Effective 17 October 2026

Privacy Policy

What ROK collects about you, why, who else sees it, how long it is kept, and how to get a copy or delete it.

Draft under legal review. This document is published so that it can be read and relied on from today, but its wording has not yet been finalised by our legal advisers and may change. Bracketed text marks details still being confirmed.

This policy explains how [ENTITY] (ABN [ABN]) ("ROK", "we", "us") handles personal information when you use the ROK platform: the public website at www.rokrescue.com, the admin console at admin.rokrescue.com, and the ROK mobile app (together, the "Service"). We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Most people use ROK because an emergency-service agency ("your agency") gave them access. Your agency decides what content you see and which of its staff can see your activity inside it. This policy covers what ROK itself does with your information. Your agency may have its own privacy obligations to you.

What we collect

Category	Details	Source
Account	Email address, display name, credentials (for example "Rope Rescue Technician"), organisation, phone number, emergency contact, time zone, profile photo.	You
Sign-in	A salted hash of your password (never the password itself), your Google identity if you sign in with Google, and the enrolment record of any authenticator app you add. Sign-in times and the device's IP address are logged.	You; our authentication provider
Agency membership	Which agencies you belong to, the groups you are in, who invited you or which access code you redeemed, and when.	Your agency; you
Reading activity	Which published items you opened and when, what you searched for and how many results came back, items you favourited, checklist steps you ticked, items you marked complete.	Your use of the app and console
Compliance records	Acknowledgments you record against procedures that require them (with the version acknowledged), and quiz attempts (answers, score, pass or fail).	Your use of the app
Recognition	Points, streaks, levels and badges your agency's settings award you, and any badge you choose to share publicly as a verifiable credential.	Derived from the records above
Authoring activity	For staff who author or review: content you create or edit, revision history, comments, approvals you record, review assignments. Your display name is stamped on these so the record stays readable if your account is later deleted.	Your work in the console
Notifications	Push notification tokens for the devices where you installed the app, your notification preferences, and a record of each notification sent (its title, how many devices it reached and whether delivery was confirmed).	Your device
Devices	For each phone where you use the app: its model, operating-system and app version, when it last synced each agency, and whether a sign-out or wipe was requested for it. An agency sees these only for phones that hold its content.	Your device
Billing (agency admins)	If you manage your agency's subscription: billing name and email, ABN, invoices, and the subscription state. Card details are entered directly into Stripe and never reach our systems.	You; Stripe
Support and enquiries	Anything you send through the website's contact or request-access forms, or by email.	You
Technical	Standard server logs (IP address, browser or app version, pages requested, errors) kept for security and debugging.	Automatic

We do not collect government identifiers, health information, or payment card numbers.

Why we collect it

To run the Service: authenticate you, deliver your agency's content to your devices (including offline), and keep it in sync.
To give your agency the records it needs: emergency-service agencies must show that staff have read and acknowledged current procedures and passed required assessments. Acknowledgments, quiz attempts and reading history exist for that purpose and are visible to your agency's authorised staff.
To review and improve content: aggregate reading and search statistics show your agency which procedures are used, searched for and not found.
Recognition: if your agency has switched on badges and points, to award them.
To bill agencies for paid plans and to meet our tax obligations.
To keep the Service secure: detect abuse, investigate incidents, and keep an audit trail of access changes.
To contact you about your account: sign-in links, invitations, password resets, security notices and, where you have opted in, notifications about published content.

We do not sell personal information, use it for advertising, or use it to train machine learning models.

Who can see it

Your agency. Administrators and staff with the relevant permissions in your agency can see your profile, your membership and groups, your acknowledgments and quiz results, and aggregate or per-item reading statistics. They cannot see your password or your authenticator secrets. If you belong to more than one agency, each sees only its own records.
Other agencies. Never. Every record is scoped to the agency it was created in.
The public. Only a badge you have explicitly chosen to share, at the link you share. You can stop sharing at any time from your account.
Service providers that host and operate the Service for us, listed below.
Authorities, where the law requires it, or to protect someone's life or safety.

Service providers (sub-processors)

Provider	Role	Where data is processed
Supabase	Database, authentication, file storage and server-side functions	United States (us-west-1, Oregon)
Vercel	Hosting for the website and admin console	United States and global edge nodes
Stripe	Subscription billing and tax calculation for agencies	United States
Expo	Delivery of push notifications to the mobile app	United States
Resend	Transactional email (sign-in links, invitations, notices)	United States

Because these providers process information outside Australia, we take reasonable steps to ensure they handle it in a way consistent with the Australian Privacy Principles, including contractual data-protection commitments. We will update this list before adding a provider that handles personal information.

How long we keep it

Record	Kept for
Account profile, memberships, preferences	Until you delete your account or your agency removes you.
Acknowledgments, quiz attempts, points and badges	For the life of your agency's account. These are your agency's compliance records; they are not deleted on a schedule.
Reading history (per item, per person)	400 days, after which only daily aggregate counts remain.
Search queries	180 days.
In-console notifications you have read	90 days.
Access and administration audit log	2 years.
ROK support visits to your agency	2 years, like the audit log that records them.
Email delivery records	90 days (recipient address, message type, delivery outcome).
Data exports you or your agency generate	14 days, then the file is deleted.
Push notification tokens	Until the device uninstalls the app or the token stops working.
Device records	180 days after the device last checks in.
Notification delivery records	30 days for per-device delivery receipts; 1 year for the record of each notification sent.
Offline sync receipts	60 days.
Billing records	As long as Australian tax and accounting law requires.
Server logs	30 days.
Backup copies	[BACKUP RETENTION]

When you delete your account, your profile, memberships, preferences, device tokens, favourites, reading history and search history are deleted. Compliance records your agency owns (acknowledgments, quiz attempts, approvals you recorded) are kept but no longer linked to a live account. Comments, revisions and approvals keep the display name you had at the time so that document-control history stays legible; the account they pointed to is gone. Any badge you were sharing publicly is revoked.

How we protect it

All traffic is encrypted in transit. Data is encrypted at rest by our hosting providers. Access to each agency's records is enforced by row-level security in the database itself, so an application bug cannot expose one agency's data to another. Staff access to production systems is limited to the people operating the Service and is logged. You can protect your own account with an authenticator app from Account → Security.

The mobile app stores a copy of your agency's published content on your device so it works without signal. That copy is protected by your device's own security; we recommend a device passcode. If your agency removes you, or you or your agency choose Sign out & wipe for a phone, the app deletes that agency's copy the next time it reaches our servers. Signing out of the app removes your personal records (favourites, progress, acknowledgments) from the phone; the agency's content stays for the next person who signs in.

Your rights and choices

Access and correction. You can view and edit your profile at any time from your account. For anything you cannot see, contact us.
Download your data. From Account → Security → Download your data you can download a machine-readable copy of every record we hold against your user id.
Delete your account. From Account → Security → Delete account. If you are the only administrator of an agency you will be asked to promote someone else first, so the agency is not left without anyone able to manage it.
Notifications. Push notifications can be switched off per guide or entirely from your account; your device settings override ours.
Complaints. Contact us first and we will respond within 30 days. If you are not satisfied you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au.

Cookies and local storage

The website uses no advertising or analytics cookies. The console and the app store a session token so you stay signed in, and the app stores your agency's content and your offline queue locally so it works without a connection. Signing out clears the session.