Privacy Policy

If you are watching a tracking page

You do not have an account, and we do not try to work out who you are.

What is collected

• An anonymous session identifier. A random value stored in your browser so a single visit is not counted as many. It is not linked to your name, email address, or any account. Your browser uses the same identifier on every organization’s page on this site, but organizations only ever see totals, never the identifier.
• Page views and whether engagement features were used — for example, that a donate button was clicked, or that a sponsor was shown. Recorded with the anonymous session identifier and reported to organizations only as totals.
• Waves. If you tap Wave at the Truck, the wave is recorded with your anonymous session identifier, so that one browser can’t send waves faster than the page allows. The crew and the organization see only the number of waves.

What is not collected

• Your location. The map shows the truck’s position, never yours.
• Your name, email address, or phone number.
• Any advertising or cross-site tracking identifier.

Letters to Santa

If an organization has enabled letters, a parent or guardian can send a letter to Santa on a child’s behalf. The form accepts a message, plus an optional first name and neighborhood. In the app, a letter is visible only to the signed-in administrators of the organization it was sent to. Responder MAX staff and our service providers can also reach it, as described under Who can see what. It is never shown publicly, never shown to other organizations, and never used for advertising.

Before the letter form opens, the person sending it confirms that they are a parent or legal guardian sending the letter on behalf of a child, and that they will review the letter for personal information before sending it. With each letter we record that this confirmation was given, the time it was recorded, and which version of the confirmation wording was shown. We do not record an IP address or anything else about the person for this confirmation. It is a record of what the sender confirmed: we do not verify anyone’s identity or age, and it is not a verified parental consent.

First names and neighborhoods are erased 60 days after submission, by an automatic job that runs every day, so a name or neighborhood is kept for at most about 61 days. Erased first names and neighborhoods can remain in our database provider’s backups for up to 8 days after they are erased, until those backups expire. The message text, the confirmation record and an anonymized count remain so organizations can report how many letters they received.

Erasing the first name and neighborhood does not change the message. Anything written in the message itself, including a name, stays in the message. The parent or guardian’s confirmation does not make a kept message anonymous.

A neighborhood name also stays in the organization’s season statistics as a count of letters from that neighborhood, never linked to a letter; the organization’s dashboard shows only neighborhoods with at least five letters.

Please review a letter before sending it, and do not include full names, home addresses, phone numbers, email addresses, school names, or other identifying information. There is no reason for us to have it and no feature that uses it.

Children

Santa Tracker is not directed to children under 13. Letters to Santa are written and sent by a parent or guardian on a child’s behalf.

Photos

Photos added during a route are public: they appear on the organization’s tracking page and its recap, where anyone who opens the page can see them and save a copy. They may show identifiable people, including children.

Photos are added by the organization, or by people it has given a photo link to. To have a photo removed, ask the organization (its administrators can remove it right away) or email us at santa-help@respondermax.com. A removed photo is deleted from our storage, and pages that are open are told to remove it; a page in a hidden tab or without signal removes it when it reconnects. Copies that viewers saved, and a copy a browser has already kept for up to an hour, are outside our control.

If you run a tracking page

Account and signup information

When your organization signs up, we collect and keep:

• the email address used to sign in, held by our authentication provider;
• the contact name, role or title, email address, and phone number given at signup;
• details about the organization: name, type, staffing model, state, website, and optionally population served, station count, tools currently used, and how many Santas are planned;
• how you heard about us, and which other services you expressed interest in;
• a record of your acceptance of the Terms of Service and this policy — the time, the version accepted, and the IP address and browser the acceptance came from;
• whether you opted in to marketing contact, and when.

This information is used to operate your account, to support you, and — only if you opted in — to tell you about other Responder MAX services. It is visible to Responder MAX staff. It is not visible to the public, not visible to other organizations, and not shown in your own admin dashboard. We do not sell it.

Route and location data

While a driver is tracking, the phone running the tracking page reports its position. Those positions are broadcast live to viewers and are also recorded so the organization can see where its route went and so we can detect a truck that has stopped reporting.

This is the location of a vehicle on a public route, published deliberately. It is still worth being clear that the phone doing the reporting belongs to a person: positions are recorded only while tracking is running. Positions recorded while the phone had no signal are sent when the signal returns. When the driver stops tracking, the phone makes one final attempt to send any it is still holding; any it can’t send are discarded on the phone. Nothing is recorded after the driver stops. The one exception: when a driver’s phone is set up before the page goes live, a single test position is saved to confirm the phone works. It is never shown to viewers.

Who can see what

Letters, route history, settings and statistics belong to the organization. They can be reached by:

• the organization’s administrators, signed in to the app. In the app, nobody else can read a letter;
• Responder MAX staff, for support and to run the service. Our staff screens show totals, not letter text, but staff with access to our database tools can reach everything we store;
• our service providers (see Who else is involved), which store and process it on our behalf.

What is public is what the tracking page shows: the truck’s position while tracking, the schedule, photos, the organization’s name and logo, and any sponsor.

How long things are kept

• Letter first names and neighborhoods: 60 days, then erased by the daily erasure job (at most about 61 days), then up to 8 more days in database backups (at most about 69 days in all). Neighborhood names remain only as counts in season statistics.
• Letter messages and the parent/guardian confirmation record: kept with the letter for as long as the organization uses the service. There is no automatic deletion of message text.
• Anonymous aggregate counts (visits, letters received, waves, donation clicks, sponsor impressions): kept for as long as the organization uses the service, so it can compare seasons. They are deleted with the organization if it is removed.
• Page-view and engagement records (with the anonymous session identifier): deleted once they are more than 90 days old and their season has ended. The totals remain.
• Wave records (with the anonymous session identifier): deleted after 90 days. The wave counts remain.
• Route positions: deleted automatically once they are more than 90 days old and their season has ended (seasons run from August 1 to July 31, in the organization’s time zone), by a job that runs every week. What remains is whether a truck tracked on each night, in the season statistics, and when each run started and ended, in the organization’s run history; neither contains a position.
• Signup and contact information: kept for as long as your organization uses the service. If an organization is removed:
  • its other data is deleted at once, including its season statistics, and every administrator’s access to it ends. A sign-in account used only for that organization is deleted. An account that also administers another organization, or belongs to Responder MAX staff, is kept; only its access to the removed organization ends;
  • the signup information (everything listed under “Account and signup information”) remains for up to 30 days after removal. After that, only a short record of the agreement remains: the organization’s name, type, state and page address, the contact’s name and email address, and which versions of the Terms of Service and this policy were accepted, and when. That record is deleted 3 years after removal;
  • our team’s email notice of the signup (with the contact’s name, email address and phone number) is kept for 3 years after removal, then deleted;
  • if the contact opted in to marketing, their name, email address, organization, organization type and state, the services they said they were interested in, and when they opted in, stay on our marketing list (in HubSpot, below) until they opt out, whatever happens to the rest. If you opt out, we stop marketing email and keep only your email address on our do-not-email list, so we don’t contact you again. Ask us and we’ll delete it entirely.
• Photos: kept until the organization removes them, or until the organization itself is removed.
• Database backups: our database provider keeps a daily backup of the database for 8 days, then deletes it. Anything erased or deleted from the database can remain in those backups for up to 8 days afterward. Photo files are stored separately and are not included in these database backups.

Who else is involved

We use a small number of service providers to run the platform. They process data on our behalf:

• Supabase — database, authentication, file storage, and the live position channel.
• Vercel — application hosting.
• Resend — sending sign-in links and account email, including our team’s notice of each new signup. Resend keeps copies of the emails it sends for its own retention period.
• Google Workspace — our team’s email, including the santa-help@respondermax.com inbox. Our notice of each new signup (with the contact name, email address and phone number) and any email you send us are kept there.
• HubSpot — our marketing contact list, used only for contacts who opted in to marketing. For each of them it holds the contact name, email address, organization, organization type, state, the services they said they were interested in, and when they opted in. Nothing is sent to HubSpot about contacts who did not opt in, or about people who view a tracking page or send a letter. HubSpot is not used on this site: it sets no cookies here.
• Slack — our internal alerts about the service, for example a truck that has stopped reporting. They identify the organization and its tracking page, not members of the public.
• Cloudflare Turnstile — checks that a person, not an automated program, is using the sign-in and signup pages. Cloudflare receives information about your browser and connection for that check.
• Cloudflare — serves our map tiles (tiles.fdsanta.com), made from OpenStreetMap data with Protomaps.
• Stadia Maps — backup map tiles only, used when ours can’t load.
• About map tiles — they load directly in your browser when you view a map, which means the map providers above can see your IP address and which map tiles you requested, as they can for any site that displays a map.
• Nominatim (OpenStreetMap) — two kinds of lookup, never from viewers’ browsers: the street name shown for the truck, looked up by the truck’s phone from its position; and the places an organization enters for its schedule and its map’s starting point, looked up by our servers.
• About hosting logs — our hosting providers (Supabase and Vercel) keep their own request logs, which include the IP address a request came from, for their standard log retention periods. We don’t copy those addresses into letters or the confirmation record.

We do not use advertising networks, analytics products that build cross-site profiles, or social media tracking pixels on tracking pages.

Cookies and local storage

• Viewers: your browser’s local storage keeps the anonymous session identifier described above, your language choice (English or Spanish), and the time of your last wave for each Santa, so the page can tell you when you can wave again. Only the session identifier is sent to us. No advertising cookies.
• The photo page (on the phone adding photos): each photo (made smaller where the browser can) and its caption are saved in that phone’s browser before they are sent, so a photo isn’t lost if the page closes. If sending fails, the page tries again by itself while it is open, and again whenever the photo link is reopened in the same browser. The phone’s copy is removed when our server confirms the photo, when our server answers that the organization has already removed it, or when you delete it on the photo page. A photo the server turned down (for example, because the page wasn’t live) is not retried by itself: it waits on the phone for Send again or Delete. A copy is also gone if the browser’s data for this site is cleared. The page also remembers which camera to use.
• The driver’s tracking page: while tracking, the browser keeps a note that this phone is tracking (the time, and the tracking page’s own address in that tab), so the photo page can warn if it is opened on the tracking phone. The note is removed when tracking stops. None of this is sent to us.
• Administrators: a sign-in session cookie, required for the dashboard to work. The dashboard also keeps a few conveniences in your browser, such as setup form text you haven’t saved yet. The sign-in and signup pages load Cloudflare Turnstile (see above).

Your choices

• Marketing: opt-in only. If you did not check the box at signup, we will not contact you for sales purposes. You can opt in or out at any time by emailing us.
• Access, export and deletion: email us at santa-help@respondermax.com to see what we hold about your organization, to get a copy of it, to correct it, or to have it deleted. There is no self-service export; we prepare a copy on request.
• Letters: if a parent or guardian wants a letter removed, including its message, contact us or the organization it was sent to.

Changes to this policy

Updates are published here with a new version number and date. The version in force when your organization signed up is recorded with your account.

Contact

santa-help@respondermax.com

See also: Terms of Service · Help & FAQ