Privacy Policy for the Spike App
Version 1.0 – effective as of 25 October 2026
Controller for the processing described in sections 3, 4, 8 and 9: Secron AB, Swedish company registration number 559435-2816, Stämånavägen 10, SE-443 39 Lerum, Sweden ("Secron", "we", "us"). Email: sales@secron.se.
This Privacy Policy applies to the Spike app for Windows, Android and iOS, the cloud service behind the app and the Spike instruments (together the "Service"). It does not apply to Secron's other activities. The policy complements the End User License Agreement (EULA) at https://www.secron.se/eula-english/ Terms such as Customer, Leader, Administrator, Participant, Observer, Exercise and Instrument have the same meaning as in the EULA.
The Swedish version is the original. This English translation is provided for convenience. In the event of any discrepancy, the Swedish version at https://www.secron.se/integritetspolicy/ prevails.
Summary
Two controllers. Your organization (the Customer) is the controller for what happens in an Exercise, for example your positions. Secron stores and processes that data on the Customer's behalf as a processor. Secron is itself the controller for account administration, licenses, support and security in the Service.
Active Participants are location-tracked during an ongoing Exercise, including in the background. The Exercise's Leader sees the positions in real time and afterwards. You can stop the tracking at any time (section 6).
All data in the Service is stored and processed within the EU at Google Cloud. Only when map imagery is fetched does your device contact map providers that may be located outside the EU (section 10).
No advertising, no sale of data, no analytics or tracking tools in the app.
Your rights are described in section 13. Questions about Exercise Data go to your organization; all other questions to sales@secron.se. You may complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.
1. Who is responsible for your personal data?
1.1 Two roles. Spike is used by organizations – fire and rescue services, training providers and companies – to train their staff. Who is the controller depends on the processing concerned:
Processing
Controller
Secron's role
Exercise Data: positions, track logs, participant names, roles, the Leader's actions during the Exercise, instrument history, after-action review (sections 5–7)
The Customer
Processor
Account and license administration for Leaders and Administrators (section 3)
Secron
Controller
The organization's contact person in the app (section 4)
Secron
Controller
Support, security, operational logs, records of acceptance of terms (section 8)
Secron
Controller
1.2 Exercise Data. For data processed in an Exercise, the Customer – normally your employer or training provider – determines the purposes and the legal basis. Secron processes such data only on the Customer's instructions and under the data processing agreement in force between the Customer and Secron. Questions about, or objections to, the processing in an Exercise should therefore primarily be directed to the Customer, for example via the Exercise's Leader or the organization's data protection contact. Sections 5–7 nevertheless describe the processing so that you, as a Participant or Leader, know what happens.
1.3 Contact. Questions about this policy or about data protection in the Service: sales@secron.se, or by post to the address above.
2. What is personal data?
Personal data is any information that can directly or indirectly be linked to a living person, for example a name, an email address, a technical account ID or a GPS position that can be linked to you. Processing is anything done with the data, such as collection, storage, display and deletion. "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council.
3. Leaders and Administrators – account data
3.1 What data. For you as an account holder, Secron processes:
email address (used as username), display name and phone number (optional);
organization, role (Leader or Administrator), account status (active/suspended), any quota for the number of Exercises and the number of Exercises created;
when and by whom the account was created, and the time of your last sign-in;
the version and time of your acceptance of the terms of use and this policy;
authentication data at Google Firebase Authentication: your password in hashed form (Secron never sees your password), session keys, and the emails sent when you request a password reset.
3.2 Source. The account is created by the Customer's Administrator or by Secron. You can change your display name and phone number under Settings. The time of last sign-in and acceptance of terms is recorded by the app.
3.3 Purposes and legal basis.
Purpose
Legal basis
Provide you with sign-in and the correct permissions in the app, and provide the Service to the Customer
Performance of the contract with the Customer; in relation to you as an employee of the Customer, our legitimate interest in performing that contract (Article 6(1)(f) GDPR)
Administer licenses, seats and quotas in the Service
Performance of a contract (Article 6(1)(b)) and legitimate interest (Article 6(1)(f)) respectively
Security: suspend accounts, revoke sessions, detect and investigate misuse and intrusion
Legitimate interest (Article 6(1)(f)) in a secure service for all customers
Support and troubleshooting
Legitimate interest (Article 6(1)(f)) and performance of a contract
Being able to show which terms you have accepted
Legitimate interest (Article 6(1)(f)) in being able to evidence contractual terms
The data is necessary for the account to exist. No account can be created without an email address; the phone number is optional.
3.4 Who sees the data. The Customer's Administrators see the accounts in their own organization. Secron's staff see the accounts of all organizations for license and support purposes. Google processes the data as a sub-processor (section 10).
3.5 Your own control. Under Settings you can change your display name and phone number, change your password and delete your account. Deletion is permanent: the account data and the sign-in are removed. Exercises you have created remain with the Customer, but only with a technical account ID that can no longer be linked to your account data. Administrator accounts are deleted by another Administrator.
4. The organization's contact person in the app
4.1 What data. The Customer's Administrator can enter a contact person for the organization in the app: name, email address and phone number. Secron may also keep short internal notes about the organization's license in the app (for example when the license is due for renewal and who the contact is).
4.2 Source. The Customer's Administrator or Secron, based on the agreement with the Customer.
4.3 Purposes and legal basis. Administering the organization's license in the Service and contacting the organization about the Service – operational information, changed terms, support (performance of the contract with the Customer, Article 6(1)(b), and legitimate interest, Article 6(1)(f), in managing the agreement). The data is seen by the Customer's own Administrators and by Secron's staff.
5. Participants and Observers – Exercise Data
The Customer is the controller for the processing in this section (see section 1.2). The description is provided here so that you know what happens.
5.1 What data. When you join an Exercise, the following is processed:
an anonymous technical account ID created by the app on your device (no name, no email address);
an installation ID consisting of the device model and a random number, stored on your device, so that the Leader can recognize the same device again;
the name or call sign you enter in the lobby (optional – the field is pre-filled with "Participant" and a sequence number), the selected participant type (active or Observer), the selected role (e.g. firefighter or officer) and whether you have marked yourself as ready;
the time you joined and which version of the terms your device has accepted;
for active Participants: your position in real time and a track log of positions and times during the Exercise (section 6);
derived data in the after-action review: when you were inside the simulated zones, for how long, and the simulated exposure this corresponded to. These values are the output of the Exercise simulation and say nothing about your real health or exposure.
Observers are never location-tracked and have no track log.
5.2 Why. The Customer uses the data to run the Exercise (show you on the Leader's map, control the scenario) and to evaluate and follow up the Exercise afterwards with those who took part. The Customer determines the purposes and the legal basis. For municipal fire and rescue services the basis is normally a task carried out in the public interest (Article 6(1)(e) GDPR) within the duty to train under the Swedish Civil Protection Act (2003:778); for other organizations normally a legitimate interest (Article 6(1)(f)). The processing is not based on your consent, and accepting the terms in the app is not consent within the meaning of the GDPR but a confirmation that you have received the information.
5.3 Who sees the data. The Exercise's Leader sees your position in real time and can replay the Exercise afterwards. The Leader may choose to let Participants see each other's current positions during the Exercise (not the history). Secron's staff have access to Exercise Data only for operations, support and troubleshooting on the Customer's behalf. Google processes the data as a sub-processor (section 10).
5.4 For how long. The Customer decides. Exercise Data remains until the Leader deletes the Exercise in the app (only ended Exercises can be deleted) or until the Customer's agreement with Secron ends, after which Secron deletes Customer Data within 90 days. Ending an Exercise – manually or automatically 24 hours after it was created – does not delete the data.
5.5 Traces the Leader leaves. The Leader's actions during the Exercise – placing and moving the virtual release, changes to wind and intensity, what the Participants were allowed to see and when, drawn layers – are logged with timestamps and form part of the Exercise Data. The Leader's account ID is linked to the Exercise. This data is also processed on the Customer's behalf.
6. Location tracking in detail
6.1 When. Tracking starts when you have joined an Exercise as an active Participant and the Exercise is running, and continues until the Exercise ends or you leave it.
6.2 How. The app reads the device's location service, smooths the readings and records your position approximately every two seconds. Your current position is sent to the Service in real time; the track log is sent in batches approximately every 20 seconds. If there is no network, the points are stored temporarily on the device and sent when the network returns. Tracking continues when the screen is off or the app is in the background: on Android via a visible notification (foreground service), on iOS via the system's background location indicator.
6.3 Permissions. The app asks for location permission ("while using the app" is sufficient) and, on Android, permission to show the notification. Camera permission is used only to read QR codes; the images are processed locally and are not stored.
6.4 How to stop. Leave the Exercise in the app, close the app, or revoke the location permission in the device settings. Tracking also stops when the Leader ends the Exercise or when it ends automatically (at the latest 24 hours after it was created). If you stop, the Leader cannot see you on the map or in the after-action review. If you want to take part without being tracked, you can join as an Observer.
6.5 The Leader's own position. When a Leader creates an Exercise, the app may read the Leader's position once to center the map. The position is not stored unless the Leader chooses to place the virtual release there.
7. Instruments
A Spike Instrument that is switched on sends its serial number, GPS position and battery level to the Service over the mobile network, normally every two to five seconds. The Service stores the Instrument's latest position and time and, during an ongoing Exercise, also a history of position, time and simulated value. The data relates to the Instrument, but if a person carries it, it may indirectly show where that person has been; it is therefore part of the Exercise Data for which the Customer is responsible. The Instruments have no microphone, camera or real sensors and collect nothing about their surroundings. The mobile network operator processes traffic data for the Instrument's SIM card as an independent controller.
8. Support, security, operational logs and acceptance of terms
8.1 Support. When you contact the app's support at sales@secron.se, we process your name, email address, the content of your request and any attachments in order to help you (legitimate interest, Article 6(1)(f), and performance of a contract). Please do not send sensitive data to support.
8.2 Security and operational logs. The cloud service logs technical events – timestamps, account and exercise identifiers, error messages and IP addresses in the infrastructure logs – for operations, troubleshooting, and to detect and investigate intrusion and misuse (legitimate interest, Article 6(1)(f)). Account suspension revokes active sessions.
8.3 Command queue. Actions that require server-side processing (creating an Exercise, managing accounts) are queued temporarily with your account ID; the content is deleted when the action is complete and the queue entry no later than 24 hours afterwards.
8.4 Acceptance of terms. For Leaders and Administrators, the version and time of acceptance are recorded on the account. For Participants, the version and time are stored on the device, and the version is written to the Exercise's participant list. The purpose is to be able to show which terms applied (legitimate interest, Article 6(1)(f)).
9. Data stored locally on your device
The app uses no cookies and contains no third-party analytics, advertising or tracking tools. The following is stored locally on the device:
Data
Who
Why
Removed
Remembered email address ("Remember me") in the operating system's protected storage (Keychain, Keystore, Windows Credential Manager)
Leader/Administrator
Pre-fill the sign-in form
When you turn off "Remember me" or uninstall the app
Sign-in session
Leader/Administrator
Keep you signed in
When you sign out
Installation ID
Participant
Recognize the device in Exercises
When you uninstall the app or clear the app's data
Anonymous account ID
Participant
Rejoin the same Exercise
When you uninstall the app or are signed out at the end of the Exercise
Accepted terms version and time
Everyone
Avoid asking for acceptance every time
When you uninstall the app or clear the app's data
Queue of track points not yet sent
Participant
Avoid losing the track log during network outages
As soon as the points have been sent
Map settings and map session keys
Everyone
Selected map type, faster map loading
When you uninstall the app or clear the app's data
Cached addresses of the terms and the support address
Everyone
Work without a network
When you uninstall the app or clear the app's data
10. Recipients, sub-processors and transfers outside the EU/EEA
10.1 Secron never sells personal data and shares it only with the recipients listed here, and with public authorities where required by law.
Recipient
What
Where
Safeguard
Google Cloud EMEA Limited / Google LLC – Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Logging
All data in the Service (accounts and authentication, Exercise Data, instrument data, logs)
EU (Belgium/Netherlands)
Data processing agreement with Google (Google Cloud Data Processing Addendum); storage and processing within the EU
Google Maps Platform (Map Tiles API), when a map key is used
IP address, the map area being displayed, session key
Global, including the USA
Google's terms and privacy policy; European Commission standard contractual clauses / EU–US Data Privacy Framework
Esri, Inc. – World Imagery
IP address and the map area being displayed (satellite imagery)
USA
European Commission standard contractual clauses / EU–US Data Privacy Framework where applicable
OpenStreetMap Foundation
IP address and the map area being displayed (road map)
United Kingdom/EU
European Commission adequacy decision for the United Kingdom
SMHI (Swedish Meteorological and Hydrological Institute)
Coordinates of the exercise location and IP address when fetching the weather forecast
Sweden
Processing within the EU
OpenWeatherMap Ltd, only if selected as weather provider
Coordinates of the exercise location and IP address
United Kingdom
Adequacy decision
MSB RIB (Swedish Civil Contingencies Agency), only if the integration is enabled
Substance lookups (UN numbers) and IP address
Sweden
Processing within the EU
Apple (App Store, TestFlight) and Google (Google Play)
Downloads, updates and operating-system-level crash reports under their terms and your settings
According to the respective provider
Independent controllers
Mobile network operator for the Instruments' SIM cards
Traffic data
According to the operator
Independent controller
10.2 Transfers outside the EU/EEA. All data in the Service – accounts, authentication, Exercise Data, instrument data and logs – is stored and processed within the EU. Data leaves the EU/EEA only when your device fetches map imagery directly from the map providers listed above (IP address and map area). This is based on Chapter V GDPR: a European Commission adequacy decision (the United Kingdom; the EU–US Data Privacy Framework for certified US recipients) or the European Commission's standard contractual clauses. Copies of the safeguards can be requested from sales@secron.se.
10.3 Sub-processors on the Customer's behalf. For Exercise Data, Google is Secron's sub-processor. The Customer is informed of new sub-processors in accordance with the data processing agreement.
11. How long do we keep the data?
Data
Retention period
Account data for Leaders and Administrators
For as long as the account exists. Deleted when the account is removed by you, by the Customer's Administrator, or by Secron when the agreement ends
Records of acceptance of terms
For as long as the account exists and thereafter for as long as needed to show which terms applied, but no longer than ten years
The organization's contact person and license notes
For as long as the organization exists in the Service
Exercise Data (Customer is controller)
Until the Leader deletes the Exercise, or at the latest 90 days after the Customer's agreement has ended, unless the Customer instructs otherwise
The Instruments' latest position
Overwritten at the next report; removed when the Instrument is deregistered
Support requests
Normally no longer than 24 months after the request has been closed
Command queue
Content deleted when the action is complete; the entry no later than 24 hours afterwards
Operational and security logs
Normally 30 days; longer if needed to investigate an incident
Data stored locally on the device
See section 9
When the retention period has expired, the data is deleted or anonymized. Backups are deleted in accordance with Secron's ordinary routines.
12. How do we protect the data?
All communication between the app, the Instruments and the cloud service is encrypted (TLS); data is also encrypted at rest at Google.
Server-side access rules restrict each account to its own organization, its own Exercises and its own position. Zones, timeline and instrument history are written only by the server.
Participants are identified by anonymous technical accounts without name or email address.
Passwords are handled by Firebase Authentication in hashed form. Account suspension revokes active sessions.
The app contains no third-party analytics, advertising or tracking tools.
Secron's staff access Customer Data on a least-privilege basis and only for operations, support and troubleshooting.
If a personal data breach concerning Customer Data occurs, Secron informs the Customer without undue delay so that the Customer can fulfil its obligations under Articles 33–34 GDPR. Breaches concerning data for which Secron is the controller are reported to IMY where required.
13. Your rights
13.1 Under the GDPR you have the right to:
access the personal data we process about you and information about the processing (Article 15);
have inaccurate data rectified (Article 16);
have data erased in certain cases, for example when it is no longer needed (Article 17);
have the processing restricted in certain cases (Article 18);
receive the data you have provided in a machine-readable format and transmit it to another controller (data portability, Article 20), where the processing is automated and based on a contract or consent;
object to processing based on legitimate interest (Article 21) – we then continue only if we have compelling legitimate grounds that override your interests;
withdraw any consent you have given at any time, without affecting the lawfulness of processing carried out before the withdrawal.
13.2 How. For account data, the organization's contact person and support (where Secron is the controller): email sales@secron.se. We may need to confirm your identity, for example by you writing from the email address linked to the account. We respond within one month; if the request is complex, the period may be extended by two months, in which case we will let you know. For Exercise Data (where the Customer is the controller): contact your organization. Secron assists the Customer in fulfilling your request in accordance with the data processing agreement.
13.3 Self-service in the app. Leaders and Administrators can correct their name and phone number and delete their account under Settings. Participants can stop the tracking at any time (section 6.4).
13.4 Complaints. You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, SE-104 20 Stockholm, Sweden, https://www.imy.se, or with the supervisory authority in the EU country where you live or work.
14. Children
Spike is not directed at children and is intended for persons aged 18 or over. If a Customer allows younger persons to take part in an Exercise, for example in youth programs, the Customer is responsible for ensuring that this is permitted and that the necessary approvals from legal guardians are in place. Secron does not knowingly collect data about children for its own purposes.
15. Automated decision-making and profiling
Secron makes no automated decisions that produce legal effects or similarly significantly affect you, and does not profile you. The simulation in an Exercise computes zones and simulated values from positions, but it is the Customer and the Leader who draw conclusions in the after-action review.
16. Changes to this policy
We may update this policy, for example when the Service or the law changes. The current version is always available at https://secron.se/legal/privacy/en. In the event of material changes, the app asks you to accept the new version before you continue, and the Customer's contact person is informed at least 30 days before the change takes effect. The version history below shows what has changed.
17. Contact
Secron AB
Company registration number 559435-2816
Stämånavägen 10, SE-443 39 Lerum, Sweden
Email: sales@secron.se
Web: https://secron.se
End User License Agreement (EULA) for the Spike app: https://www.secron.se/eula-english/
Swedish version of this policy (governing): https://www.secron.se/integritetspolicy/
Version history
Version
Date
Change
1.0
2026-10-25
First version.