire-department members who are at least 18 years old, and we do not knowingly create accounts for anyone under 18.

We cannot make the same claim about the dispatch data Cadre ingests. Emergency calls involve people of every age, and the dispatch records described in section 4 — including the dispatcher's narrative — can contain information about minors who are the subjects of emergency calls. That information arrives as part of the official dispatch record and is retained with it; we do not and cannot filter it out.

13. Opting out of SMS

You can stop Cadre text alerts at any time:

Reply STOP to any Cadre text message. You will receive one final message confirming you have been unsubscribed, and no further texts will be sent.
Reply HELP to any Cadre text message for assistance, or contact us using the information below.
You can also disable text alerts in the app's notification settings, or ask your department administrator to do it for you.

Opting out of SMS does not close your account or affect push notifications, which you control in the app's alert settings and your device settings.

14. Changes to this policy

If we change this policy, we will post the updated version here and revise the "last updated" date at the top. For material changes affecting Cadre users, we will also notify subscribing departments.

15. How to contact us

Patchen Technologies LLC
1385 Sunset Ridge
Watertown, NY 13601, USA
Email: [email protected]