EMDG EndEx Privacy Policy

Effective date: October 1, 2026

EMDG EndEx ("the app") is operated by EM Disaster Gaming ("we", "us"). The app
collects feedback from exercise participants and turns it into an after-action
report for the facilitator who ran the exercise. This policy explains what
information the app collects, how it is used, who it is shared with, how long
it is kept, and how you can delete it.

Contact: arthur@emdisastergaming.com or spoling@emdisastergaming.com

1. Information we collect

Facilitator accounts. To create an account you provide an email address and a
password, and optionally your name. The password is stored only as a one-way
hash, which we cannot read. If you sign in with Apple, Google, or Microsoft,
we receive an identifier from that provider and, if you allow it, your email
address. We never receive your password for that provider.

Exercise content. Facilitators enter exercise details: name, date, location,
organization, scenario, objectives, and capabilities.

Participant responses. Participants do not create an account. When you join an
exercise with a code, you enter your name, organization, and role, and then
your ratings, survey answers, and hotwash comments.

Purchase records. If an agency subscribes, Apple's App Store or Google Play
takes the payment. We never see your card or your store account details. The
store gives us a record of the purchase: the product, purchase identifiers,
and the dates the subscription starts, renews, and ends.

Technical information. Our servers process your IP address to deliver the
service and to limit abuse. Our hosting provider's logs may keep it for a
limited period. It is not added to your account or used to identify you.

Information we do not collect. We do not collect your location, contacts,
photos, advertising identifiers, or browsing activity. The app contains no
advertising and no analytics or tracking software.

2. Device permissions

Microphone and speech recognition are used only when you choose to dictate an
answer. Dictation is done by your phone's own speech service, which may send
audio to Apple or Google under their privacy terms. The app receives only the
resulting text. We do not receive or store audio.

Face ID, fingerprint, or passcode is used only if you turn on the app lock.
The check is done by your phone. We never receive biometric data.

Photo library access is used only if you choose to save a shared report to
your photos. The app does not read your photos.

3. How we use information

We use the information above only to provide the service: to sign you in, to
collect and show responses to the facilitator who ran the exercise, to draft
the after-action report, to confirm that a subscription is active, and to
keep the service secure. We do not use it for advertising or marketing, and
we do not send marketing email.

4. Report generation with AI

When a facilitator generates a report, the participants' responses for that
exercise are sent to Anthropic, PBC, whose Claude model drafts the report.
The participant name field is removed before anything is sent. Organization,
role, and everything typed into the answer fields are sent as written.
Anthropic processes this data only to produce the report and, under its
commercial terms, does not use it to train its models. Reports are marked as
drafted by AI.

5. Who we share information with

We do not sell personal information, and we do not share it for advertising.
We share it only with:

- The facilitator of an exercise, who sees each participant's name,
  organization, role, and answers.
- Service providers that process it for us under contract: Microsoft Azure
  (hosting and database, in the United States) and Anthropic (report
  drafting).
- Apple or Google, which process subscription payments under their own
  privacy policies.
- Authorities, when the law requires it.

6. Security

Data is encrypted in transit and at rest. Passwords are stored as one-way
hashes. Sign-in tokens are kept in your phone's secure storage. No system is
perfectly secure, and we cannot guarantee absolute security.

7. How long we keep information

An exercise, its responses, and its report are kept until the facilitator
deletes the exercise. A facilitator account is kept until the facilitator
deletes it. Encrypted backups are kept for 7 days and then expire. Drafts of
your answers stay on your phone until you submit them.

8. Deleting your data

Facilitators can delete any exercise in the app, which deletes its responses
and report. Facilitators can delete their account in the app under More, then
Delete account. The account, its exercises, their responses and reports, and
the subscription record are removed at once. Instructions are also at
https://endex-server.happysand-9334073b.centralus.azurecontainerapps.io/account-deletion

Deleting an account does not cancel a subscription. Cancel it in the App
Store or Google Play subscription settings.

Participants who want their answers removed should contact the facilitator
who ran the exercise, or email us with the exercise name and date.

9. Your rights

Depending on where you live, you may have the right to access, correct, or
delete your personal information, to receive a copy of it, or to object to
how it is used. To make a request, email us at the addresses above. We will
answer within 30 days. We do not discriminate against anyone for making a
request.

10. Children

The app is for emergency management professionals. It is not directed at
anyone under 18, and we do not knowingly collect information from children.

11. Changes to this policy

If this policy changes in a way that matters, we will change the effective
date above and show the new version in the app.