Privacy Policy

Last Updated: September 21, 2026 · Effective Date: September 21, 2026

Overview

Pocket Protocols is a mobile application and related website (collectively, the "Service") that provide quick-reference access to Emergency Medical Services ("EMS") protocols, medications, and hospital information for EMS providers across the United States and Canada. The Service is operated by Rappasoft LLC ("Rappasoft," "we," "us," or "our").

This Privacy Policy explains what information we collect through the Service, how we use and share it, and the rights and choices available to you. By downloading, accessing, or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Service.

Information We Collect

Information You Provide to Us

You can use the core app without creating an account. If you choose to create an account, use cross-device sync, or request or use agency features, we collect the information needed to provide those features, such as your name, email address, password or authentication credentials, agency membership and access-request information, role, and related account settings.

If you contact us directly (for example, by email), we will receive the information you provide, such as your email address and the contents of your message.

When you are signed in, we may store selected app data so it can sync across your devices. This may include app preferences, downloaded protocol-set identifiers, notes, favorites, bookmarks, history, and similar app state. You should not enter patient-identifying information, protected health information, or clinical treatment records into notes, logs, or other user-entered fields.

Files and photos you upload. Some agency features let you attach files to a record — for example, photographing an apparatus problem or attaching a document to a work order or request. When you choose to attach a file, that file (such as a photo or PDF) and basic details about it, such as its file name, size, and who uploaded it, are stored on our servers and are visible to authorized staff at the agency the record belongs to. We access your camera or photo library only when you choose to attach a file, and only the files you select are uploaded. Do not attach images or documents that contain patient-identifying information or protected health information.

Information Collected Automatically

Subscription Information

We use RevenueCat to manage and validate in-app subscriptions. In connection with a purchase, RevenueCat and the applicable app store process:

• Purchase, subscription, and renewal status
• Subscription type (e.g., monthly or yearly) and trial status
• App store transaction identifiers and pseudonymous app-user identifiers
• Device and platform information necessary to deliver entitlements

Payment card details are handled directly by the Apple App Store or Google Play and are not collected by or disclosed to us. For RevenueCat's privacy practices, see https://www.revenuecat.com/privacy.

Analytics and Usage Data

To understand how the Service is used and to improve it, our website and mobile app may use Google Analytics. The mobile app sends usage events with a randomly generated identifier stored on your installation, and uses Sentry to record usage events and screen views as diagnostic breadcrumbs. These identifiers and technical data are not necessarily anonymous. We also keep standard server logs. Depending on the part of the Service you use, this may include:

• Pages, screens, and features viewed, and time spent
• Approximate geographic location derived from IP address (e.g., country or region)
• Device type, model, operating system, app or browser version, and language
• Referring URLs and general usage information
• Internet Protocol (IP) address and similar online identifiers

See "Cookies and Tracking Technologies" below for more detail and your choices.

Optional TikTok Advertising Measurement

In app versions where this feature is available, we use the TikTok App Events SDK only after you choose to allow advertising measurement and the device permissions described below permit it. This helps us understand whether our TikTok ads lead to app installs, app opens, and free-trial starts. It does not display TikTok ads inside Pocket Protocols.

When enabled, this integration shares the following with TikTok:

• App-install, app-launch, and verified free-trial-start events, including their timing
• Advertising and device identifiers permitted by your device settings, such as Apple's advertising identifier (IDFA) on iOS or Google's advertising ID on Android
• Basic app, device, operating-system, and SDK information, and Android install-referrer information used for attribution
• Your IP address, which TikTok receives through network requests and which can indicate approximate location

We do not send TikTok clinical searches, protocol content, patient information, notes, narrative drafts, agency or member data, precise location, access codes, account contact details, or subscription customer, product, or transaction identifiers. This integration does not send payment amounts or report a free trial as paid revenue. Other app analytics events are not forwarded to TikTok.

TikTok may match the events and identifiers it receives with information it already holds to measure and deliver advertising, subject to its terms and your TikTok settings. Its handling of this information, retention, and privacy-request options are described in the TikTok Privacy Policy. Your choices within Pocket Protocols are described below.

Crash and Diagnostic Data

The mobile app uses Sentry to detect and diagnose errors and crashes. When the app encounters a problem, Sentry may collect diagnostic information such as error messages and stack traces, the device model and operating system, the app version, and related technical data, which may include your IP address. We use this information solely to identify, troubleshoot, and fix issues and to improve the stability of the app. For Sentry's privacy practices, see https://sentry.io/privacy/.

Information We Do Not Collect

We have designed the Service to minimize data collection. We do not intentionally collect:

• Mailing addresses or telephone numbers unless you voluntarily provide them
• Precise geolocation (GPS) data — if you allow location access, your location is used on your device only, for example to list nearby protocol sets first or sort hospitals by distance, and is not transmitted to us
• Patient information or protected health information
• Clinical, diagnosis, or treatment records
• Microphone audio or your device contacts — voice search is processed on your device by the operating system, and the audio is never recorded or transmitted to us
• Photos or camera images, except the files you deliberately attach to an agency record as described above
• Health data about you

If you voluntarily include any such information when contacting us, we will receive it, but we do not solicit it.

Cookies and Tracking Technologies

Our website may use cookies and similar technologies, such as Google Analytics, to recognize repeat visits and measure usage. We also use Google Fonts to render typography, which may cause your browser to request font files from Google's servers; in doing so, Google may receive your IP address.

You can control or disable cookies through your browser settings, and you can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on. For information about Google's data practices, see Google's Privacy Policy.

The browser controls above apply to website analytics; they do not control analytics inside the mobile app.

Your TikTok Advertising Choices

TikTok advertising measurement is off unless you explicitly allow it. You may decline without affecting app access or your ability to purchase a subscription. We do not initialize TikTok measurement or collect and queue TikTok usage events before permission is granted. An install event may first be recorded when you opt in, and install-referrer information may describe an earlier installation or ad interaction.

• iOS: We also require authorization through Apple's App Tracking Transparency prompt. If permission is denied, restricted, or not yet determined, this integration does not collect or send TikTok events.
• Android: We require your in-app consent and an available advertising ID with tracking permitted. An unavailable or deleted advertising ID, limited-ad-tracking setting, or detected advertising-ID reset prevents or stops this collection.
• Withdrawal: Open Settings → Storage & Data → Advertising measurement and choose Withdraw consent. This stops future TikTok collection from that installation and discards pending local TikTok events. We also recheck device permissions and do not use other identifiers to bypass a denial.

Your advertising choice is stored on each app installation, rather than in your account; manage it on each device you use. Signing out or deleting your Pocket Protocols account does not change that installation's advertising choice; withdraw it separately in Settings. After withdrawal or a permission revocation, fully close and reopen the app before choosing to allow measurement again, and check your device privacy settings. Withdrawing consent, uninstalling the app, or deleting your Pocket Protocols account does not automatically erase information TikTok has already received. For requests about previously shared data, contact us or use the options in TikTok's Privacy Policy.

On iOS, after your in-app consent and App Tracking Transparency authorization, production versions also register an install attribution with Apple's SKAdNetwork. This records only an install conversion, not trial starts, payment amounts, or clinical information. Apple controls the delayed attribution report. Withdrawal stops further registrations by the app but cannot cancel an attribution report already scheduled by the operating system.

The TikTok choice controls this optional advertising integration. It does not switch off the separate Google Analytics, Sentry, subscription, or service operations described in this policy.

Do Not Track. Some browsers transmit "Do Not Track" signals. Because there is no industry-standard interpretation of these signals, the Service does not currently respond to them.

How We Use Information

We use the information described above to:

• Provide, operate, and maintain the Service and deliver subscription entitlements
• Create and authenticate optional accounts and provide cross-device sync
• Manage agency membership, access requests, roles, and agency-specific features
• Verify subscription and trial status and prevent fraud or abuse
• Understand usage patterns and improve the Service, its content, and performance
• With your permission, measure the effectiveness of our TikTok advertising using the limited app events described above
• Respond to your inquiries and provide support
• Maintain the security and integrity of the Service
• Comply with our legal obligations and enforce our Terms of Service

Legal Bases for Processing

Where required by law (for example, in the European Economic Area or the United Kingdom), we process personal information on the following bases: our legitimate interests in operating, securing, and improving the Service; performance of a contract with you (such as providing subscriptions); compliance with legal obligations; and, where applicable, your consent (which you may withdraw at any time).

We rely on your consent for the optional TikTok advertising measurement described in this policy. Declining or withdrawing that consent does not affect your access to the Service.

How We Share Information

We do not exchange your personal information for money. Advertising-related disclosures may nevertheless fall within legal definitions of "sale" or "sharing," as explained under "California Residents" below. We disclose information as follows:

• Service providers: With vendors who process data on our behalf, such as RevenueCat (subscription management), Sentry (crash and diagnostic reporting), and Google (analytics and fonts), under obligations to protect the information.
• TikTok: With your permission, the limited app-event, identifier, and technical information described under "Optional TikTok Advertising Measurement" is sent to TikTok for advertising measurement. TikTok's own uses and privacy choices are described in its Privacy Policy.
• App stores: The Apple App Store and Google Play process purchases under their own privacy policies.
• Agencies: If you request to join or are associated with an agency, that agency and its administrators may see information needed to manage your access, such as your name, email address, request status, membership status, role, and agency-specific email information. Authorized agency staff can also see the records you create in that agency's modules and any files you attach to them.
• Legal and safety: When we believe disclosure is reasonably necessary to comply with applicable law, regulation, legal process, or governmental request, or to protect the rights, property, safety, or security of Rappasoft, our users, or others, or to detect, prevent, or address fraud, security, or technical issues.
• Business transfers: In connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, information may be transferred as part of that transaction, subject to this Privacy Policy.
• With your direction or consent: When you ask us to share information or otherwise consent to its disclosure.

Data Retention

We retain information only for as long as necessary to fulfill the purposes described in this Privacy Policy, including to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Analytics data is retained in accordance with our Google Analytics configuration; subscription records are retained as long as needed to administer your subscription and to meet legal, tax, and accounting requirements. Account, agency membership, access-request, and synced app data are retained while your account is active or as otherwise needed to provide the Service, unless you request deletion and we are not required to keep it. Files you attach to an agency record are retained with that record and belong to the agency, so they remain available to authorized agency staff after you leave the agency or delete your account. When you delete your account (in-app or by request), your personal account data is permanently erased; agencies you belonged to may retain their own operational, personnel, training, evaluation, form, and audit records under a read-only "Former member" identity, with your email address removed or redacted. Content stored locally on your device persists until you delete it or uninstall the app.

For TikTok measurement, we store your advertising choice and local records needed to prevent duplicate events. Pending TikTok events are discarded when consent is withdrawn; cached events from an earlier app process are not replayed. Local consent and deduplication records may remain until app data is cleared or the app is uninstalled. TikTok handles data it has already received under its own retention policies and applicable law; changing your local choice does not recall that data. Contact us at anthony@rappasoft.com about access or deletion requests, or use TikTok's privacy-request options.

Data Storage, Security, and International Transfers

Local Storage

• Protocol content is stored locally on your device for offline access
• Your preferences are stored locally on your device
• If you are not signed in, your app data remains local to your device, except for subscription, diagnostic, analytics, optional advertising-measurement, support, and server-log information described above
• If you are signed in, selected app data is stored on our servers for sync, and a local copy remains on your device

Security

• Communications with our services and service providers use HTTPS encryption
• Synced app data is encrypted at rest in our application database
• We use reasonable administrative, technical, and physical safeguards designed to protect information

No method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You use the Service at your own risk.

International Transfers

We are based in the United States, and third parties we work with (including RevenueCat, Sentry, Google, and, if you opt in, TikTok) may process information in the United States and other countries. If you access the Service from Canada, the European Economic Area, the United Kingdom, or elsewhere, your information may be transferred outside your country, where data-protection laws may differ. Where required, we rely on appropriate safeguards for such transfers. The linked third-party privacy policies provide further information about their processing locations and safeguards.

Your Privacy Rights and Choices

All Users

• If you use the app without signing in, uninstalling the app or deleting app data removes the information stored locally on that device
• If you create an account, you can permanently delete it in the app: open the side menu, choose Account, then Delete Account. The flow explains the consequences, requires your password, and finishes with a confirmation. You can also contact us to request access to, correction of, or deletion of your account and synced app data
• Account deletion permanently erases your login (email and password), profile, synced app data, CE log, certifications, notification settings, sessions, and API tokens, removes you from every agency, and immediately frees your agency seats. Your email address becomes available for a new registration; a new account starts from scratch and is never reconnected to former agencies or records
• Agencies you belonged to may retain their own legitimate operational records — such as personnel, training, evaluation, form, and audit history — under a read-only "Former member" identity that has no login, email contact, permissions, or connection to any future account. Your email address is removed or redacted from retained agency records
• Deleting your account does not cancel a subscription purchased through the Apple App Store or Google Play; manage or cancel it through your store account
• Deleting your account or synced data does not automatically remove local copies that remain on devices where the app is installed
• You can control website analytics as described in "Cookies and Tracking Technologies" above, and decline or withdraw optional TikTok advertising measurement using the in-app controls under "Your TikTok Advertising Choices"
• You can contact us at anthony@rappasoft.com to make a privacy request

California Residents (CCPA/CPRA)

If you are a California resident, subject to applicable law, you have the right to know what personal information we collect, use, and disclose; to request access to or deletion of your personal information; to request correction of inaccurate information; to opt out of sale or sharing; and to not be discriminated against for exercising these rights.

We do not exchange personal information for money. The optional disclosure of device and advertising identifiers, app-event information, and IP-derived information to TikTok may constitute "sale" or "sharing" for cross-context behavioral advertising under California law. You can prevent these TikTok disclosures by leaving advertising measurement off, choosing Decline, or withdrawing consent in the app as described above. We do not knowingly sell or share the personal information of minors for these purposes. To exercise your rights or ask about information already disclosed, contact us at anthony@rappasoft.com.

Canadian Residents (PIPEDA)

If you are in Canada, you may request access to the personal information we hold about you and request corrections, subject to applicable law. We collect, use, and disclose personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

EEA and United Kingdom Residents (GDPR)

If you are in the European Economic Area or the United Kingdom, you may have the right to access, correct, delete, restrict, or object to our processing of your personal information, the right to data portability, and the right to withdraw consent. You also have the right to lodge a complaint with your local supervisory authority. To exercise these rights, contact us at anthony@rappasoft.com.

Children's Privacy

The Service is intended for EMS professionals and students and is not directed to children. We do not knowingly collect personal information from children under 13 (or under the age of majority in your jurisdiction). If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

Third-Party Services and Links

The Service relies on and may link to third-party services (including RevenueCat, Sentry, Google, TikTok, the Apple App Store, and Google Play). We are not responsible for the privacy practices or content of these third parties, and their use of your information is governed by their own privacy policies. We encourage you to review them.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after the changes take effect constitutes acceptance of the revised Privacy Policy.

Reading or accepting this policy, or continuing to use the Service, does not by itself grant consent to optional TikTok advertising measurement. That choice is made separately in the app.

Contact Us

If you have questions or requests regarding this Privacy Policy or our privacy practices, please contact:

Rappasoft LLC
Email: anthony@rappasoft.com