Privacy Policy
Updated: April 8, 2026
Overview
Hotwash ("we," "our," or "us") provides after-action review tools for first responders. We are deeply committed to the privacy and security of your data. This privacy policy explains how we collect, use, process, and protect your information.
Information We Collect
We collect basic user information necessary for account creation, authentication, and service delivery:
Name
Email address
Organization affiliation
Audio Processing and AI Training
Due to the sensitive nature of first responder operations, we handle your audio and transcription data with the strictest privacy configurations available:
Real-Time Processing: Audio recordings are processed in real-time and are not permanently stored on Hotwash servers.
Summary Storage: Only the text summaries generated from your recordings are stored in our secure database. These are accessible strictly to authorized members of your organization.
No First-Party AI Training: Hotwash explicitly does not use your audio content, transcripts, or summaries to train our own artificial intelligence or machine learning models.
Enterprise Vendor Protections: We utilize secure, enterprise-tier API endpoints for our transcription and summarization partners (Google Gemini, Groq, and AssemblyAI). We actively enforce strict "Zero Data Retention" (ZDR) policies and have formally opted out of all model-training programs with these providers.
No Third-Party AI Training: Because of these enforced enterprise configurations, your audio and text data is explicitly restricted from being logged, retained, or used to train the underlying foundation models of our third-party AI vendors.
Data Security
We implement robust, industry-standard security measures to protect your information from unauthorized access, alteration, or destruction:
Encryption in Transit: All data transmitted between your application and our database (Firebase/Firestore) is strictly enforced over HTTPS and encrypted using Transport Layer Security (TLS 1.2+).
Secure Authentication: User authentication is managed securely via Google Auth, utilizing the OAuth 2.0 protocol over HTTPS to ensure your login credentials remain protected.
Data Retention
We retain your data only for as long as necessary to provide our services:
Account information is retained while your account is active.
Text summaries are stored for the duration of your organization's active subscription.
You or your organization's administrator can request the complete deletion of your data at any time by contacting our support team.
Data Sharing
We do not sell, trade, or share your personal information or organizational content with third parties. Access to your information is strictly limited to:
Authorized members of your specific organization.
Our vetted service providers who require temporary, restricted access solely to provide the core computational services (e.g., transcription API processing), governed by the strict data retention rules outlined above.
Changes to This Policy
We may update this privacy policy periodically to reflect changes in our practices, technology, or legal requirements. We will notify users directly of any material changes to these terms.