Privacy Policy

Tactical Panda is an independent, non-commercial project run by an individual volunteer in the Great State of Texas, United States. It is not a company and is not affiliated with FIRST®. Contact: privacy@tacticalpanda.app.

FIRST®, FIRST® Robotics Competition, FIRST® Tech Challenge and FIRST® LEGO® League are trademarks of FIRST® (For Inspiration and Recognition of Science and Technology), which is not overseeing, involved with, or responsible for this website. LEGO® is a trademark of the LEGO Group.

Your account. When you sign up we store your email address, display name, and (if you sign in with Google) your profile photo. Authentication is handled by Firebase Authentication.

Terms acceptance. We record the terms and privacy notice versions shown to you, the eligibility declaration you make, and the time you accept the terms. This records your declaration, not verified age or verified parental consent. These records are included in your account export and deleted with your account. We do not collect a date of birth or identity document for this declaration.

Event membership. When you create or join an event we store your role at that event and, if someone invites you by email, the invited email address so the invitation can find you when you sign in.

Event content. Schedules, run-of-show scripts, tasks and assignments, branding settings, uploaded images, and check-in configuration created by event organizers are stored for the event. Access to records in the app depends on event membership and role; image delivery and exported materials are described below.

Premium requests. If you ask us for premium status or premium tokens, we store your request - your note, the event it concerns, your account ID and email address, and its status - so we can respond and arrange any invoice. Premium token balances and history are tied to your account. The account and email fields of a request are cleared, and your token records are deleted, if you delete your account; a request that names an event is deleted with that event.

Problem reports. The account menu used to have a “Report a problem” form; it has been replaced by Feedback (below). For reports sent with it we keep your description, the page you were on, the app version, your browser details, your account ID and email address, and whether we may contact you; they are included in your account export, and if you delete your account a report is kept without your account ID, email address or browser details. Any screenshot attached to a report is being deleted from our image host (ImageKit); your export says whether a report had one but does not include the image.

Feedback. If you use the “Feedback” button, we store your category and description, the title and address of the page you were on (never the part of the address after “?”), the app version, your screen size and browser details, your account ID and email address, the name you typed (optional), and whether we may email you about it. You may attach up to five screenshots, captured from the page or uploaded, with any marks you draw on them; they are stored as private files on our image host (ImageKit) that only our team can view, and are deleted when the suggestion is completed or deleted, or when you delete your account. Suggestions are in your account export, and if you delete your account a suggestion is kept without your account ID, email address, name or browser details.

Service and security records. We also process authentication and verification records, activity timestamps, device enrollment and access records for offline check-in, rate-limit counters (stored under one-way hashed keys), email delivery records (see “Email and newsletter”), and audit records of administrative actions. These support sign-in, abuse prevention, access control, troubleshooting, and data-management requests. Check-in audit records and rate-limit counters are set to expire after a short period (audit records after about 90 days; email-operations audit records after about a year). That expiry relies on a database setting applied separately from the app, so records can outlast these targets. Messages you send us are used to respond to your request.

Volunteer check-in is offered only for events held in the United States.

Event organizers may upload a volunteer roster (a CSV export from their volunteer management system) to run check-in. For each volunteer we store their name, assigned roles, shifts, and a log of check-in times. Depending on the uploaded roster, records may also include a preferred name, pronouns, a minor-status flag, languages, youth-protection screening or training status, shirt size, team and organization affiliations, employer, and alumni status. Check-in can also store notes, answers to organizer-defined prompts, and the account responsible for an action. Organizers should only provide information needed for the event and should not put unnecessary sensitive details in free-text fields.

Contact details in roster imports. The importer reads the CSV in your browser. It sends volunteer email addresses and phone numbers, or a name fallback when those are absent, to our server to compute an event-specific keyed fingerprint. The saved roster contains that fingerprint rather than the original contact fields. Emergency-contact and accommodation columns are excluded from the saved roster and are not inputs to this fingerprint. The fingerprint helps match records across imports; it does not make the named roster anonymous. These import restrictions do not prevent someone from entering personal information in notes, prompt answers, or other free-text content.

Kiosks. When a signed-in person starts a kiosk, the service creates a temporary device account tied to that one event, separate from anyone’s personal account. It can only use that event’s check-in screens and sees the limited roster view. We record which account started it. The device account is deleted when the kiosk is exited or revoked, and it stops working after 16 hours in any case. Volunteers who check in at a kiosk do not need an account.

Minors on rosters. Accounts are only for people who are 18 or older. Volunteer rosters may include minors, whose information is provided by the event organizer. Check-in staff and kiosks see only a minor’s last initial, not their full last name. Organizers must get parental consent where it is required.

Account emails. We send the emails needed to run your account: verification codes and links, password resets, the confirmation codes for deleting your account or exporting your data, an encrypted copy of an export you request, and replies to requests such as a premium request. These are not marketing, and unsubscribing from the newsletter does not stop them.

Newsletter. We send the newsletter only if you sign up on the newsletter page, tick the consent box, and confirm from the email we send you. Having an account, being on a volunteer roster, or being invited to an event never subscribes anyone. For a signup we store your email address, the consent wording you agreed to, when you asked and when you confirmed, and your status. If you sign up but never confirm, you receive no newsletter, and we keep the address until you confirm, unsubscribe, or ask us to delete it. Every newsletter has an unsubscribe link, and one-click unsubscribe for mail apps that support it. When you unsubscribe we delete your address and keep only a one-way hash of it, the reason, and dates, so that you are not emailed again by mistake. If you sign up again with fresh consent, that record is replaced.

Delivery records. For each email the service sends we keep a short record: the recipient address, the kind of message, when it was sent, and whether it was accepted, delivered, or bounced. It does not contain the message text, codes, or links. These records are set to expire about 90 days after the message is finished, and they are deleted if you delete your account. As noted above, that expiry relies on a database setting applied separately from the app.

Bounces and replies. We read delivery-failure reports sent to our sending mailbox. An address whose newsletter permanently fails, or fails repeatedly, is removed from the newsletter. Reports we cannot match to a message we sent are filed for a person to review; the review entry holds a date and a reason, not the message. Messages sent to our mailboxes, such as a reply asking to unsubscribe, can be read by a person and stay in the mailbox until we clear them out.

Invoices and receipts. If we send an invoice or receipt notice, we keep a record of it (its type, number, amount and currency, when it was sent, the premium request or event it concerns, and the account it was addressed to) for as long as we need it for accounting and legal purposes. The record does not contain your email address. If you delete your account, that record is kept but unlinked from your account.

Tactical Panda does not set cookies. To make the app work, it stores information in your browser’s local storage, session storage, IndexedDB and (on coaches packet pages only) a service worker cache, and only to sign you in and keep your session secure, remember settings you choose, save your work, run offline check-in, and let a coaches packet open offline. We do not use this storage, or any other technology, for analytics, advertising, or tracking you across websites, and we do not let other companies do so through our pages.

Security check. The sign-up, login, forgot-password, and newsletter forms use Cloudflare Turnstile to check that you are a person and not an automated program. To do this, Cloudflare receives your IP address and technical information about your browser and connection. Cloudflare states that it uses this information to detect bots and improve its bot detection, not to identify, profile, or target you; see the Cloudflare Turnstile privacy addendum. Our hosting provider may set a short-lived security cookie if it needs to check that traffic comes from a real browser, for example during an attack.

Google sign-in. If you sign in with Google, Google sets its own cookies in the sign-in window; those are governed by Google’s privacy policy.

Offline check-in. To keep check-in working on unreliable venue Wi-Fi, the app may keep a temporary copy of the permitted roster fields and pending check-ins in an encrypted offline copy in IndexedDB. Pending check-ins are sent to the service when you synchronize.

Your choices. You can object to this storage at any time, free of charge: change or reset any setting in the app, or clear this site’s data in your browser settings, which removes everything listed above from that browser. Doing so signs you out and removes any offline check-in data or unsaved schedule drafts on that device. Logging out locks encrypted offline copies but does not delete them, so unsynced work can be recovered. Preferences and some other local data may also remain after logging out. Older versions may have left unencrypted check-in snapshots; snapshots with pending work can remain until migrated or removed. Clear site data on shared devices when it is safe to discard any unsynced work. Downloaded files and printed copies are not removed by logout or by clearing browser storage.

If we ever want to store or read information on your device for anything other than the purposes above, such as analytics, we will ask for your consent first and update this policy.

Google Firebase provides authentication and database storage. The app uses database rules and server-side access checks to restrict event records by membership and role. Check-in staff and kiosk sessions receive a limited view of the roster; event managers and the Volunteer Coordinator can access more fields. The service operator and infrastructure providers may process information to operate, maintain, secure, and support the service. Team and event information comes from official FIRST APIs. Our server may briefly keep an answer in memory, for up to two minutes, so repeated requests do not ask FIRST again; it is not saved to a database or file. Information incorporated into saved schedules or other event content may be retained with that content.

Hosting and email delivery providers process requests and email. That includes verification and account-management emails, an encrypted copy of a requested account export when email delivery is configured, and the newsletter for people who signed up for it. ImageKit stores and delivers event-branding images when that feature is used. Image delivery URLs should not be treated as confidential or protected by event membership; do not upload private documents or sensitive personal information as branding images. ImageKit also stores screenshots attached to suggestions, as private files reachable only through short-lived signed links, until the suggestion is completed. Cloudflare provides the security check on our sign-up, login, forgot-password, and newsletter forms, as described in “Cookies and data stored on your device”.

Fonts are served from our own site. Requests to external services, such as those above, can disclose your IP address and browser/request information to the provider. Signing in with Google uses Google’s sign-in service. Service providers may process technical records for delivery, security, and diagnostics. We may also disclose information where legally required, to enforce our Terms of Service, or to protect people or the service. Event organizers are responsible for copies they download, print, or share outside the app.

Where processing happens. Our providers may process information in the United States and in other countries where they operate, and we do not promise that data stays in any particular country. If you use Tactical Panda from elsewhere, your information can be transferred to and processed in those places.

Volunteer check-in data has event-based access deadlines and a scheduled deletion date, as described below.

Access windows. Check-in staff and check-in kiosks can use the roster until 5 days after the event ends. The Event Director, Event Admins, and the Volunteer Coordinator can access it until 30 days after the event ends.

Scheduled deletion. After an access window closes, the underlying data is locked against ordinary event access rather than immediately deleted. For events with a known end date, the app schedules roster deletion for 120 days after the event. Event managers can extend their own access twice, 30 days at a time, directly in the app; further extensions require administrator approval and cannot extend access past the scheduled deletion date. Deletion is carried out by a background process; a scheduled date is not confirmation that physical cleanup has completed. If the event end date is missing, fallback dates based on the import apply; check the event’s data-handling panel for its dates.

Deleting the event. If an Event Director deletes the event, the service deletes its database records, including the roster and check-in records, as part of that operation. Related cleanup, such as removing externally hosted images, is recorded and retried if it fails. Deletion from the service does not remotely erase downloaded, printed, or disconnected offline copies, and images that were already delivered may remain in browser or content-delivery caches for a time.

Authorized event managers can remove roster data through the check-in tools. Account information, preferences, and acceptance records are kept while the account exists and are included in account deletion. Event content has a separate lifecycle and can remain for other event members. Minimal account-deletion status and key-destruction records remain to prevent deleted accounts or data from being restored through the app. Invoice and receipt records are kept for accounting but unlinked from a deleted account, and the newsletter opt-out record described above keeps only a one-way hash. Contact us about information that is not covered by the self-service controls.

Suspended or ended accounts. If we suspend or end an account under the Terms of Service for abuse, a security risk, or legal reasons, we may keep the minimum information needed to enforce that decision and to stop the same person from returning, such as the email address and the reason, for as long as that purpose lasts. Data-protection law may limit this, and we will consider a deletion request in that light.

Wherever you live, you can contact us to request access, a copy, correction, or deletion of your personal information. Depending on the law that applies, you may also have rights to restrict processing, object to particular uses, receive portable data, withdraw consent where processing relies on consent, and complain to a data-protection authority. Rights can have legal conditions and exceptions; these tools do not limit your statutory rights.

Access and portability. Signed-in users can download an export of their account profile, saved-event index, memberships, join requests, invitations, preferences, and acceptance records, plus the invoice and receipt notices addressed to them, their newsletter consent record, and a list of the emails we sent them (type, status, and times, not the content), from the account page (“Download your data”). The export is generated automatically after you confirm the request with a one-time code sent to your email, and is delivered as a machine-readable JSON file inside a ZIP archive protected with AES-256 encryption. The archive password is shown to you once, in the app only - it is never stored or emailed. This automated export does not include every record that might mention you, such as volunteer rosters, free-text event content, or all operational logs. Contact us for a broader access request or if you believe something is missing.

Deletion. You can request account deletion from the account page, confirmed with a recent sign-in and an emailed one-time code. If you are the Event Director of an event you created, the self-service flow first requires you to delete that event, because the app does not currently let you hand it to another director; contact us if you need help or wish to make a privacy-rights request. Once deletion is accepted for processing, the app blocks account access and starts cleanup, with a target of 30 days. Cleanup can require retries. The workflow removes account records, email delivery records, and selected account-attribution fields from shared content; it does not automatically find every mention of your name in free text or a separate volunteer roster. Tell us about such records so they can be reviewed as part of your request.

Correction. You can edit your display name and manage your sign-in details in Settings. Your email address cannot be changed in the app. Contact us to correct that, or anything else you cannot change yourself.

No sale or advertising-related sharing. We do not sell personal information or share it for cross-context behavioral advertising as part of operating Tactical Panda. This does not mean information is never disclosed: the service-provider and event disclosures above still apply. We do not discriminate against anyone for exercising their privacy rights.

Volunteers. If you appeared on a volunteer roster but don’t have an account, the event organizer who uploaded the roster determines its event use. Contact them or us and we will help locate and address your request about the record. You do not need an account to make a request.

We may need to verify your identity before disclosing or deleting information. We respond within the period required by applicable law: generally one calendar month for GDPR requests, or 45 calendar days for CCPA and similar US state-law access, correction, and deletion requests where those laws apply. Where a lawful extension is necessary, we will explain it within the initial response period. If a request is refused or limited, we will explain the reason and applicable complaint options, and you can reply to ask us to reconsider. You may complain to your relevant privacy regulator, including an EU supervisory authority, the UK ICO, Australia’s OAIC, or a US state attorney general, as applicable.

Accounts are for adult event organizers and operators who are at least 18 and have reached the legal age of adulthood where they live. Minors may not create or use an account, including with parental permission. We ask account holders to declare that they meet this requirement; this declaration is not verified proof of age. Younger volunteers can participate through their event organizer without an account.

Volunteer rosters may include young people who do not have an account (see “Minors on rosters” above). Organizers must have a lawful basis to provide their information, give appropriate privacy notices, and obtain parental authorization where required. Account age restrictions do not remove these responsibilities. If you believe an underage account or a child’s information has been provided improperly, contact privacy@tacticalpanda.app so we can investigate and take appropriate steps, including restricting access or deleting data.

If we change this policy we will update this page and the date at the top. For material changes we will ask account holders to review and accept the new version in the app, as the Terms of Service describe.

Questions, privacy rights requests, or deletion requests: privacy@tacticalpanda.app.