Privacy Policy
The short version
- Your account is yours. Your training record follows you across every department you ride for.
- We collect what a training record needs: who you are, what you trained on, how long you spent on it, how you scored, and what you submitted. Nothing more.
- Instructors and chiefs at a department you belong to can see your training activity — that is the point of a compliance system. Other members cannot.
- We do not sell your data, we do not advertise, we run no analytics or ad trackers, and we do not use your training content to train AI models.
- Data lives in Microsoft Azure in the United States. One cookie, for keeping you signed in.
- Never upload patient care reports, HIPAA-protected records, or personnel investigation files. Rekindle is a training system, not a medical or personnel records system.
The short version is a summary, not a substitute — the sections below control.
1. Who we are and what this covers
Rekindle Training (“Rekindle”, “we”, “us”) provides a fire-service learning management system: courses, skills assessment, and audit-ready training documentation. This policy covers https://rekindletraining.com, the Rekindle web application, and the email we send you about your account.
It explains what we collect, why, who can see it, and what you can ask us to do about it. Your use of Rekindle is also governed by the Terms of Service.
The contracting entity is [registered entity name — e.g. Rekindle Training, LLC], [mailing address — required for privacy and copyright notices].
2. You, your department, and Rekindle
Rekindle is individual-first: you create your own account, you name the department or agency you serve with, and you can associate your account with more than one agency from your profile. Many firefighters ride for two or three.
That structure means two parties hold responsibilities for your data:
- Rekindle is responsible for your account and for operating the platform — security, availability, and the choices described in this policy.
- Your department is responsible for how it uses the training data it can see about its own members: what it assigns, how it evaluates readiness, how long it must retain records, and how it responds to public-records requests or litigation. A department's own policies, personnel rules, and applicable records laws apply to that use, and we can't change them on its behalf.
If you leave a department, records of the training you completed for that department remain part of that department's training documentation. See retention and deletion for how that interacts with your rights.
3. What we collect
3.1 Account and identity
Collected when you sign up or edit your profile:
- Name, email address, and password. We never store your password — only a salted scrypt hash of it, which cannot be reversed into your password.
- Rank or title, and contact phone number (both optional).
- Department or agency affiliations, and which one is primary.
- Station assignment and shift, where your department uses them.
- Your role — trainee, instructor, or chief (admin) — and your avatar color.
- Whether your account is active, and the date it was created.
3.2 Training activity
This is the substance of a training record, and it is generated as you train:
- Enrollments and assignments — the courses you're enrolled in, who enrolled you or whether you self-enrolled from the catalog, due dates, and refresher cycles.
- Time on task — while a lesson is open, the viewer reports activity about every 10 seconds, and we record time per slide or per page. Reported time is capped server-side, so it reflects attention rather than a window left open overnight. It stops when you switch tabs or close the lesson.
- Progress and completion — which units you've viewed, when you started and finished.
- Assessments — quiz attempts including your individual answers, the score, pass/fail, and timestamps.
- Submissions — files you upload for skill sheets and assignments (the file itself, its original name and size), plus the instructor's grade and written feedback.
- Training records — on course completion we write a permanent record: course title, training category, credit hours, seat time, and completion date. These are append-only by design — the record is what makes it audit-ready — and they build your transcript.
- Certifications — certifications issued or renewed through Rekindle, with issue and expiration dates, and whether one has been revoked.
- Audit log — an append-only trail of who did what: sign-ups, enrollments, grading, certification grants, record-affecting administrative changes. It stores the actor, action, affected item, and one line of description.
3.3 Content uploaded by instructors
Instructors upload PowerPoint decks, PDFs, and assignment materials. Those files are stored, converted for display (see 3.5), and served to enrolled members. If a deck names members, includes photographs, or contains incident details, that content is in Rekindle because your department put it there — the Terms of Service puts responsibility for what gets uploaded on the uploader.
3.4 Technical and log data
- A session cookie that keeps you signed in — see section 5.
- Ordinary server logs: request paths, timestamps, IP address, browser user-agent, and errors. We use these to keep the service running and to investigate abuse or defects.
3.5 How lesson conversion works
PowerPoint files are converted to slide images on our own servers using open-source software (LibreOffice and poppler). PDFs are rendered in your browser by a copy of pdf.js that we serve ourselves. Your lesson content is not sent to a third-party conversion, transcription, or AI service.
4. What we don't collect
- No location tracking. Rekindle does not request or store GPS or device location.
- No device or contact scraping, no microphone or camera access, no keystroke or screen recording, no webcam proctoring.
- No Social Security numbers, driver's license numbers, payment card numbers, or biometrics. There is no field for them. Don't put them in a free-text field either.
- No health or patient information. Rekindle has no PHI fields and is not designed, and not offered, as a HIPAA-covered system. Never upload patient care reports, run sheets containing patient identifiers, medical records, or fitness-for-duty medical documentation.
- No personnel investigation, disciplinary, or CJIS-regulated material. Rekindle is a training system; those records belong in the systems your department maintains for them.
- No advertising or cross-site tracking data, and no data broker enrichment.
If sensitive information of that kind reaches Rekindle anyway, tell us at privacy@rekindletraining.com and we will work with your department to remove it.
6. How we use information
- To run your training — authenticate you, show your courses, unlock modules in order, grade quizzes, route submissions to an instructor.
- To produce the records your department needs — transcripts, ISO training-hours reporting by category, certification expiry tracking, overdue and readiness dashboards, and the audit log.
- To keep the service working and honest — debugging, backups, capacity, abuse investigation, and the server-side time caps that keep reported hours credible.
- To communicate with you about your account: assignment and due-date notices, security notices, and material changes to this policy or the Terms.
- To improve Rekindle using aggregate, de-identified usage patterns — how long a lesson takes across many departments, which quiz items nearly everyone misses. Nothing published or shared in this form identifies you or your department.
We do not: sell or rent personal information; share it with advertisers or data brokers; use your uploaded content, submissions, or transcripts to train machine-learning models; or use training data for any purpose other than delivering and documenting training.
7. Who can see your data
| Who | Can see | Cannot see |
|---|---|---|
| You | Your profile, your courses and progress, your quiz scores and answers, your submissions and feedback, your certifications, and your full transcript. | Other members' records. |
| Instructors at a department you belong to | For that department's courses: your enrollment, completion, time on task, quiz scores and answers, submitted files, and grades. This is what grading and reporting require. | Your password (nobody can — it is only stored hashed). |
| Chief / admin at a department you belong to | Everything an instructor sees, plus your member record (rank, station, shift, contact details), certifications and expirations, ISO hours reporting, and the audit log. | Your password. |
| Other members | Nothing about your training. Rekindle has no member-to-member browsing. | Your records, scores, and submissions. |
| Your other departments | Each department sees its own courses, assignments, and reporting. | Another agency's assignments, grading, or internal reporting. |
| Your transcript | Your transcript spans every agency you've trained with, and it's yours to print or share with anyone. Instructors and the chief at your primary department can also open it — which means they can see training you completed for another agency. | Staff at a non-primary agency cannot open your transcript; they see only their own department's courses and reports. |
| Rekindle staff | Only what is needed to operate the service — investigating a support request you or your department raised, diagnosing a defect, or responding to a security incident. Access is limited to staff who need it. | We don't browse training records for any other reason. |
A note on roles: a department's chief and instructors are appointed within your department, not by us. If you believe someone at your department has access they shouldn't, raise it with your department first — and with us at privacy@rekindletraining.com if you think Rekindle has a defect.
Because departments are matched by the name typed at signup, anyone typing your agency's name joins that agency's roster. Don't put confidential information in an agency name, and tell us if you see an account that doesn't belong.
9. Where data lives and how long we keep it
Data is stored in Microsoft Azure data centers in the United States. Uploaded lesson files, converted slide images, and submitted files are stored on Rekindle-controlled storage in the same region.
| Data | Kept for |
|---|---|
| Account and profile | While your account is active, then per your deletion request (see section 11). |
| Course progress, quiz attempts, in-flight work | Through the training cycle; prior cycles of recurring courses are archived so history survives a refresher. |
| Training records and transcripts | Retained as your department's compliance documentation — commonly years. ISO and state programs, and defense against a line-of-duty claim, depend on retrospective records. |
| Certifications | While issued, plus history of prior issues and renewals. |
| Submitted files (skill sheets, assignments) | While needed as evidence for the record they support. |
| Audit log | Append-only; retained for the life of the department's account. Its integrity is the point. |
| Session cookie | 12 hours, or until you sign out. |
| Server logs | A short operational window, then discarded or aggregated. |
| Backups | On a rolling schedule; deletions propagate as backups age out. |
10. How we protect it
- Passwords are stored as salted scrypt hashes, never in plain text and never recoverable — not even by us.
- In transit, traffic to Rekindle is encrypted with TLS.
- At rest, the database is encrypted by Azure SQL, and database credentials are held in the deployment environment, not in our source code.
- Access control is enforced per request: lesson content, submitted files, and reports are checked against your sign-in, role, and enrollment before they are served.
- Session cookies are
httpOnlyand same-site, which blunts script-based theft and cross-site request forgery. - The audit log is append-only. Nothing in the application updates or deletes an audit row, so administrative history can't be quietly rewritten.
- Staff access is limited to people who need it to operate the service.
What we don't claim: Rekindle has not completed a SOC 2 audit or a third-party penetration test, and no system is perfectly secure. We'd rather tell you that than imply otherwise.
If we learn of a breach affecting your personal information, we will notify affected members and departments without undue delay, and as required by applicable law.
Found a vulnerability? Report it to security@rekindletraining.com. Please give us a reasonable window to fix it before disclosing publicly; we won't pursue good-faith research that respects member privacy and avoids service disruption.
11. Your choices and rights
11.1 What you can do yourself, right now
- See and correct your information — your profile holds your name, email, rank, phone, station, shift, and avatar.
- Review your training data — My training for progress and time on task, and My transcript for the complete record, which is printable and shareable with any agency or prospective employer.
- Manage your agencies — add or remove affiliations, and change which one is primary, from your profile. Removing an affiliation stops that department's future visibility into your ongoing training; records of training you already completed for it remain part of its documentation.
- Sign out to end your session and clear the cookie.
11.2 What to ask us for
Email privacy@rekindletraining.com from your account email address, and we will respond within 30 days:
- Access or a copy — a machine-readable export of the personal data we hold about you.
- Correction of anything you can't fix yourself — a mis-entered training record, a wrong department affiliation.
- Deletion of your account and personal data.
- Restriction or objection — tell us what you object to and we'll explain what we can do.
- A human — no automated decision-making produces legal or comparably significant effects about you in Rekindle. Readiness judgments are made by people at your department.
11.3 The honest limits on deletion
Two things we can't simply erase, and you should know why before you sign up:
- Completed training records and the audit log are append-only. They exist so a department can prove what training happened. Deleting them on request would defeat the purpose of a compliance record and could expose your department in an ISO review or a lawsuit.
- Your department's copy of its records. Where the records are your department's documentation, we will delete your Rekindle account and de-identify what we can, and we will refer the rest to your department, which is the party with the retention obligation. We'll tell you exactly what was deleted, what was retained, and who at your department to talk to.
We will not retaliate for a privacy request, and exercising these rights never affects your training standing.
12. State and regional privacy rights
California. Under the CCPA/CPRA, California residents have rights to know, access, delete, correct, and limit use of sensitive personal information, and the right not to be discriminated against for exercising them. We do not sell personal information and do not share it for cross-context behavioral advertising, so there is no “Do Not Sell or Share” action to take. Use the contacts in section 11; we verify requests against your account email. An authorized agent may submit a request with written proof of authority. See the California Attorney General's CCPA page for background.
Other U.S. states. Residents of states with comprehensive privacy laws — Colorado, Connecticut, Virginia, Texas, Oregon, and others — have similar rights to access, correct, delete, and obtain a copy of their data, and to appeal a denial. To appeal, reply to our response and write “Privacy Appeal” in the subject line; if we deny the appeal we'll tell you how to contact your state attorney general.
Outside the United States. Rekindle is built for U.S. fire departments and hosted in the United States. If you use it from the EU, UK, or Canada, you are consenting to processing in the U.S.; contact us and we will honor access, correction, deletion, and portability requests on the same terms.
13. Juniors, explorers, and cadets under 18
Rekindle is built for adults. We do not knowingly collect information from anyone under 13, and accounts must not be created for them.
Junior firefighter, explorer, and cadet programs are real, and members aged 13–17 may use Rekindle only where the department has obtained verifiable parent or guardian consent under its own program rules, and the department has an adult responsible for the account. Departments enrolling minors should keep that consent on file — Rekindle does not collect or verify it.
If you believe a member under 13 has an account, or that a minor's account was created without consent, write to privacy@rekindletraining.com and we will remove it promptly.
14. Changes to this policy
We update this policy when the product or our providers change. The “Last updated” date at the top always reflects the current version. For material changes — a new category of data, a new recipient, a new purpose — we will notify account holders by email or an in-app notice at least 30 days before the change takes effect, so you have time to export your record and close your account if you disagree. Continued use after the effective date means the updated policy applies.
15. Contact us
- Privacy questions and data requests: privacy@rekindletraining.com
- Security reports: security@rekindletraining.com
- Everything else: support@rekindletraining.com
- Mail: [registered entity name — e.g. Rekindle Training, LLC], [mailing address — required for privacy and copyright notices]
See also the Terms of Service, which covers accounts, uploaded content, acceptable use, and the limits of what a training record proves.