Privacy Policy

Last updated: November 10, 2026

Battle Rhythm ("we", "our") provides Incident Response Ledger and related tools for emergency management agencies at battlerhythm.co, and a public demo at demo.battlerhythm.co. This policy describes what we collect, how we use it and how we protect it.

Information We Collect

• Account information: your email address, name and position, and your password (stored only as a one-way hash). If you turn on two-step sign-in, its secret is stored encrypted.
• Agency data: incidents, labor and equipment entries, employee pay rates, materials and other costs, vendors, EOC time and activity logs, crew time reports, shift tickets and photos that your agency enters.
• Request access and demo sign-ups: the name, title, organization, email address and (for Request access) phone number you give us, and the network address the request came from.
• Activity and security records: an audit log of sign-ins, changes and exports (who, when and from what network address), and basic server logs.

How We Use Your Information

• To sign you in, keep your account secure and send account emails (setup links, password resets and security notices).
• To store, calculate and report your agency's incident costs, including FEMA forms and LEMO exports.
• To review access requests, set up demos, and follow up with you about Battle Rhythm when you request access or start a demo.
• To keep the audit records agencies need for reimbursement and records retention.

We do not sell or rent your information, and we do not use it for advertising.

Service Providers

• Railway hosts the application and its database in the United States.
• Groundmail delivers our emails.
• OpenAI processes questions you ask PoppaGPT, along with the incident figures needed to answer them.
• Google (Gemini) processes documents you scan with Tara, where that feature is enabled.

Each agency can turn the AI tools (PoppaGPT and Tara) off; nothing is sent to OpenAI or Google then.

Data Storage & Security

Data is encrypted in transit (HTTPS/TLS). Each agency's records are kept separate by the database itself, so one agency cannot see another's. Sign-in sessions time out after inactivity, and changes are recorded in an audit log. The public demo runs on a separate database from the production service.

Retention

• Agency records are kept for as long as your agency uses Battle Rhythm, and deleted records are kept restorable to meet records-retention requirements. Your agency can export all of its records at any time.
• Demo agencies, and everything in them, are deleted 14 days after sign-up. We keep the sign-up details (name, organization and email) to follow up, unless you ask us to delete them.

Your Rights

You may request access to, correction of, or deletion of your personal information. If your account belongs to an agency, contact your agency's Battle Rhythm administrator; otherwise contact us through battlerhythm.co.

Contact

For questions about this policy, contact your agency's Battle Rhythm administrator, or reach us through battlerhythm.co.

← Back to Sign In