Privacy Policy

Last updated: June 5, 2026

This Privacy Policy explains how FRCBOM (“FRCBOM”, “we”, “us”, or “our”) collects, uses, shares, and protects information when you use our website and web application (the “Service”). FRCBOM is a Bill of Materials (BOM) and parts-management tool for FIRST Robotics Competition (FRC) teams. By using the Service, you agree to this Policy.

If you do not agree with this Policy, please do not use the Service.

1. Who We Are & How to Contact Us

FRCBOM is operated by the FRCBOM project team. For any privacy question, request, or complaint, contact us at:

Email: davidmasin2910@gmail.com

For the purposes of the EU/UK General Data Protection Regulation (GDPR), the operator of FRCBOM is the “data controller” of personal data processed through the Service.

2. Information We Collect

2.1 Information you provide

Account information: your email address, username/display name, and a password (stored only as a salted cryptographic hash — we never store your plain-text password).
Team information: team name, team number, team membership, roles, and team passwords/admin passwords you set.
Content you create: robots, subsystems, Bills of Materials, part numbers, inventory, machines, materials, orders, and related configuration.
Communications: messages you send us (e.g., support requests).

2.2 Information from third-party sign-in & integrations

Google Sign-In: if you sign in with Google, we receive your name, email address, and a unique Google account identifier (“sub”) from your Google profile. We do not receive your Google password.
Onshape: if you connect your Onshape account, we store OAuth access and refresh tokens and your Onshape user/company identifiers so the Service can read CAD documents, assemblies, Bills of Materials, thumbnails, and metadata on your behalf, and (when you choose) write part-number metadata back to Onshape. We access this CAD data only to provide the Service.

2.3 Information collected automatically

Session cookies: we use a strictly-necessary session cookie to keep you logged in and to secure your session.
Log & technical data: our servers and hosting provider may log IP address, browser type, device information, pages requested, and timestamps for security, debugging, and abuse prevention.
Cached assets: we cache CAD thumbnails and 3D assets generated from your connected Onshape documents to reduce repeated API calls and improve performance.

3. How We Use Your Information

We use the information described above to:

Create and manage your account and team, and authenticate you;
Provide the core features of the Service (BOM tracking, part numbering, inventory, 3D visualization, Onshape sync);
Communicate with you about the Service, including security and administrative notices;
Maintain, secure, debug, and improve the Service and prevent fraud or abuse;
Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not use it for advertising.

4. Legal Bases for Processing (GDPR)

Where the GDPR applies, we rely on the following legal bases:

Contract: to provide the Service you request and operate your account.
Legitimate interests: to secure, maintain, and improve the Service and prevent abuse, balanced against your rights.
Consent: where you connect an optional integration (e.g., Onshape) or otherwise give consent; you may withdraw consent at any time.
Legal obligation: where we must process data to comply with applicable law.

5. Google User Data — Limited Use Disclosure

FRCBOM’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

We use Google user data only to provide and improve the sign-in and account features you request;
We do not transfer or sell Google user data to third parties except as needed to provide the Service, for security purposes, or to comply with applicable law;
We do not use Google user data for advertising; and
We do not allow humans to read Google user data unless you give consent, it is necessary for security or to comply with law, or the data is aggregated/anonymized.

We share information only as needed to run the Service:

Within your team: content you create (robots, BOMs, inventory, etc.) and your display name/role are visible to other members and administrators of your team.
Service providers (sub-processors): we use trusted third parties to host and operate the Service, including our cloud hosting/database provider, Google (authentication), and Onshape (CAD integration). These providers process data on our behalf under their own terms.
Legal & safety: we may disclose information if required by law, regulation, legal process, or to protect the rights, property, or safety of FRCBOM, our users, or the public.
Business transfers: if the project is transferred to another operator, information may be transferred as part of that transaction, subject to this Policy.

7. Data Retention

We keep your personal data for as long as your account or team is active, or as needed to provide the Service. Demo teams and their data are automatically deleted after their expiry. When you delete your account or team, or ask us to delete your data, we delete or anonymize it within a reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements. Cached CAD assets and backups are purged on a rolling basis.

8. Your Rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any right, email us at davidmasin2910@gmail.com. We will respond within the time required by applicable law. You may also disconnect Onshape at any time, and revoke FRCBOM’s access to your Google account at myaccount.google.com/permissions.

8.1 EU/UK residents (GDPR)

You have the rights listed above and the right to lodge a complaint with your local data protection authority. We do not use your data for solely automated decision-making that produces legal effects.

8.2 California residents (CCPA/CPRA)

We do not sell or “share” (as defined under California law) your personal information, and we do not use sensitive personal information for purposes that would require an opt-out. California residents may request to know, delete, or correct their personal information, and will not be discriminated against for exercising these rights.

8.3 Israeli residents

In accordance with Israel’s Protection of Privacy Law, 5741-1981, you may request to review, correct, or delete personal information we hold about you by contacting us at the email above.

9. Children’s Privacy

FRCBOM is built for FIRST Robotics Competition teams, whose members are often students, including minors. The Service is intended to be used under the supervision of a coach, mentor, parent, guardian, or school. We do not knowingly collect personal information from children under 13 (or the equivalent minimum age in your jurisdiction) without appropriate consent from a parent, guardian, or school. If you believe a child has provided us personal information without proper consent, contact us at davidmasin2910@gmail.com and we will delete it. Coaches and mentors who create teams are responsible for obtaining any consents required by their school or organization before inviting student members.

10. Security

We take reasonable technical and organizational measures to protect your information, including hashing passwords, encrypting data in transit (HTTPS), and restricting access to credentials and OAuth tokens. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. International Data Transfers

FRCBOM may be operated from, and use service providers located in, countries including the United States, Israel, and the European Union. Your information may be transferred to and processed in countries other than your own, which may have different data-protection laws. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for such transfers.

12. Cookies

We use only strictly-necessary cookies to operate the Service: a session cookie to keep you signed in and protect your session. We do not use advertising or third-party tracking cookies. Because these cookies are essential to the Service, they cannot be disabled without breaking core functionality; you can clear them through your browser at any time.

13. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice where appropriate. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

14. Contact

Questions about this Policy or your data? Email davidmasin2910@gmail.com.