Privacy

Last updated November 1, 2026. ValkFire is published by BonkWorks Studios LLC.

ValkFire is fire department operations software. It is bought and controlled by a fire department, and most of what it holds is that department's own operational record. This page describes what the software collects, why, who can see it, and how long it is kept.

What is collected

About department members

Operational records

Patient records

None of this is saved unless the department has turned Patient records on.

• Who can open a patient card. While the call is running, its patient cards can be opened by the members on that call: its incident commander, the members on its board and the members who answered its page as coming. Administrators, members the department has given the patient-records permission, and the medical directors an administrator names can open them too. Once the call is closed, only those three can. A member of another department the crew lets help with a patient can open only that patient, until 2 hours after the call ends (see Mutual-aid crews below).
• Who opened it. The app records who opens a patient card and when.
• Nothing is overwritten. Each vital-sign set, treatment or note is saved once and never edited. A correction is a new entry. An officer or administrator can mark a mistake "entered in error" with a reason; it is hidden and kept in the history. Patient cards cannot be deleted from inside the app.
• Where a patient's name never appears. The name and history are kept only on the patient card. They are never on the incident record itself. They never appear on the tactical or mass-casualty map, the bay TV or other paired screens, the dispatchers' page, the mutual-aid page, a notification, or any department export or report. NERIS reports never carry them. They leave the card only through the handoff to the ambulance and a released copy, below.
• Released copies. After a call has closed, an administrator or a member with patient records can release a copy of a patient's record to someone with a right to it, such as a hospital or the patient. The copy holds the parts they pick, which can include the name. ValkFire keeps a record of who released it, to whom, why, which patients and which parts; administrators can see that record.
• Notifications. No notification says anything about a patient — not on the lock screen, and not in the data the notification carries.
• On devices. So that an opened card is still on hand without a signal, phones and tablets keep a copy of the patient cards they have opened in the app's own storage. When the member signs out, and once their work has reached the server, the copy is cleared before the app opens for anyone else. The Windows app and web browsers keep no patient cards or rehab records on the device. They read them from the server each time.
• EMesh. Patient cards and patient notes never travel over EMesh. A call's patient list does: age, sex, chief complaint, triage color and where the patient went. It travels only over EMesh's encrypted link.
• AI. Patient cards are never sent to Google Gemini or any other AI. Radio traffic is different: dispatchers sometimes say patient details on the air, and if the department turns on radio transcription, that audio is sent to Google Cloud Speech-to-Text (see Radio below). Phones and tablets read a photo of a patient's medicine bottles or medication list on the device itself; the photo never leaves it. On a computer or in a web browser, and only if the department turns it on, the photo is sent to Google Cloud Vision, which sends back the text. Either way, only each medicine's name and strength are kept, and the photos are not saved. Otherwise the crew types the medications.
• Saying the vitals. A member can say a set of vital signs instead of typing them. ValkFire asks the device's own speech recognizer to do it on the device. iPhones and iPads do, or the member types instead; Android phones that have an on-device recognizer use it, and on others, and on a Windows computer with online speech recognition turned on, the device's recognizer may send the sound to Google or Microsoft. In a web browser, vitals are typed. ValkFire keeps no recording, only the numbers.

The handoff to the ambulance

• When the crew marks a patient as handed to an ambulance agency, ValkFire puts that patient on the agency's private web page. The crew's screen shows the agency's QR code, link and 4-digit code.
• Each agency has its own link and code. Only the department's administrators set or change a code, and every change is logged. An agency with no code of its own gets a one-time link and code for that handoff.
• The medic enters the code, their name and their unit. After five wrong codes, that device is paused for 15 minutes and the department is told. After 25 wrong codes on one link in an hour, the whole link is paused.
• The list shows each patient's time, age and sex, chief complaint and incident number. It shows no names. Opening one patient shows the name and the other details the department allows.
• The department chooses what the page shows: name, age, history, allergies, medications, vital signs, treatments, notes, and the crew's flags.
• A patient stays on the list for 10 hours unless the department sets 4, 8, 12 or 24 hours.
• An officer or administrator can put a patient back on the list, or take one off early. They must give a reason, and it is logged.
• Every time the list or a patient is opened, ValkFire records the name and unit the medic gave.
• The page is never stored by the browser and is hidden from search engines.
• When a patient leaves the list, the medic's page stops showing them. The patient's record stays with the department in ValkFire.

Radio

A department can turn on Radio. ValkFire then plays and keeps county radio traffic, which it receives from Broadcastify, a radio-streaming service, and from the county's page feed. Dispatchers sometimes say patient details on the air.

• With each call. The transmissions heard during a call are kept with that call, as long as the call's record. Only the department's officers and administrators can play them.
• The live radio. The page's audio and the county radio are kept for 4 hours so members can hear them on the page, on the way and in the county radio bar. Every member of the department can play them during those 4 hours. Then they are deleted.
• Words. Only if the department turns on transcription, the audio is sent to Google Cloud Speech-to-Text in the United States, a service Google lists under its HIPAA Business Associate Addendum, and the words are kept in the call's log beside the audio.
• Broadcastify receives no department data. ValkFire asks it for the county's radio, not for anything about the department or its members.
• Radio audio never goes on the bay TV, a notification, an export, NERIS or a mutual-aid page.

Search and rescue

A department's search-and-rescue site (sar.valkfire.com) keeps the record of a search.

• Volunteers who join a search with a join code give their name, phone number, affiliation, an emergency contact and whether they are 18 or older. The department keeps these with the search. The department can revoke a join code at any time, which cuts off everyone who joined with it.
• Tracks and clues. While a volunteer is searching, the app keeps the track they walked and any clue they mark, with its location. Unlike the on-the-way sharing below, a search track is a trail, because the search needs to know what ground was covered.
• Drone photos carry the place and time they were taken. Each search chooses how long to keep them, 7 or 90 days from when they were taken. At 03:30 Central each night, photos past that date are deleted, unless an administrator has placed them on legal hold. A line in the search's log records each deleted photo's file name, time taken and fingerprint.

Location

Location is off by default. Each member decides for themselves, on each phone, and the department cannot turn it on for them. There are two separate choices.

Your own distance to the call. When a member turns this on, their position is read only while a call is open on screen and the app is in front. It shows that member how far they are from the call and roughly how long they are out, and it is not sent to anyone. The same holds for ValkFire's own turn-by-turn navigation, when a member chooses it under Navigate with: it reads the phone's position on the phone to give the turns, and keeps none of it.

Showing where you are while you're on the way. A member is asked once, in the first-run tour or the first time they answer a page, and can change the answer any time in You → This phone. When a member has said yes:

• Sharing starts only when they answer a page as responding to the station or the scene, and it keeps going while they drive, with the screen off.
• It stops when they arrive, when they change their answer, when the call ends, or when they press Stop sharing — in the app, or on the notification. Reaching the hall on a call that has been started is not arriving: it carries on while they ride to the scene, and stops there.
• While it runs the phone shows it: on Android, a notification named for the call with a Stop sharing button; on iPhone, the blue location indicator. ValkFire never asks an iPhone for “Always” location.
• Only where you are, no speed, no trail. One position per person per call is kept — latitude, longitude, how accurate it is, and when — and each new one replaces the last. It is deleted when the member arrives, stops, or the call ends.
• While it runs, the member's own phone notes when it reached the hall or the scene, and when it left the hall for the scene, as times on their answer to the page, marked GPS. Those times are kept with the call, like an arrival the member taps; no position is kept with them. The member can take one back.
• Members of the department see it on the call's map and the area map, by rank and last name with how old the position is, and in Who's coming as how far out they are, so the officer knows who is coming and how close they are. Crews riding the same rig share one phone's position for the rig.
• On a call with a running board, the app uses those positions and the hall times, in memory, to tell which truck each member left the hall on, and the device of the officer in command puts that seat on the board. All that is kept is the seat: the member, the rig, when, and whether their phone, the order they reached the hall or an officer set it. No speed, no trail and no driving is ever worked out, kept or sent. An officer can always change a seat, and the department can turn this off.
• Sharing with dispatch. Only if the department turns on sharing with dispatch, and only for a member who turns on their own Share with dispatch on a call switch (off until they do): while they are responding, the county's dispatchers see, on a link sent with each page, their rank and last name, where they are headed, how many minutes out their own phone says they are (or how far), and a dot on a map. Never a phone number, a first name, anyone who answered that they can't come, or anyone with the switch off. The link stops working when the call ends, and after 12 hours at most.
• A member who says no loses nothing else, and is never marked absent for it.
• It needs the phone's precise location. With only an approximate location allowed, sharing does not start, and the app says how to turn precise location on.

Addresses entered for calls and pre-plans are converted to coordinates using the U.S. Census Bureau geocoder, a free public service. Results are cached so the same address is not looked up repeatedly.

Reading photos with AI

ValkFire can read a document so nobody has to type it in: a certification card, certificate, roster, a rig's paperwork, or a hazmat placard. To do that, the file is sent to Google's Gemini model, with the department's roster names and unit numbers so it can match them. The text it finds comes back for a person to check before anything is filed. Once a member has said yes, every file they add on the Documents screen is read this way.

• Each member is asked first, the first time, on each device. Saying no means typing the details by hand; nothing else changes. The answer can be changed any time in You → Account & sign out.
• ValkFire uses Google Cloud's Vertex AI service, in the United States, under which Google does not use the photos or the results to train its models. Google may keep requests for a limited time to detect abuse and to meet legal requirements.
• Patient cards are never sent to Gemini.
• The demo never sends anything to Google.

Technical data

Standard operational logging by the hosting provider: request timestamps and error reports. Each phone that turns on notifications registers a notification token, so pages and alerts reach it; it is removed when the member signs out or deletes their account. A page's notification shows what the department chooses to show on a locked phone: by default the call type, address, cross streets, units and the dispatcher's notes, which can describe the patient's complaint. The department can limit it to the call type and address, or the call type alone. Other notifications never carry anything about a patient. Each phone reports which version of the app it runs, so the department can be told when an update is due. If the department turns on notification tests, each test reports when it arrived, whether the app was open, and the phone's model and system version. If the department's daily page test is on, once a day the server sends each member's phone a silent message and records whether it answered and when; results are kept 30 days and are seen only by that member and the department's admins. No advertising identifiers. ValkFire contains no advertising, no third-party analytics and no advertising or analytics tracking. The only member location it shares on a fire or EMS call is the on-the-way sharing above, which each member chooses for themselves, and, when both the department and the member turn it on, the same position shown to the county's dispatchers. Search-and-rescue tracks and drone photos are described under Search and rescue.

Who can see it

• The department. Members see their department's records; administrators see and approve everything. Patient records have tighter rules, described under Patient records. Departments cannot see each other's data.
• The county's dispatchers, only if the department turns on its dispatch page and gives them the address (and, if it sets one, the PIN). During a Weather Watch call it shows the department's spotters: who is at which post, what they have reported, and the position of those sharing on the way.
• Mutual-aid crews, in three ways, each started on purpose by the department's own members. The view-only page: when an officer shares a running call by QR code or link, the crew sees the map with units and staging, who has command, hazards, the pre-plan and water nearby, and building access codes only if the officer chooses to include them. It shows no member's location and nothing about a patient. The page counts how many times it was opened and when it was last opened, with no names and no IP addresses, and it stops working when the call ends or the officer withdraws it. EMesh: a phone from another department that scans Command's EMesh code receives a copy of that one call, and no other, over EMesh's encrypted link. The copy includes the call's patient list, as described under Patient records, but never a patient card or patient note. Help with a patient: a member on a running call can show a code, 8 letters, good for 10 minutes. A person from another department who enters it types their full name and department, sees only the patients they are put with, can add vital signs, treatments and notes under that name, and loses access 2 hours after the call ends. The crew can add them to more patients or turn their phone off. After the call, their department receives a link and code to the patients they worked, so it can write its own report; that list follows the same rules and hours as an ambulance handoff (see The handoff to the ambulance).
• Google Firebase hosts the data and provides sign-in, storage and hosted functions. Data is held in the United States. BonkWorks Studios LLC has accepted Google Cloud's HIPAA Business Associate Addendum, and patient records are stored and handled in Google Cloud services that Google lists under it. Push notifications travel through Apple's and Google's push services, which that addendum does not cover. A patient card never goes in a push; a page's notification carries the dispatcher's text when the department chooses (see Technical data).
• Google Gemini, through Google Cloud's Vertex AI in the United States, reads the files a member chooses to have read (see Reading photos with AI above), and only with that member's permission. It never receives a patient card.
• Google Cloud Speech-to-Text, in the United States, turns radio audio into words, only if the department turns on transcription (see Radio).
• Broadcastify supplies county radio audio when the department turns on Radio. It receives no department data.
• Anthropic (Claude) reads the files a department uploads to its setup form, if the department asks it to (see Requests and setup).
• Microsoft 365 carries BonkWorks Studios LLC's own email, including replies to departments.
• NERIS — the National Emergency Response Information System, run by the Fire Safety Research Institute — receives incident reports when the department chooses to submit them. This replaces NFIRS, which closed on February 1, 2026. Submission is the department's decision, per report or automatically on approval, and can be switched off. Reports never carry a patient's name or history.
• The ambulance agency a patient is handed to, if the department uses Patient records. It sees that patient on its private handoff page, with only the details the department allows and only for the hours the department sets (see The handoff to the ambulance).
• BonkWorks Studios LLC can access department data only where necessary to operate and support the software, or where the law requires it.
• Nobody else. Data is never sold, rented, shared for advertising, or used to train anything.

How long it is kept

Fire department records have statutory retention periods that vary by state, and they are usually measured in years. ValkFire keeps records for as long as the department's account is active, or as long as the department's own retention policy requires — whichever is longer. Patient cards and rehab records cannot be deleted from inside the app. A department can export its records, at any time, as a spreadsheet, from within the app. Patient cards, patient notes and call narratives are left out of every export and stay in the app. When a department closes its account it can request full deletion.

Some copies are kept for a set time and then deleted on their own:

• The live radio: 4 hours.
• A patient on an ambulance agency's handoff list, or on a helping department's list: the department's handoff window, 10 hours unless it chooses 4, 8, 12 or 24. The patient's record stays with the department.
• The record of each time a handoff list or patient is opened: 6 years.
• Another department's access to a patient: 2 hours after the call ends.
• Search-and-rescue drone photos: 7 or 90 days from when they were taken, as the search chose, unless on legal hold.
• Setup-form uploads that no form lists: deleted within a few hours.

Your choices

• Reading photos with AI — asked before the first one, and switchable in You → Account & sign out.
• Location — off unless you turn it on, and you can turn it back off at any time in You → This phone. To stop sharing in the middle of a call, press Stop sharing in the app or on the notification.
• Photographs — only ever taken when you press the camera button.
• Your own record — ask a department administrator to correct or remove anything about you. Operational records that name you, such as an incident you responded to, are the department's records rather than yours, and their retention rules apply. A rehab record about you can be corrected, but not deleted.
• Getting it all out — the department's administrators can export its records from Admin → Data → Export all data, any time, no request needed. Patient cards, patient notes and call narratives are not in it.
• Deleting your account — from inside the app, any time. See below.

Deleting your account

Any member can delete their own ValkFire account from inside the app: You → Account & sign out → Delete my account, then type DELETE to confirm. It works in the phone app and the web app alike. The full details are on Deleting your account.

• Deleted: the sign-in (phone number or email), the phone's notification registration, the member's phone number, email, emergency contact and photo.
• Kept by the department: the records of the member's service — calls, truck checks, trainings, meetings, certifications, state license numbers and pay hours, their rehab records, and the patient records they wrote, with their name as the author. These are the department's records and its retention rules apply. The member's name stays on the roster until an administrator takes it off.

Can't sign in? Email privacy@valkfire.com from the email address or with the phone number on your roster entry and we will delete the account within 30 days.

Evaluation passes (the Ride-Along and the demo department)

A department evaluating ValkFire opens the Ride-Along and the demo department with a pass we give it on a call. For each pass BonkWorks Studios LLC keeps: the department it was given to; the two devices it is open on, each as a random number that browser keeps and the kind of device (for example “iPhone · Safari”); the name typed when agreeing to the evaluation terms and when; which Ride-Along chapters and demo screens were opened and when; and whether the pass ended and why. The demo department gives each pass its own sign-in, deleted when the pass ends. To stop abuse, tries are counted per internet address with a scrambled code that changes every day, kept for two days; the address itself is not stored. Members of a department on ValkFire who open the Ride-Along from the members page get a pass of their own the same way, kept with their department's records. We keep a pass's records for 12 months after it ends, then delete them, unless we need them to protect the software from misuse; a department can ask for a copy of its own. Email privacy@valkfire.com and we will delete a pass's records.

Requests and setup from valkfire.com

When you send the request form on See ValkFire (valkfire.com/see), BonkWorks Studios LLC keeps what you typed — your department, name, title, email, phone, city and state, roster size, what you're interested in and your message — to answer you and to keep track of where your department is with ValkFire. Replies come from BonkWorks Studios LLC's own email, on Microsoft 365. Nobody else sees it, and it is never added to a mailing list. To stop abuse, the form counts requests from each internet address for a day using a scrambled code that changes every day; the address itself is not stored. Email privacy@valkfire.com and we will delete your request.

A department joining ValkFire fills in the setup form at valkfire.com/intake, behind a codeword BonkWorks Studios LLC gives it: the department, its people, rigs, check sheets, pre-plans and water sources, and any files it uploads (up to 600 files and 2 GB per form). Photos are turned upright, made smaller and have their location tags removed before they are uploaded. If the department asks the upload helper to fill the form from its files, each file is sent to Anthropic's Claude model to read. Before anything is sent, the department confirms its files hold no patient records, a file that looks like a run report is never sent, and spreadsheet columns such as birth dates and medical details are removed. The department checks everything the helper fills in before it presses Finish, and BonkWorks Studios LLC reviews it again before anything is loaded into ValkFire.

Valkyrie, the AI helper

Valkyrie is an AI, not a person, and it can be wrong. On See ValkFire (valkfire.com/see) anyone can ask it about ValkFire. Your question and the last few turns of the conversation are sent to Anthropic's Claude model with a sheet of facts from this website; it sees nothing else. Neither the question nor the answer is kept. To stop abuse, Google's reCAPTCHA (Firebase App Check) checks that the question comes from this website, and questions are counted for a day per browser and per internet address using scrambled codes that change every day; the address itself is not stored. Valkyrie never sends anything for you: if you tap Request pricing on its card, what you typed goes in exactly as the request form above would.

Inside the app and on the members page, signed-in members can ask Valkyrie how ValkFire works. The question, the relevant parts of ValkFire's manuals and, in the app, a short summary of the member's own department (rig status, the member's name and own certifications and their open requests, never patients) are sent to Anthropic's Claude model. The app asks the member first, and the answer can be changed from Valkyrie's own screen. Nothing about a question or answer is kept. Anything Valkyrie drafts for ValkFire is sent only when the member taps Send, as an ordinary request.

Requests from inside the app

When a member uses "Ask for something", "Request another way" or "Report a problem" in the app, what they wrote, the photos or files they added, the screen it was about, their name, their department, and the app version and kind of device are kept in that department's ValkFire space. Everyone in the department can see the department's requests and the answers; BonkWorks Studios LLC reads them to answer and to decide what to build. Report a problem also adds the app's own recent error messages from that device. The app asks members to leave patient details out. Requests are kept with the department's records and deleted with them.

Children

ValkFire is workplace software for fire department members and is not directed at children. Departments with junior or explorer members under 18 should treat those roster entries the way they treat any other personnel record they hold. Patient records can be about children, including newborns. They are kept and protected the same way as any other patient record.

Security

Data is encrypted in transit and at rest by the hosting provider. Access is controlled by sign-in and by per-member permissions set by the department's administrators. Patient records have tighter rules, described under Patient records. More on how the records are kept safe: Security.

If you were a patient

A patient record in ValkFire belongs to the fire department that cared for you, and that department decides who may see it. To see a copy or ask for a correction, contact the department. If you write to privacy@valkfire.com instead, we will pass your request to the department and stay copied on it so we can help.

Changes

Material changes will be dated at the top of this page, and departments will be told directly rather than expected to notice.

Contact

BonkWorks Studios LLC — privacy@valkfire.com