App Privacy Notice

The Post 200 mobile app (“the app”) is provided by American Legion Post 200 (“Post 200,” “we,” or “us”). We built the app to serve our members, veterans, families, and the Wallis community — not to collect data about you. This notice explains exactly what the app collects, why, and your choices.

1. What the App Collects

Information you provide directly

• Hall-rental inquiries — your name, contact details, event date, and group size.
• Membership inquiries — the information you type into the inquiry form.
• Contact messages — your name, email or phone, and the message you write.
• Member account profile — only what you choose to add or update through the Member tab.

Information the app stores on your device

• A secure Sanctum authentication token after you sign in (see section 3).
• A Firebase device token if you opt in to push notifications on Android (see section 4).
• Cached events, news, and announcements so the app loads quickly and works briefly without a connection.

The app does not read your contacts, calendar, photos, microphone, or location. If you choose to add an event to your phone calendar or get directions to the Post, the app hands that request to your phone’s native app — we never see it.

2. How We Use Your Information

• Respond to your hall-rental, membership, and contact inquiries.
• Authenticate you when you sign in to your member account.
• Deliver push notifications you have opted in to.
• Show you events, news, and announcements you have asked the app to display.
• Maintain the security and proper operation of the app and the Post 200 server.

3. Your Sign-In Token

When you sign in to your Post 200 member account, the app receives a Laravel Sanctum authentication token from the Post 200 server.

• Where it’s stored: on your device only, in your operating system’s secure key store (Android Keystore on Android, Keychain on iOS), under the key post200.sanctum.token.
• What it does: it tells the Post 200 server who you are when the app makes a request, so you don’t have to retype your password every time.
• Who can see it: nobody outside your device. The token is never sent to any third party.
• How to remove it: sign out from the Member tab or the Settings screen. The token is deleted from your device immediately.

Two-factor authentication (2FA) is supported through the same Fortify flow used on the website. If you have 2FA enabled on your account, the app will prompt for your second factor at sign-in.

4. Push Notifications & Device Tokens (Android)

If you opt in to push notifications on an Android device, the app registers a Firebase Cloud Messaging (FCM) device token with the Post 200 server. That token is the only thing FCM needs to deliver a notification to your specific device.

• We use the token to send you Post 200 event reminders and announcements only.
• We do not sell, rent, share, or otherwise disclose the token to anyone other than Google’s FCM service, which delivers the notification to your device.
• You can disable push notifications at any time in your device’s notification settings or in the app’s Settings screen. Disabling them unregisters your device token from the Post 200 server.

5. Inquiry Form Submissions

When you submit a hall-rental inquiry, a membership inquiry, or a contact message through the app, the information you enter is sent over HTTPS to the Post 200 server and reviewed by Post staff.

• Inquiry submissions are used only to respond to you.
• They are not sold, rented, or shared with marketers, advertisers, or any other third party.
• Inquiries are retained according to the schedule in section 7.

6. Third-Party Services

The app uses one third-party service in production:

• Google Firebase Cloud Messaging (Android only) — delivers push notifications. The only data shared with Firebase is the device push token described in section 4. No personally identifiable information about you is sent to Firebase by the app. Firebase is governed by Google’s own privacy policy at policies.google.com/privacy.

The app does not use Google Analytics, Facebook SDK, advertising SDKs, crash-reporting services that collect personal data, or any other analytics or tracking tooling.

7. Data Retention & Deletion

• Sign-in tokens — removed from your device immediately when you sign out.
• Push device tokens — unregistered from our server when you disable notifications or sign out.
• Inquiry submissions — retained on the Post 200 server for 1 year, then deleted.
• Member account — retained while your account is active. Deleted within 30 days of a verified deletion request.
• Cached app data — cleared when you uninstall the app or sign out.

To request deletion of your Post 200 account and any associated data held on the Post 200 server, use the data deletion request form on wallispost200.org. Deletion requests are processed within 30 days.

8. Your Rights & Choices

You can:

• Sign out at any time, which removes your authentication token from the device.
• Disable push notifications in your device settings or in the app’s Settings screen.
• Update your member profile information through the Member tab.
• Request a copy or deletion of the data we hold about you (see section 7).
• Uninstall the app, which clears all locally cached data from your device.
• Contact us with any questions or concerns (see section 10).

9. What We Don’t Do

10. Contact Us About Your Data

Questions about this notice or how the app handles your information? Reach out any time:

American Legion Post 200 330 Legion Rd, Wallis, TX 77485
Phone: (979) 478-9913
Email: commander@wallispost200.org

We collect what the app needs to work. Nothing more.