Terms of Use & Security Policy

Applies to ICP Desk v0.17.1. See what changed in this version.

ICP Desk is software that helps teams organize incident information, rosters, and ICS forms. It is provided by its volunteer maintainer (the “Operator”) and used by organizations and individuals (“Users”). By signing in or using ICP Desk you agree to this policy. If you do not agree, do not use it.

1. Not an emergency system

ICP Desk is a planning and record-keeping aid. It is not an emergency notification, dispatch, or life-safety system and must never be the only way you receive or send critical information. Always follow your agency’s official procedures, keep your own backups of anything important, and verify information (assignments, medical details, frequencies, accountability) before acting on it. It may be unavailable, delayed, or wrong at any time.

2. Provided “as is”, without warranty

ICP Desk is provided “as is” and “as available.” The Operator makes no warranty of any kind, express or implied, including accuracy, reliability, availability, fitness for a particular purpose, or that exported forms meet any agency, state, or federal requirement. Generated ICS forms and exports must be reviewed by a qualified person before use or submission.

3. Limitation of liability

To the fullest extent permitted by law, the Operator and anyone who contributes to ICP Desk will not be liable for any direct, indirect, incidental, special, consequential, or punitive damages, or for any loss of data, loss of records, injury, property damage, or operational decision, arising from the use of, or inability to use, ICP Desk, even if advised of the possibility. Where liability cannot be excluded, it is limited to the amount you paid to use ICP Desk (which, for most Users, is nothing).

4. Your responsibilities

  • You are responsible for everything done under your account and for the accuracy and legality of the information you enter. Do not share your password; use a unique password of at least 15 characters.
  • Organizations are responsible for who they invite, for the roles and permissions they grant, and for removing members who should no longer have access.
  • Only enter personal, medical, or license information that you are authorized to collect, that is needed for the incident, and that the person has agreed to share. Follow your agency’s privacy, records, and retention rules and any laws that apply to you (for example public-records, privacy, and health-information rules).
  • Do not enter real incident or personal data into training or demonstration incidents.

5. Prohibited conduct

You may not:

  • access, view, change, or delete data that belongs to another organization or person without permission;
  • attempt to bypass login, permissions, organization separation, rate limits, or other protections;
  • probe, scan, overload, or interfere with the service, or run automated attacks against it;
  • upload malware or content you do not have the right to share;
  • use ICP Desk to harass, defraud, stalk, or harm anyone, or for any unlawful purpose;
  • impersonate another person or misrepresent your role or qualifications.

6. Reporting a security problem — your duty

If you find, suspect, or accidentally trigger a security flaw or data exposure, you must:

  1. Report it to the Operator as soon as possible, and in any case no later than 24 hours after you become aware of it, using the contacts in section 7. Do not wait to be sure.
  2. Stop as soon as you realize you can see something you should not. Do not keep exploring, copy, download, change, or delete data, and do not use the flaw again after confirming it exists.
  3. Keep it confidential. Do not tell others, post it publicly, or share a way to exploit it until the Operator confirms it is fixed or 90 days have passed with no response.
  4. Delete any data you came across that is not yours, and tell us what you saw so affected people can be notified.
  5. Never include real incident, personnel, or license data in your report.

If you are an organization administrator and believe an account was compromised (lost device, shared password, unfamiliar activity), report it immediately and reset the affected password, which signs that account out everywhere.

Failing to report a known vulnerability, hiding one, or exploiting one for any reason other than reporting it is a violation of this policy and may lead to account removal and, where the law allows, legal action.

7. How to report

  • Email sherwin7376@outlook.com with the subject ICP Desk security report.
  • Or use GitHub private vulnerability reporting on the ICP Desk repository (Security tab → Report a vulnerability).

Please include what you found, how to reproduce it, the version shown in the sidebar, and whether another organization’s data was involved. We aim to acknowledge reports within 3 business days and assess them within 7 days. This is a volunteer project, so those are targets, not guarantees. Reporters are credited unless they ask not to be.

8. Good-faith research safe harbor

If you follow section 6 — report promptly, stop once you have confirmed an issue, avoid data that is not yours, do no damage, and keep it confidential until fixed — the Operator will treat your actions as authorized and will not pursue action against you for them. This safe harbor does not cover data theft, extortion, service disruption, social engineering of people, or anything outside good-faith testing. It does not bind other organizations or third parties.

9. Monitoring and audit logs

To protect Users and keep the service accountable, ICP Desk records sign-ins, permission and role changes, shares, exports, and administrator “support access” sessions, along with the account, time, and network address involved. Platform administrators may view an organization only through logged support access, used to give help or investigate a problem. By using ICP Desk you consent to this logging. Logs may be provided to organization administrators, to protect the service, or when required by law.

10. Personal information: we can see it, we do not share it

ICP Desk stores personal information that Users and organizations enter, which can include names, contact details, emergency contacts, medical and allergy information, qualifications, and driver’s license records and images. You should know the following:

  • The Operator can view this information. As the person who runs the service, the Operator and any platform administrator they authorize have technical access to stored data, including personal data, and may view it when needed to provide support, fix a problem, keep the service secure, investigate a violation of this policy, or comply with the law. Support access to an organization is logged.
  • We do not share it. We do not sell, rent, trade, or publish personal information, and we do not disclose it to anyone outside your organization and the people you have chosen to share it with, unless we are required to by law (for example a subpoena, court order, or other valid legal process) or it is necessary to prevent imminent serious harm to a person.
  • Limited use. We use personal information only to run, support, secure, and improve ICP Desk, never for advertising or unrelated purposes.
  • Inside ICP Desk, access follows your settings. Within an organization, personal details are shown only to members whose role and sharing permissions allow it. Members control what they share through their profile and sharing settings.
  • Security. Data is protected by access controls, per-organization separation, and encrypted backups, but no system is perfectly secure. If we learn that personal information was exposed, we will notify the affected organization as soon as practical.

11. Legal requests and investigations

The Operator may preserve and disclose account information, logs, and content when required by subpoena, court order, or other valid legal process, or when reasonably necessary to investigate a suspected violation of this policy, protect people or property, or defend legal claims. Where permitted, we will try to tell the affected organization first. Information that an organization enters belongs to that organization, and requests for it should go to the organization. The Operator is not a party to any dispute between Users or between a User and their agency, and does not verify any User’s identity, credentials, or authority.

12. Indemnity

You agree to defend and hold the Operator harmless from claims, losses, and costs (including reasonable legal fees) that arise from your misuse of ICP Desk, your violation of this policy or the law, or information you entered without authority to do so.

13. Suspension and removal

The Operator or an organization administrator may suspend or remove an account, or restrict access, at any time for any suspected violation of this policy or to protect the service. The Operator may change, pause, or discontinue ICP Desk at any time, so keep your own copies of exports you rely on.

14. Data, backups and retention

Data is stored on the server where your organization’s copy of ICP Desk runs and may be included in encrypted backups. Deleted items may remain in backups for a limited time. Organizations should export and archive official records through their own channels rather than relying on ICP Desk as the system of record.

15. Changes to this policy

This policy may be updated as ICP Desk changes. The current version always appears here, and the changes in each release are listed in the version history. Continuing to use ICP Desk after a change means you accept it.

16. General

If any part of this policy is found unenforceable, the rest stays in effect. This policy is governed by the laws of the state or jurisdiction in which the Operator resides, and disputes will be handled in the courts there, except where the law requires otherwise. Nothing here limits rights you cannot waive by law.

This is a good-faith policy written for a volunteer-run tool and is not legal advice. The Operator should have it reviewed by a lawyer licensed in their jurisdiction.

Version History