Privacy policy
Updated October 1, 2026. Applies to the Holler iPhone app and holler.run.
The short version. Holler uses your location only during an outing you start, and shows it to the people you choose. We don’t sell your data, show ads, or track you across other companies’ apps or websites. You can delete outings, your Medical ID, or your whole account from inside the app.
What we collect
- Account: your email address (you sign in with a one-time code we email you), an optional name shown to your Guardians, an optional phone number shown on your live link during an alert if you turn that on, and an internal account ID.
- Profile photo (optional): a photo you choose in Settings, resized to 512 pixels and stored privately. Only your Guardians who accepted your invitation and the people you watch can see it, through links that expire after an hour. Remove it anytime in Settings.
- Outings: your precise location while an outing you started is active, including in the background if you allow “Always” location. Also the activity type, start and end times, return time and check-ins, SOS, missed-return and no-movement alerts, and the private link. Your past outings (route, time, distance) are visible only to you.
- Outing briefs (optional): the plan, meeting point, signal notes and instructions you choose to share. Anyone with that outing’s live link can read its brief while the link remains accessible. Saved briefs for reuse are private to your account until you apply one to an outing. Briefs are included in your data export; deleting an outing deletes its brief, and deleting your account deletes your saved briefs. You can also remove saved briefs individually.
- Guardians: the names and email addresses of people you add, your confirmation that they agreed to hear from you, invitations and whether they accepted, their notification settings, and any “I’m checking on them” responses (with the name they type, if any). If a Guardian unsubscribes, we keep their email address so we can honor that.
- Text alerts (Guardians who opt in): the mobile number a Guardian enters on their invitation page, the exact consent wording they agreed to and when, hashed (not readable) copies of their IP address and browser, and whether that number replied STOP or START.
- Medical ID (optional): the emergency contact, allergies, conditions, medications, blood type and notes you type. It is private unless you turn on sharing, and then it shows on your live link only while an alert is active.
- Notifications: your device’s push token or browser push subscription, and delivery records for Guardian emails and notifications so alerts aren’t sent twice.
- Reliability reports (optional): if you enable “Share reliability reports”, we collect check outcomes, alert delivery and acknowledgement timing ranges, tracking gaps, battery-use ranges, activity type, GPS mode, app version and a general device model. Reports are linked to your account and timestamped when received. They do not contain coordinates, routes, names or free-text answers. Turning this option off stops reports and removes the account link from previously stored reports.
- Crash-detection tuning (separate optional setting): if you enable “Help improve crash detection”, we collect short motion and speed samples around possible impacts, detector settings and outcomes. This includes samples from a detector being evaluated in the background. Samples are linked to your account and timestamped when received, but exclude coordinates, routes, names, audio and anything you type. Turning this setting off deletes your uploaded tuning samples.
- Voice check-in (optional): speech recognition runs on your phone while an “Are you OK?” check is on screen. Audio and transcripts are not saved or uploaded. If on-device recognition is unavailable, Holler does not fall back to cloud transcription. If reliability reports are enabled, an outcome such as “OK” or “help” can be recorded without the audio or transcript.
- Subscriptions, when available: Apple and RevenueCat process in-app purchases; Stripe processes web checkout. Holler stores account-linked subscription, transaction and entitlement records to provide access and handle purchase support. We do not receive your full payment-card details. Paid checkout is not enabled in the current beta.
- Website: if you join the iPhone waitlist, your email and a hashed, rotating key for rate limiting. holler.run uses Vercel Web Analytics (cookieless page counts) on public pages. Private app, live-link and invitation pages are excluded. The app has no advertising SDK; its optional diagnostic reporting is described above.
- Email you send us: messages to addresses at holler.run are received by Resend and forwarded to our support inbox so we can reply.
- Service logs: our providers keep standard request and sign-in logs (such as IP address and time) for security.
We don’t access your address book, photo library, Apple Health, camera or advertising identifier (you pick a profile photo yourself, and only that one image is uploaded). The microphone is used only for the optional on-device “Are you OK?” voice check. Holler does not contact emergency services for you.
How we use it
Only to run Holler: sign you in, share your outing with the people you choose, send their alerts and notifications, show your history, answer support email, manage subscriptions when available, improve reliability when you opt in, and keep the service secure. No advertising, no profiling, no tracking.
Who can see it
- Anyone with an outing’s private link sees your name, location, recent route, return time, shared outing brief and alert status while the outing is active (and, during an alert, your phone number and Medical ID if you turned those on). Ordinary links close when you end the outing or it expires. If an alert is open at that point, the link, route and last location remain readable for up to 24 hours after closure, including after you mark yourself safe. Marking yourself safe hides the alert, phone number and Medical ID; deleting the finished outing closes its link. Share links only with people you trust.
- Guardians who accepted your invite (or verified the email you added) can see your active outings and your profile photo in their own Holler account, but not your history. You can see the profile photo of each Guardian who connected their account, and of each person you watch.
- Service providers (below) that help us run Holler.
We don’t sell or rent personal information or share it with data brokers.
Service providers
| Provider | What it does |
|---|---|
| Supabase | Sign-in, database and background jobs. |
| Cloudflare Turnstile | Checks sign-in attempts for automated abuse when enabled. It receives browser and network signals, such as IP address, but no Holler password or outing location. |
| Vercel | Hosts holler.run and its web analytics. |
| Resend | Sends sign-in codes and Guardian emails, and receives email sent to holler.run. |
| Google (Gmail) | Hosts the support inbox where email to holler.run is forwarded. |
| Expo (650 Industries) | Relays iPhone push notifications and delivers app updates. |
| Apple | Delivers push notifications and draws maps (MapKit) in the app and on the live link. |
| Stripe | Processes Holler Plus payments on holler.run and calculates sales tax. It receives your email, billing address and card; Holler never sees your full card number. |
| RevenueCat | Checks Holler Plus purchases made in the iPhone app. It receives your Holler account id and purchase receipts, not your location. |
| Browser push services | Deliver web notifications if a Guardian turns them on. |
Text messages are not being sent yet. When they are, Twilio will deliver Guardian text alerts and receive STOP, START and HELP replies, and we’ll add it to this table.
Keeping and deleting data
- Abuse prevention: short-lived counters use hashed email addresses to limit repeated invitations, account recreation and device registration. These counters can survive account deletion. Limits expire after 24 hours; counters become eligible for automatic cleanup after two days. They contain no location history or message content.
- Outings and Medical ID stay until you delete them (Settings → Outing history, Settings → Medical ID, or the web dashboard). An outing that is live or still showing an alert can be deleted once that is over.
- Delete your account in the app (Settings → Delete account permanently) or on the web dashboard. This closes live links and removes your profile, profile photo, Guardians, Medical ID, outings, location history, alerts and devices from our database.
- Optional diagnostic data: turning off reliability reports removes their account link, but the unlinked reports may remain for analysis. Turning off crash-detection tuning deletes your uploaded tuning samples. Account deletion removes tuning samples and removes the account link from reliability reports.
- Backups may keep deleted data for up to 90 days before it is overwritten.
- Waitlist and support emails are kept while we need them, and removed on request.
Guardians
If someone added you as a Guardian, every Holler email has a link to stop emails from that person, no account needed. You can also turn off app or browser notifications per person in your Holler account.
Text message alerts
- Opt-in only. Holler texts a Guardian only after they enter their own mobile number on their invitation page and tick an unticked consent box. The person who added them cannot turn texts on. Consent is not a condition of anything.
- What we send. Safety alerts for that person’s outings only: SOS, a missed check-in, a no-movement alert, and when they mark themselves safe, plus a one-time confirmation. No marketing. Message frequency varies, typically a few per month. Message and data rates may apply.
- Stopping. Reply STOP to any Holler text to stop all Holler texts to that number, for every person who added you. We keep the number on our opt-out list so it stays stopped. Reply START to resume texts you previously agreed to, or HELP for help.
- We do not share or sell mobile phone numbers or SMS opt-in consent with third parties for marketing. Numbers are used only to send the alerts you chose, through our SMS provider.
Your rights and contact
Download your data yourself anytime: Settings → Export my data in the app, or Download my data at holler.run/app/settings. You get one JSON file with your profile, Medical ID, Guardians as you entered them, outings with routes, alerts and who responded, Home places, presets and notification settings. Private links, security tokens and other people’s private details are left out.
You can ask to access, correct, export or delete your information at hello@holler.run, and you may have extra rights where you live (for example under the GDPR or CCPA). Most things you can also do yourself in the app; see Support.
Holler is not directed to children under 13 and we don’t knowingly collect their information. If you think a child under 13 has an account, contact us and we’ll delete it.
We may update this policy as Holler changes; the date at the top shows the latest version.