Privacy Policy

1. Overview and the systems this policy covers

GeorgiaFIRST runs a small family of web systems that support FIRST Robotics events in Georgia. This one policy covers all of them. It explains what information each system collects, how it is stored and protected, who can access it, and what rights you have.

• VARS Volunteer Portal and Administration (vars.gafirst.org, admin.vars.gafirst.org and, for the FIRST Tech Challenge, ftc.vars.gafirst.org): volunteer roster, assignments, forms, badges, check-in, meals, lodging, hours, the step challenge, event maps and communications.
• Media (media.gafirst.org): event photo uploads from volunteers and guests, and the review team’s approval tools.
• Symposium Central (symposium.vars.gafirst.org): presentation proposals, review and the Symposium schedule.
• Registration (registration.vars.gafirst.org): team registration, the lottery draw, rosters, invoices and messages to teams.
• Home (home.vars.gafirst.org): an internal control room used only by GeorgiaFIRST staff to monitor the systems above, manage staff accounts and run backups.

For most in-season FIRST Robotics events, volunteer information is imported into VARS after you apply and are accepted through FIRST Headquarters’ Volunteer Management System (VMS). In that case you do not register directly in VARS. For some offseason events or other programs, you may register or provide information directly through VARS, Symposium Central, Registration or Media. Either way, you acknowledge that your information may be used as described in this policy.

2. Information we may collect

Depending on how you interact with these systems, we may collect and keep:

Volunteers (VARS)

• Identity and contact: name, preferred name, email address, phone number.
• Role information: volunteer role and designation (for example a badge title), assigned event, positions applied for, availability, and answers to event questions.
• Logistics: meal selections, dietary needs, sizing, travel, and hotel assignments (hotel, nights and room-sharing information).
• Event access: badge details, a badge logo you choose to upload, and check-in and scan timestamps.
• Program status: FIRST youth protection and certification status, hours served, and coordinator notes.
• Step challenge (when an event uses it): the number of steps you choose to enter for each event day, when you entered it, and whether event staff approved, adjusted or declined it. Staff may mark a volunteer’s entries for review, in which case you will see that they are flagged for further review. Event staff may add a short note to a decision.

Photos and media (Media)

• The photos you upload, the event they are for, and when they were uploaded.
• Who uploaded them: for volunteers, your name, volunteer code, role and badge title; for guests who use the public upload link, the name you choose to enter (optional) and whether you are a student, mentor, volunteer or guest.
• Technical details about the picture, such as size, camera model, time taken and exposure settings, used to help reviewers judge quality. Photos may also contain information your phone embeds in them, such as the date and, depending on your phone settings, a location.
• Review decisions (approved, denied, edited), who made them and why. Reviewers can see the picture and who uploaded it, but not your email address or phone number.

Presenters and reviewers (Symposium Central)

• Proposal details: presenter and co-presenter names, email addresses and phone numbers, team name and number, program, session title and description, availability, and any files you attach.
• Review and scheduling information: reviewer assignments, reviewer comments, decisions, the schedule and room assignments, and the messages we sent you.

Teams and coaches (Registration)

• Team name and number, program and event, the contact person’s name, email address and phone number, registration status and lottery results.
• Invoices, payment status and the messages we sent you. Payments are handled outside these systems; we do not collect payment card or bank account numbers here.

Staff, accounts and sign-in

• Coordinator, administrator and reviewer accounts use a username or email address and a password or sign-in code that is stored in hashed form, never in plain text. Volunteers sign in with information already on file or with a private sign-in link sent to their email.
• Technical details such as device, browser, network address and sign-in times, used to keep the systems working and secure.

The portal does not expose other volunteers’ information, except that a volunteer with a hotel room can see their assigned roommate’s name. We do not knowingly collect government ID numbers, or health information beyond basic dietary needs voluntarily provided for meal planning.

3. Minors

Some FIRST Robotics events involve participants and volunteers under 18. Where we hold information about a minor, it is provided by a parent, guardian, coach or authorized event coordinator on the minor’s behalf and is used only for event logistics, such as badges, meals, check-in, registration and scheduling. Photos taken at events may show minors. Please only upload photos you took or have permission to share, avoid photographing anyone who asks not to be photographed, and do not add names of minors to photos. We do not use minors’ data for any purpose beyond the event it was collected for, and we do not knowingly collect personal information directly from children under 13 outside of an event setting supervised by a parent, guardian or authorized event coordinator.

4. How we use information

• Assign and coordinate volunteer roles and shifts, review presentation proposals, and run team registration and the lottery.
• Manage event logistics such as meals, lodging, badge printing, check-in, schedules, rooms and invoices.
• Run event activities such as the step challenge (totals and leaderboards are used by staff, and highlights such as team totals or top totals may be announced, which can include names), and collect event photos for GeorgiaFIRST events, communications and recaps.
• Communicate event-related updates and maintain records for event organizers.
• Meet legal, safety and program requirements, and resolve disputes.
• Protect the systems, our volunteers and our events from misuse, including reviewing entries that look inaccurate.

We do not sell, rent, or use your information for advertising or marketing.

5. Where your data is stored

Each system keeps its data on Cloudflare’s secure cloud infrastructure (VARS in a managed database; Symposium Central, Registration, Media and Home in their own protected storage). Google services are used for email delivery, nightly backups and for storing approved and pending event photos in GeorgiaFIRST’s Google Drive. Access for coordinators, reviewers and administrators is limited to designated people with individual credentials, and each system only shows a person what their role needs. We do not grant blanket access to volunteer data. The Volunteer Portal is a separate, lower-privilege area limited to a volunteer’s own information.

Photos are held on our servers only briefly while they are being filed (about ten minutes) and are then stored in Google Drive. Reviewers view them through the Media site; approving or declining a photo moves it between folders.

Symposium Central holds messages that are waiting to be sent in a short-lived outgoing queue and retries them if email delivery is slow. Delivered messages are cleared from the queue after about a week; messages that could not be delivered stay visible to administrators until they resend or discard them.

Each night, each system saves a backup copy of its data to its own folder in GeorgiaFIRST’s Google Drive, and a status email goes to administrators. Backups are kept on a rolling basis and are accessible only to designated administrators.

6. Sharing

• Event coordinators, reviewers and staff who need information to assign roles, review proposals or photos, or manage logistics.
• FIRST Robotics, event partners and service providers when needed to run events and programs, or when required by law.
• Service providers: Cloudflare (hosting and databases), Google (email, Drive storage, backups and fonts), and a third-party AI service provider that administrators may use for limited supporting features (for example summarizing or drafting event-related text). The AI feature is not core to these systems and does not receive passwords, sign-in codes or other authentication data.
• Public pages show limited information only. For example, the Symposium schedule shows session titles and presenters’ first names with a last initial, and the Registration roster shows competing team names. Email addresses and phone numbers are never shown on public pages or included in exports shared outside the event team.
• Volunteers see step-challenge team totals and their own entries. Staff see individual totals and leaderboards.
• Approved event photos may be used by GeorgiaFIRST for events, communications and recaps. If you do not want a photo of you used, contact us and we will remove it.

We do not share your information with sponsors or any third party for marketing or unrelated purposes, and we do not sell it.

7. How we contact you

Contact details usually come from FIRST HQ’s VMS after you are accepted for a role, or from the form you fill in on one of these systems, and are used to coordinate your participation. We may email you to:

• Confirm your role, proposal, registration or event assignment.
• Send forms and logistics details (badge, meals, lodging, check-in, schedule).
• Send reminders about your upcoming event, including, when an event runs the step challenge, an optional reminder around 8 pm on each event day asking you to log your steps.
• Share program updates, new volunteer opportunities or grant/application windows.
• Send thank-you messages after an event.

Essential vs. non-essential: emails tied to your event registration or logistics are essential. Program updates, opportunity announcements and appreciation messages are non-essential and include an option to opt out. You may contact us any time to be removed from non-essential messages or from our systems entirely.

These systems are largely automated, so messages are generated from imported event and role data. If an email looks wrong (wrong event, wrong role), please tell us at vars@gafirst.org.

8. How long we keep it

We keep volunteer, presenter, team and event data only as long as reasonably necessary for the event and for historical record-keeping, such as year-over-year volunteer tracking. Step-challenge entries are kept with the event they belong to. Photos are kept in Drive for as long as the event team needs them; declined photos are kept separately for staff and can be deleted on request. Backups are kept on a rolling basis. You may request deletion at any time, subject to records we must keep for event or safety purposes.

9. Your rights

• Request a copy of the information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your data, or removal of a photo of you, subject to records we are required to keep.

To make a request, contact us using the details below.

10. How we protect your information

• The systems are protected by Cloudflare’s security infrastructure, including encryption in transit and network-level protections.
• Server-side authentication and authorization for sensitive operations; unauthenticated requests are rejected.
• Time-limited sessions and scoped access, so access expires and is limited to what a role needs. Reviewers, presenters and volunteers each see only what their role requires.
• Restricted administrative functions with individual credentials, and a separate restricted-scope Volunteer Portal login.
• Audit logging, backups, and confidential credentials kept server-side and never exposed to public pages.
• Regular review of who holds admin access.
• People who handle volunteer data complete advanced data security training through FIRST Robotics.

These safeguards follow the principles of least privilege, data minimization and secure-by-default access.

Important: no system can be guaranteed 100% secure. Despite our safeguards, information could be lost, accessed, altered, used or disclosed without authorization through events outside our reasonable control. These statements describe safeguards we have implemented and are not a representation of formal certification, independent audit, or compliance with any particular statute or framework unless expressly stated.

11. Cookies and local storage on your device

We store a sign-in session and a few display preferences in your browser or installed app. They are needed for the systems to work. We do not use advertising cookies or analytics trackers.

• Staying signed in: the Volunteer Portal can keep you signed in on your own phone or computer (including when installed as an app) for up to 90 days of inactivity, so you do not have to sign in every time. Signing out removes it. Do not use this on a shared or public device.
• Offline copy: so the portal still works with a poor signal, a saved copy of your portal information (your name and contact details, and your events and roles) is kept on your device and refreshed whenever you are online. Signing out removes it. Venue maps you open are also saved on your device.
• Photos you select for upload are processed in your browser and sent directly to us.

12. Your responsibilities

You agree to provide accurate information (including accurate step counts), keep your sign-in details private, only upload photos you took or have permission to share, and not misuse, copy, scrape or interfere with these systems or the information in them. You are responsible for activity under your account.

13. Consent

By applying, registering, submitting a proposal, uploading photos, signing in or otherwise using these systems, you consent to the collection, use and sharing of your information as described here, including event-related emails and messages.

14. Disclaimer of warranties

These systems are provided “as is” and “as available.” To the fullest extent permitted by law, GeorgiaFIRST makes no warranties, express or implied, about availability, accuracy, reliability or fitness for a particular purpose.

15. Limitation of liability

To the fullest extent permitted by law, GeorgiaFIRST, its directors, staff, volunteers, partners and service providers are not liable for any indirect, incidental, special, consequential or punitive damages, or for loss of data, profits or opportunity, arising from your use of these systems or from events outside our reasonable control, including outages, third-party failures, or unauthorized access despite our safeguards.

16. Indemnification

To the extent permitted by law, you agree to hold harmless GeorgiaFIRST and its directors, staff, volunteers and partners from claims arising from your misuse of these systems or violation of this policy.

17. Legal requirements

We may access, preserve or disclose information when we believe it is required by law, legal process or a government request, or is necessary to protect the rights, safety or property of GeorgiaFIRST, our volunteers, participants or the public.

18. Other sites

These systems may link to other websites or services (for example maps or FIRST’s own sites) with their own policies, which we do not control.

19. Governing law and disputes

This policy, and any questions relating to it, are governed by the laws of the State of Georgia, USA, without regard to conflict-of-law principles. Disputes will be brought in the state or federal courts located in Georgia, and you consent to that jurisdiction. If any part of this policy is found unenforceable, the rest remains in effect.

20. Changes to this policy

We may update this policy at any time, for example when we add a new system or feature. The “Last updated” date reflects the most recent version, and continued use of these systems means you accept the updated policy.

21. Contact

For questions about this policy, or to make any system, data, access, photo or deletion request, contact GeorgiaFIRST at vars@gafirst.org.