Privacy Policy

Effective April 22, 2026 · Last updated April 22, 2026

This Privacy Policy describes how Washington Law Enforcement Exploring Advisors (“WLEEA”, “we”, “our”, “us”) collects, uses, and protects personal information when you use the WLEEA website at wleea.com or the WLEEA mobile app (together, the “Services”). By using the Services you agree to this Policy; if you don’t, please don’t use them.

1. Who we are

WLEEA is a Washington State 501(c)(3) non-profit that supports Law Enforcement Explorer programs. We are the data controller for the information described here.

2. Information we collect

Account & profile information

When you register or use your account, we collect:

• Username, email address, and password (password is hashed and never stored in plain text)
• First name, last name, and display name
• Your sponsoring agency or Explorer Post
• Optional profile details you choose to provide (avatar, biography)
• Your assigned WLEEA roles and permissions (e.g. Explorer, Advisor, Admin)

Submissions you send us

If you submit an award nomination, scholarship application, contact form, or other form, we collect whatever you choose to enter — including, for scholarships, your personal essay, letters of recommendation, and Explorer resume. File uploads are emailed to the board and then deleted from our server immediately; metadata about the submission is retained in our database.

Activity within the Services

• RSVPs, waitlist status, and saved (bookmarked) events
• Reminder preferences for events you’ve RSVP’d to
• Documents you’ve viewed or downloaded (when you’re signed in)
• Announcements you’ve marked as read

Technical & device information

• IP address and user-agent of form submissions (for spam/abuse prevention)
• A Firebase Cloud Messaging (FCM) device token if you enable push notifications — this is a random Google-issued identifier, not tied to your device identity
• Session cookies issued by WordPress on login (see Cookie Policy)

3. What stays on your device

The mobile app stores several things locally so it works offline and so you don’t have to log in repeatedly. These never leave your device:

• Your session token (JWT) and, if supported, a refresh token — in the device’s secure keystore (Android Keystore / iOS Keychain)
• A cached copy of your profile for offline display
• Your app PIN (stored hashed) and biometric-unlock preference
• App preferences: theme, notification toggle, saved home-screen filters, bookmarked events
• Cached pages of events, announcements, and documents for offline viewing

Signing out of the app clears your session token, refresh token, and cached profile.

4. How we use your information

We use your information only for the purposes below:

• Providing the Services — running your account, showing events, processing RSVPs, handling submissions, sending the push notifications you’ve enabled
• Communicating with you — responding to forms you submit, sending account notices (e.g. 2FA codes, submission receipts), and following up on award/scholarship nominations
• Security & abuse prevention — rate-limiting, reCAPTCHA verification, two-factor authentication, detecting unauthorized access
• Improving the Services — fixing bugs and administering the platform
• Legal compliance — when required by law or to protect our rights

We do not use your information to build advertising profiles, sell to third parties, or share with data brokers.

5. Third-party services we use

Google Firebase Cloud Messaging (push notifications)

If you enable notifications in the app, a device token is sent to Google so we can deliver push messages through Apple/Google’s notification systems. The token is a random identifier — no name, email, or other personal data is shared with Google in the token itself. Disable notifications in the app’s Settings to revoke this.

Google reCAPTCHA Enterprise (spam protection)

Pages with public forms (contact, award nomination, scholarship application, beta sign-up) load Google’s reCAPTCHA Enterprise script. Google may collect browser/IP data to determine whether the visitor is human. This is governed by Google’s Privacy Policy and Terms.

Google Maps (optional)

When you tap an event venue address, the app hands the address off to your device’s maps application (Google Maps on Android, Apple Maps on iOS). No WLEEA account data is sent with the link.

Hosting

The WLEEA website and API are hosted on SiteGround. Server-level logs (access logs) are managed by the hosting provider under their privacy practices.

We do not use Google Analytics, Facebook Pixel, Sentry, Mixpanel, advertising SDKs, social login, or any other analytics or tracking service.

6. How long we keep your information

• Account data — retained while your account is active. If you request account deletion (or use Delete Account in the app), we remove your profile and associated personal data from our databases.
• Submissions — form submissions are retained in our database for administrative review (scholarship cycles, award records). Uploaded files are deleted from disk immediately after the admin notification email is sent; a daily cleanup cron also purges any stale files older than 90 days as a safety net.
• IP & user-agent on submissions — stored with the submission record for abuse investigation.
• FCM device tokens — deleted when you disable notifications or sign out.
• Anonymous / aggregated data — may be retained indefinitely.

7. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct or update inaccurate information
• Delete your account and associated personal data
• Receive a copy of your data in a portable format
• Withdraw consent for optional processing (e.g. push notifications)
• Lodge a complaint with your local data protection authority

You can exercise most of these directly in the app — edit your profile under Profile, toggle notifications under Settings, and permanently delete your account via Settings → Delete Account. For anything else, email board@wleea.com.

8. Security

We protect your information with reasonable technical and organizational measures including HTTPS encryption in transit, hashed passwords, JWT-based authentication, optional two-factor authentication, optional PIN/biometric unlock on the mobile app, server-side rate limiting, and Google reCAPTCHA on public forms. No system is perfectly secure, so we can’t guarantee absolute security — but we work hard to protect what you share with us.

9. Children’s privacy

Law Enforcement Exploring serves young adults aged 14 and up. Users under 18 should have a parent or guardian review this policy. We do not knowingly collect personal data from children under 13; if you believe we have, contact us and we’ll delete it.

10. Changes to this policy

We may update this policy occasionally. When we do, we’ll change the “Last updated” date above and, for material changes, post a notice in the app or website. Continued use of the Services after the update constitutes acceptance of the revised policy.

11. Contact us

Questions, requests, or complaints about this policy? Email board@wleea.com or write to us at the address at the top of this page.