← Back to OncoCrew

Privacy Policy

Last Updated: June 8, 2026

1. Introduction

OncoCrew is a private messaging application designed for informal communication between hospital colleagues and friends. It is not a clinical system and should not be used for patient care coordination, medical records, or any healthcare-related clinical communication. This Privacy Policy describes how OncoCrew collects, uses, and protects your information when you use our application at https://oncocrew.djmbase.com (also accessible at https://oncocrew.web.app).

2. Information We Collect

When you use OncoCrew, we collect the following information:

• Account Information: Email address and display name (via Firebase Authentication)
• Profile Photos: Optional profile images you upload (stored in Firestore as part of your user document)
• Messages: Text messages you send within the app (stored in Firestore), including:
  • Original messages (one-to-one and group conversations)
  • Replies and quoted messages
  • Forwarded messages (a copy is created with the original sender attribution)
  • Edited messages (the latest version is stored; previous versions are not retained)
  • Deleted messages (soft-deleted; a placeholder remains in the conversation; underlying content is removed)
• Voice Recordings: Audio messages in WebM or MP4 format (stored in Firebase Storage)
• Images: Photos and images you share in chat (stored in Firebase Storage)
• Presence Data: Online/offline status, read receipts, typing indicators, and timestamps
• Group Membership: Information about which groups you belong to
• Push Notification Tokens (FCM): If you enable notifications, a Firebase Cloud Messaging (FCM) token is generated for your browser/device and stored in your user document (users/{email}/fcmToken). This token is used solely to deliver message notifications to your device.

2.1 Push Notifications

OncoCrew uses Firebase Cloud Messaging (FCM) to deliver push notifications for new messages. Key points:

• Notifications are opt-in. You must explicitly grant permission via the bell icon in the top bar.
• You can disable notifications at any time from your browser settings or by clicking the bell icon again.
• On iPhone/iPad (iOS Safari), notifications require installing OncoCrew as a Progressive Web App: tap Share → Add to Home Screen, then open from the Home Screen icon and enable notifications.
• Each device/browser receives its own unique FCM token. Tokens are stored only while notifications are enabled and are deleted when you disable notifications or delete your account.
• Notifications contain the sender's name and a preview of the message. Do not share PHI given that previews may appear on lock screens.

3. How We Use Your Information

We use the collected information to:

• Provide and maintain the messaging service
• Authenticate users and secure accounts
• Deliver messages and enable real-time communication
• Display your online/offline presence to other users
• Deliver push notifications for new messages (when enabled)
• Moderate content for safety and compliance (by administrators upon report or as required by law)
• Troubleshoot technical issues and improve the application

We do not use your data for advertising, profiling, or sale to third parties. OncoCrew does not currently use analytics tracking (e.g., Google Analytics, Firebase Analytics).

4. Data Storage and Security

Your data is stored securely on Google Firebase infrastructure, which includes:

• Firestore: Database for messages, metadata, and FCM tokens
• Firebase Storage: Secure storage for photos, voice recordings, and images
• Firebase Authentication: Secure user authentication
• Firebase Hosting: Application hosting
• Firebase Cloud Messaging (FCM): Push notification delivery

Security measures:

• All data is encrypted in transit using HTTPS/TLS
• Data is encrypted at rest using Firebase's default encryption
• Access to Firestore and Storage is enforced through server-side security rules; users can only read/write data they are authorized to access
• Servers are located in the United States
• File size limits: Profile photos max 2 MB; voice recordings and images max 5 MB

4.1 Service Workers

OncoCrew registers two service workers in your browser to enable offline support and background notifications:

• service-worker.js handles caching and offline behavior of the application shell.
• firebase-messaging-sw.js handles background push notifications when the app is closed or in the background.

Service workers run only within the OncoCrew origin (oncocrew.web.app) and do not access data from other websites.

5. Cookies and Local Storage

OncoCrew uses browser storage mechanisms (cookies, localStorage, IndexedDB) for essential functions only:

• Firebase Authentication tokens to keep you signed in between sessions (stored in IndexedDB/localStorage by Firebase SDK).
• FCM token cache to avoid re-requesting a notification token on every page load.
• UI preferences such as last opened conversation, draft message text, and similar non-sensitive state.

We do not use tracking cookies, advertising cookies, or third-party analytics cookies. Clearing your browser data will sign you out and remove all local OncoCrew data.

6. Third-Party Services and Libraries

OncoCrew uses the following third-party services and libraries:

• Google Firebase (Authentication, Firestore, Storage, Hosting, Cloud Messaging) — Firebase Privacy Policy
• webm-duration-fix (MIT Licensed) — Open-source library used to fix WebM voice recording duration metadata on Android devices — GitHub Repository

7. Children's Privacy

OncoCrew is not intended for users under the age of 18. We do not knowingly collect personal information from children under 18. If you believe we have collected such information, please contact us so we can delete it.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request deletion of your account and associated data
• Withdraw consent at any time by disabling notifications and/or deleting your account
• Request an export of your messages in JSON format (contact admin)
• Object to or restrict certain processing of your data

To exercise these rights, contact us at the email address provided below. You can delete your account at any time from within the app: open the Profile tab and tap the red Delete Account link. Deletion is permanent and cannot be undone. Your profile, account record, and profile photo are removed immediately; messages you previously sent in conversations remain visible to other participants but are re-attributed to Deleted User. Account deletion requests submitted by email are processed within 30 days.

9. Data Retention

Messages and Media: Retained until deleted by you or an administrator. Deleted messages leave a placeholder visible to participants; the underlying text, image, or audio is permanently removed.

FCM Tokens: Retained while notifications are enabled. Removed when you disable notifications, sign out, or delete your account.

Account Data: Retained while your account is active. If you delete your account, your personal data will be removed from our systems within 30 days.

10. Content Moderation

OncoCrew administrators may review messages reported by users or flagged automatically (e.g., for suspected PHI sharing or abuse). Administrators may delete content or suspend accounts that violate this policy or applicable law. We do not proactively scan or read private messages outside of these moderation cases.

Users can also block other users (which hides their messages and prevents new direct messages) and report users or groups for review. Reports include the reporter's email, the reported user or group, and an optional reason; reports are accessible only to administrators and are retained until the report is resolved.

11. Jurisdiction

OncoCrew is operated from the United States. Users are responsible for compliance with their local laws and regulations regarding data privacy and communication. By using OncoCrew, you agree to the terms of this Privacy Policy and applicable laws.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last Updated" date. Material changes may also be communicated via an in-app notice. Your continued use of OncoCrew after changes constitutes your acceptance of the updated Privacy Policy.

13. Contact

If you have any questions about this Privacy Policy, please contact:

• Email: diglej@gmail.com
• Website: https://oncocrew.djmbase.com (also https://oncocrew.web.app)