Privacy Policy

Holler Guide is operated by Holler Software LLC, a Virginia limited liability company (“Holler,” “we,” “us,” “our”).

This policy covers:

• the Holler Guide website at holler.guide;
• the Holler Guide iOS app (previously published as “Rappahannock Events”);
• the Concierge, our AI assistant, on both the website and the app;
• Holler Ride, our local ride-request service.

It does not cover our shop, or the separate school and business sites we host — each publishes its own policy.

Most of what follows applies wherever you meet us. Where something is true on only one surface, we mark it (App only) or (Web only).

Account information. (App only) If you sign in with Apple, we receive your name and email address — or a private relay address if you choose to hide it. (Web only) If you sign in on the website, we use a one-time link sent to your email address. Either way we store an internal identifier for your account.

Location. (App only) With your permission, the app uses your device location to show what’s nearby, sort places by distance, and give directions. None of that reaches our servers. Two things do leave your device, though. To draw a driving route, we hand your location to Apple’s mapping service, which returns the route under Apple’s own terms — it never passes through us. And if you’ve agreed to share data with the Concierge and location access is still on, we include a rough note about where you are in what we send the Concierge — a nearby town name, and the names of up to three places from our catalog that are among the closest to you, in an order that has nothing to do with distance, so the list itself doesn’t reveal which one is nearest. No distances, no travel times, no coordinates, and not your street address. See The Concierge. (Web only) The map works without your location unless your browser asks and you allow it. The same is true of the Farm Tour planner: if you tap “Use my location,” your browser may ask your permission, and if you allow it, we use your device’s location to show roughly how far each stop is and to let you start the route from where you are instead of the Visitors Center. That location never leaves your device — it is never sent to our servers, never stored, and never included in the directions links the planner opens in Google or Apple Maps. Check-in works the same way — see Check-ins.

What you do here. Places and events you view, what you save, and reservations you make.

Check-ins. We keep the visit, not your coordinates. When you check in at a place, Holler stores which place and when, linked to your account, for your Ledger. We don’t store your coordinates or how far away you were. To check that you’re there, your phone or computer asks for your location once, when you tap, compares it with the place’s location on the device itself, and then lets it go. If you’re not close enough, nothing is sent to us. Check-in needs an account, and it never runs in the background.

Payments. Card details go directly to Stripe. We never receive or store your card number — we keep only a reference to the customer record Stripe holds for you.

Concierge communications. When the Concierge calls or emails a venue for you, we keep a record of that — who it went to, when, and the outcome — so we can show you what happened. See The Concierge.

Ride details. See Ride data.

Technical records. Our servers log requests — including IP addresses — to keep the service running and to investigate abuse.

• To run Holler Guide and show you what’s relevant nearby
• To process reservations, rides, and payments
• To let the Concierge act on your behalf when you ask it to
• To send you things you asked for — reservation and ride updates, and (App only) push notifications
• To publish ratings, scores, quotes, and tips from surveys and reviews, with your permission where it’s needed
• To check and correct what our listings say, and to answer businesses that write to us
• To protect the service from fraud, abuse, and automated traffic
• To understand what people use, so we can improve it

We do not sell your personal information, and we do not use it to target advertising.

Chatting without an account. You can ask the Concierge questions without signing in — on holler.guide or in the app. You get a short-lived anonymous session token — it isn’t tied to a name, an email, or an account, and it expires on its own. Signed out, the Concierge can plan, compare, and recommend, but can’t book, order, call, or email on your behalf — that needs an account.

Your messages are sent to Anthropic to generate a reply, along with details of the places and events in our own catalog that are relevant to your question. (App only) A rough note about where you are can travel with your message too — see Where you are, below. We do not save anonymous conversations. The chat lives in your browser; close the tab and our servers have nothing to show you again. Our logs record that a request happened, but not what you asked.

Where you are. (App only) The Concierge gives better answers when it knows roughly where you are — whether a place is around the corner or an hour over the mountain. When all three of these are true — you’ve agreed to share data with the Concierge, location access for the app is on, and your phone has a fix — we add a couple of lines about your surroundings to each request. Those lines give an approximate place name, normally the nearest town in our catalog, and the names of up to three of the closest places we list. The names arrive in an order that has nothing to do with distance, so the list itself doesn’t tell the Concierge which one is nearest. No distances, no travel times, none of your coordinates or street address, at any precision. We ask iOS for an approximate location fix rather than the most precise one available. If everything in our catalog is more than 60 miles away, we leave the lines out altogether. This works the same whether or not you’re signed in.

Those lines travel with your message — to our servers, and on to Anthropic, which generates the reply. We don’t store them, don’t log them, and don’t build a history of where you’ve been. Anthropic handles what it receives under its own terms. Two switches stop this, and either one on its own is enough: turn off location access for the app in iOS Settings, or revoke Concierge data sharing in the app under Profile → Data & Privacy.

Please don’t type anything into the Concierge you wouldn’t want handled by an outside AI provider — payment details, government ID numbers, or health information.

The bot check. (Web only) To keep the Concierge and the forms on this site from being drained or flooded by bots, we use Cloudflare Turnstile. It runs in the background, and most visitors never see it. To run it, Cloudflare receives:

• your IP address
• a fingerprint of your browser’s secure connection (TLS)
• your browser type and version
• which page of ours you’re on

Cloudflare handles these signals for us as a service provider, and states it cannot identify you personally from them or use them to track you across other websites. It may set its own cookie. We only ever see the result as pass or fail. Turnstile does not run in the iOS app. For details, see Cloudflare’s Turnstile Privacy Policy.

Acting on your behalf. (App only) Signed in, the Concierge can call a venue by phone or send an email in your name. We keep a record of those — recipient, time, contents, and call transcript — so we can show you the outcome. Calls are only placed between 7 AM and 10 PM Eastern.

You don’t need an account to request a ride. Here is exactly what happens to what you enter.

What we ask for. Your name and phone number (required — the driver needs both to find you), your party size, where you’re going and optionally where you’re being picked up, your email address (optional, used to send you a tracking link), and any notes you want dispatch to know.

What the driver can see about you. Your first and last name, your phone number, your pickup address, your drop-off address, and your party size. That is the whole list. The driver does not receive your email address or the notes you leave for dispatch. Drivers have no app and no login, so they cannot browse other rides or look up past passengers.

We do not track your phone’s location during a ride. We match a driver by distance from the pickup address you gave us — not from live GPS.

What you can see about the driver. Once assigned: their first and last name, and the make, model, color, and license plate of the vehicle, so you can identify the car.

Your ride link. Your ride gets a private, unguessable web link — that’s what lets you check status without signing in. Treat it like a key. Anyone who has it can see the ride’s status, the pickup and drop-off addresses, and the driver’s details, and can cancel the ride. We don’t put your name or phone number on that page. If you forward the link, you’re sharing that access.

Who else touches ride data. The addresses you type are sent to Google Maps Platform to turn them into map coordinates. Confirmation and assignment emails go out through Amazon SES. Our dispatch staff can see the full ride record, including your name and phone number, in order to run the service.

Each of these has its own privacy policy governing what it does with data.

Everywhere

• Amazon Web Services — our servers, database, file storage, and outbound email (Amazon SES), in the United States. When Anthropic’s own service is unavailable, we may run the same Anthropic models through Amazon Bedrock.
• Anthropic (Claude) — the model behind the Concierge. Your messages are sent to Anthropic to generate a reply. Claude also helps us sort written survey answers and reviews, and helps us sort and answer email that reaches our team. (App only) This can include a rough note about where you are — a nearby town name and the names of up to three nearby places, in an order that has nothing to do with distance. No distances, no coordinates, and not your street address. See The Concierge.
• Stripe — payment processing. Card numbers go directly to Stripe.
• PostHog — product analytics. See Cookies.
• TelemetryDeck — privacy-preserving usage counts. Sets no cookies and stores no IP addresses.

Web only

• Vercel — hosting, plus Web Analytics and Speed Insights. Both are cookieless.
• OpenFreeMap / MapLibre — map tiles. Loading the map sends your IP address and the area you’re viewing to the tile host.
• Cloudflare — the bot check on the Concierge and the forms on this site.

Surveys and reviews

• Google (Gmail) — the inbox where our editors receive each new review, including the name and email address you gave, if any.

App only

• Apple — Sign in with Apple, maps, and push notification delivery. When you ask for directions, your location and where you’re headed go to Apple to calculate the route.
• Retell AI — places the Concierge’s phone calls to venues on your behalf.

Rides only

• Google Maps Platform — turns the pickup and drop-off addresses you type into map coordinates so we can match a nearby driver.

Strictly necessary

• Your sign-in cookie — set when you sign in so the site knows it’s you. It can’t be read by JavaScript.
• Concierge session — a short-lived token your browser holds while you chat. It closes with the tab.
• Cloudflare’s bot check may set its own cookie.

Analytics

• PostHog sets a first-party cookie and stores a matching value in your browser. It records which pages you view and automatically captures interactions such as clicks and form submissions — the element you interacted with, not what you typed. On your first visit we also record how you got here: the referring site and any campaign tags on the link. PostHog derives an approximate city or region from your IP address.
• Vercel Web Analytics, Speed Insights, and TelemetryDeck set no cookies.

Your browser’s settings let you block or clear cookies for this site. If you’d like us to exclude you from analytics, write to privacy@holler.guide and we’ll take care of it.

Your data is held on encrypted servers hosted by Amazon Web Services in the United States. Everything moves over HTTPS. Access to production data is limited to the people who need it to run the service.

No system is perfectly secure. If something goes wrong that affects your information, we will tell you.

How long we keep something depends on what it is and whether your account is still active. We remove personal information when you ask us to.

• Your account and its history — profile, saved plans, reservations, and Concierge records — stay with us while your account exists, and until you ask us to remove them.
• Ride records stay in our dispatch history after the trip ends, so we can answer questions about a past ride.
• Anonymous Concierge chats aren’t stored at all.
• Check-ins stay with your account while it exists, and until you ask us to remove them.
• Survey answers, reviews, and listing corrections stay with us until you ask us to remove them or we no longer need them for the guide. The scrambled IP code stays with the response it came with. Copies in our team’s inboxes stay there until we delete them, which we do when you ask.
• Analytics is held by PostHog, Vercel, and TelemetryDeck under their own schedules.
• Server logs, including IP addresses, are kept for troubleshooting and security.

What doesn’t go away when you delete your account

• Payment records at Stripe. We ask Stripe to delete your customer record, but Stripe keeps transaction records it is independently required to retain.
• Email delivery records at Amazon SES — and any email we sent you is in your own inbox.
• Backups, until the backup itself ages out.
• Anonymous, aggregated counts that can’t be traced back to you.

If you want something gone sooner than the above, write to us and we’ll do it.

You can ask us to:

• See what we hold about you
• Correct anything that’s wrong
• Delete your account and the personal information tied to it

You can also delete your account yourself: sign in and open Delete my account on your account page.

How deletion works. Some records clear automatically. Where your information is tied to someone else’s record — an experience you booked, a listing you host, a school or business account you belong to — we remove or disconnect it by hand, so that deleting your account doesn’t break another person’s booking. Records we keep for businesses or other people, such as signed proposals, sent emails and audit logs, are unlinked from your account. Some may still show your name where it was part of the record, and audit logs keep an internal account number. We confirm when it’s done. Some records survive deletion, for the reasons listed above.

Other choices

• (App only) Turn off location access any time in iOS Settings — this also stops the Concierge from receiving anything about where you are.
• (App only) There’s a Revoke Concierge Consent control under Profile → Data & Privacy in the app.
• (App only) Turn off push notifications in iOS Settings.
• Every non-essential email we send has an unsubscribe link.

Holler Guide isn’t built for children and isn’t directed at them. We don’t knowingly collect personal information from anyone under 13.

If you’re a parent or guardian and believe a child under 13 has given us information — through the Concierge, a ride request, a sign-up, a survey, a review, or a form on a place’s page — write to privacy@holler.guide with “Child privacy” in the subject and enough detail to find the record. We’ll confirm we received it, delete what we find, and tell you when it’s done. You don’t need an account to make this request.

We may update this policy. When we do, we’ll change the date at the top of this page, and for material changes we’ll tell you in the app or by email.

Questions, requests, or corrections:

Holler Software LLC, Woodville, Virginia.