The Squad — Privacy Policy
The short version: The Squad shares your precise location with the other members of an operation you have joined, only while you are an active member of that operation. That includes while the app is in the background, so your team can still see you when your phone is locked. We do not sell your data, we do not show ads, and we do not track you across other apps or websites.
This policy explains what information the Squad mobile app (“The Squad,” “the app,” “we,” “us”) collects, why, who can see it, and the choices you have. The Squad is developed and operated by Noel Mercado. If you have questions, contact noelmerc@gmail.com.
1. Information we collect
Account information
- Email address (or a phone number, if you sign up with one) and a password, used to create your account and sign you in. Passwords are handled by our authentication provider and stored only in hashed form; we cannot see your password.
- An internal account ID assigned to you.
Profile and operation membership
- Your call sign, the short name you choose that your team sees on the map.
- Your role (for example operator or supervisor), and for each operation you join, your call sign in that operation, your role, when you joined, and whether you are currently active in it.
- A private team record that is created automatically for your account.
Location
- When you open an active operation and grant permission, the app collects your device’s precise location (latitude and longitude), along with heading, speed, location accuracy, and the time of the reading.
- Location is collected only while you are an active member of an active operation. It is not collected on the sign-in screen, in operation lists, or in Demo Mode, which uses simulated positions and sends no real location.
- The server keeps only your most recent position for each operation. Each new reading replaces the previous one. The current version of the app does not store a history of your movements on our servers.
- If a supervisor turns on “movement breadcrumbs” for an operation, the app draws a short trail of recent positions on each member’s screen. Those trails are built on the device from the live positions and are not saved to our servers.
Device status sent with your location
- Your battery level, whether Low Power Mode is on, and your network type (for example Wi-Fi or cellular). Your team sees these so they know whether your position is likely to stay up to date.
Operation content
- Operations you create (name, join code, settings, start and end times).
- Map markers placed by supervisors (type, label, and location).
- Operational alerts such as check-in, hold, move, or emergency, including any message text, plus who sent them and who acknowledged them.
- An operation event log that records things like members joining or leaving, call-sign and role changes, marker changes, alerts sent and acknowledged, and the operation ending.
Push notification token
- If you allow notifications, the app registers a push notification token for your device, along with your device platform (iOS or Android), so you can receive operational and emergency alerts. When you sign out, the token is disabled for that device.
Address search
- If you search for an address on the map, the text you enter is sent to your device’s mapping and geocoding service (Apple on iPhone, Google on Android and on the web) to turn it into map coordinates. We do not save your searches.
Information stored on your device
- The app stores your sign-in session, the operation you are currently sharing location with, the latest location reading waiting to be uploaded if your connection drops, and your push token on your device so the app works reliably.
What we do not collect
- The app does not include advertising or third-party analytics SDKs, and it does not access your contacts, photos, camera, microphone, or health data.
2. Background location and why it is needed
The Squad is built for teams that need to see each other’s positions during an operation, often while phones are locked or in a pocket. To do that, the app asks for “Always” location permission. Background location is used only to keep your position updated for your team while you are an active member of an active operation.
- On iPhone, the system shows a location indicator while background sharing is running. On Android, a persistent notification says your location is being shared with members of the active operation.
- Sharing stops when you leave the operation, when a supervisor ends the operation, or when you sign out. In the background, the app checks that you are still an active member and stops itself if you are not.
- You can turn location access off at any time in your device’s Settings. Without location permission you cannot appear on the live map.
3. Who can see your information
| Information | Who can see it in the app |
|---|---|
| Your live position, heading, speed, accuracy, battery, Low Power Mode, and network type | Only people who are currently active members of the same operation. When you leave an operation, or when that operation ends, your position for that operation is deleted. |
| Your call sign and role in an operation | Active members of that operation. |
| Markers, alerts, acknowledgements, and the event log | Active members of that operation. |
| Your email address or phone number | Not shown to other users. |
| Your push token | Only you and the system that sends notifications. It is never shown to other users. |
These limits are enforced by access rules in our database, not only by the app’s screens. Anyone with an operation’s join code can join it while it is active, so share join codes only with people you trust. Supervisors can see the members of their operation and can change call signs, roles, and priority designations.
The developer can access stored data to operate, secure, and support the service.
4. How we use information
- To create and secure your account and sign you in.
- To show your position and status to your team during an active operation.
- To deliver markers, alerts, and emergency notifications to operation members.
- To keep the service working: troubleshooting, preventing abuse, and enforcing access rules.
We do not use your information for advertising, and we do not build profiles of you for marketing.
5. Service providers
We use a few service providers to run the app. They process data on our behalf to provide their services:
- Supabase — account sign-in, database, real-time updates, and server functions. All of the account, location, and operation data described above is stored with Supabase. Supabase Privacy Policy.
- Google Maps Platform — displays the map and, on Android and the web, looks up address searches. Google’s map software may collect technical information such as your IP address, device identifiers, crash and performance data, and how the map is used, under Google’s own terms. Google Privacy Policy.
- Expo (650 Industries) — the push notification service that delivers alerts. It receives your push token and the notification contents, which are a generic title plus the operation and alert identifiers. Notifications are delivered through Apple Push Notification service or Firebase Cloud Messaging. Expo Privacy Policy.
- Apple — on iPhone, address searches are turned into coordinates by Apple’s geocoding service, and Apple delivers push notifications. If you have chosen to share diagnostics with developers, Apple may also provide crash reports through TestFlight or the App Store. Apple Privacy Policy.
These providers may log technical information, such as IP addresses and request times, as part of running their services.
6. No selling, no ad tracking
We do not sell or rent your personal information. We do not share it for advertising, and we do not track you across other companies’ apps or websites. The app does not use the advertising identifier (IDFA).
We may disclose information if required by law, such as a valid subpoena or court order, or when needed to protect someone’s safety.
7. Data retention and deletion
- Live location: only your latest position is kept for each operation. It is deleted when you leave that operation, when the operation ends, and when your account is deleted.
- Account, profile, and operation content are kept while your account exists.
- Deleting your account: in the app, open Operations (the screen after you sign in) and tap Delete Account. Read what will be removed, then confirm. Deletion happens immediately. It removes your sign-in account, profile, call sign, operation memberships, live locations, and push notification tokens. Operations you created are ended and then deleted, including their markers, alerts, and event logs, and other members are removed from those operations. Markers you placed and alerts you sent in someone else’s operation are deleted. Event-log entries you contributed to someone else’s operation are kept, but they are no longer linked to your account. The call sign in use at the time can still appear in that log sentence. If you cannot use the app, email noelmerc@gmail.com from the email address on your account, or include your phone number if you signed up with one. Use the subject “The Squad account deletion.” We will verify that request and delete the same information within 30 days.
- You can also email us to request a copy of your data or to correct it.
8. Children
The Squad is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us and we will delete it.
9. Security
- Data travels between the app and our servers over encrypted connections (HTTPS/TLS).
- Database access rules ensure that you can write only your own location, only while the operation is active, and that only active members of an operation can read its data.
- Passwords are stored in hashed form by our authentication provider.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. The Squad is not a certified system for criminal-justice information (for example, it is not CJIS-certified) and should not be used to store that kind of information.
10. Your choices
- Turn location or notification permission on or off in your device’s Settings.
- Leave an operation at any time to stop sharing your location with it.
- Sign out to stop location sharing and disable push notifications on that device.
- Use Demo Mode to try the app without an account or sharing real location.
- Delete your account in the app from the Operations screen. You can also email us to access, correct, or delete your data.
11. Changes to this policy
We may update this policy as the app changes. When we do, we will post the new version on this page and update the effective date above. If a change significantly affects how your information is used, we will provide notice in the app or by email before it takes effect.
12. Contact
Noel Mercado
Email: noelmerc@gmail.com