Your information, explained

Privacy notice

You choose what to share and use your name and PIN to manage it.

Draft for operator and qualified legal review. Not approved for real-user launch.

Operator: Not yet configured. Policy version: Draft.

What we store and show

We store the rider’s full name, selected blood type, optional allergies or conditions, contact name, primary phone number, and optional secondary phone number. These fields and the update date appear on the public profile; the emergency contact name appears only when you choose to make it public. Random codes reduce guessing; they do not make emergency data private.

Birth date is required for new activations and profile saves. Existing profiles without it remain readable, but their owner must add it when next editing and saving. It is stored as a private date-only value to keep age current. Calculated age is public only when you choose to share it; your full birth date is never public. Optional gender is public only when you explicitly choose to share it; “Prefer not to say” is omitted. Age, birth date and gender are rider-provided and unverified, and are not medical verification. You can edit these values or delete your profile by signing in with your name and PIN. The operator must obtain qualified privacy and legal review of these additions, especially for profiles belonging to minors; no compliance is claimed.

We also store whether a tag is active, its manufacturing reference, a shortened name suggestion for printing, the profile’s version, which consent wording you accepted and when, a salted password hash of your PIN, a normalized copy of your name for matching, protected access credentials, and temporary security records. We do not collect home addresses, bystander identity, or location.

Name and PIN access

Your name and PIN allow you to edit, deactivate or delete your profile. Keep your PIN private. Your name is public and is not a secret. We store a salted, one-way password hash, never the raw PIN, and a lowercase, trimmed name with repeated spaces collapsed for matching. Neither the hash nor this matching field appears in public profiles or owner responses. Short-lived secure browser cookies let you manage your tag. A separate activation cookie allows brief recovery in the same browser if activation succeeds but the response is lost. There is no automatic PIN reset or phone recovery.

Your choices

Only activate if you understand the public visibility and have permission to share your contacts’ details. You can edit or remove optional information by signing in with your name and PIN. Deactivation immediately hides the public profile while retaining it privately for you. Deletion removes the profile, PIN hashes and access records, consent records, and management sessions from the live database; a small record with no personal information remains so the tag code cannot be reused.

Retention and backups

Active profiles remain until owner deletion. Temporary activation recovery expires within 15 minutes; management sessions expire within the configured session period (30 minutes by default). Temporary identifiers used to limit repeated requests expire within two minutes. Expired records are removed by scheduled cleanup or the database’s automatic expiry feature when configured. Expired records stop granting access or counting against request limits even if physical removal happens later.

No automated backup retention has been configured. The operator must finalize backup and deletion procedures before launch. Deletion cannot retract information someone already viewed, copied, or photographed.

Infrastructure and security

The intended production hosting and database providers are Vercel and Google Firebase Firestore. Their service logs may include technical connection information and requested URLs. We keep an aggregate count of tag-page visits, including QR scans and repeat openings. It stores no visitor identity, location or individual scan history. We do not install third-party analytics or trackers. To limit abuse, the application briefly counts requests using protected, one-way versions of source network addresses supplied by trusted hosting infrastructure. PIN verification has no attempt rate limit or account lockout in this phase. Other existing request limits remain. These counters are not used to analyse scans or track riders. We avoid logging submitted form content, PINs and access secrets, medical details and phone numbers.

The optional activation scanner requests camera access only when you choose Open camera. Video is processed locally in your browser, not recorded or uploaded. The camera stops when you close the scanner, leave the page or switch tabs. The scanner does not request microphone or location access.

Questions or requests

A support channel has not yet been configured. For now, sign in with your name and PIN for edits, deactivation, and deletion. We do not claim certified legal compliance. The operator must arrange qualified legal review of this notice and applicable obligations before launch.