Privacy Policy.

This policy describes the information practices of Creepy Hollow Woods and CreepyHollowWoods LLC (“Creepy Hollow Woods,” “we,” “us,” or “our”) for our website, ticketing, attraction operations, volunteer applications, and related communications.

• Ticket purchases: purchaser name, email, phone number, selected ticket type, attraction date, order and payment status, fees, and transaction references.
• Insanity ticket holders: each holder’s supplied legal name and email, verification status, verified legal name, whether the holder meets the age requirement on the attraction date, waiver status, ticket status, and support history.
• Waivers: waiver version and cryptographic hash, typed legal signature, agreement statement, signing date and time, IP address, and browser/device information used to preserve evidence of consent.
• Volunteer applications: contact information, date of birth, address, school or organization information, availability, experience, emergency contacts, and health, allergy, medication, respiratory, seizure, strobe-sensitivity, or other safety information the applicant submits.
• News and communications: newsletter subscriber name, email, phone number, subscription status, and information included in messages or support requests.
• Website and security data: IP address, request headers, browser type, device information, timestamps, security and fraud signals, server logs, and authentication records.
• Local browser storage: shopping-cart contents, Insanity-requirement acknowledgment, and administrative display preferences. Cart storage can include holder names and email addresses entered before checkout and remains on that device until the cart is cleared or browser storage is removed.

Stripe processes payment-card information directly. Creepy Hollow Woods does not receive or store full card numbers or card security codes.

For Insanity tickets, Stripe Identity collects and processes a government-issued identity document and matching selfie. Stripe may extract information including legal name and date of birth. Creepy Hollow Woods does not download or store copies of the ID, selfie, ID number, or birth date in its ticketing database. We retain the Stripe verification reference, verified legal name, and the result of whether the person is old enough on the attraction date.

Online verification does not replace the entry requirement. Every Insanity attendee must bring a physical government-issued photo ID to the attraction.

• Process payments, manage orders, and issue and scan tickets.
• Confirm Insanity age and identity eligibility, record waivers, prevent ticket misuse, and assist with manual review at entry.
• Send confirmations, tickets, verification invitations, daily reminders through the attraction date, operational notices, and requested marketing communications.
• Evaluate and manage volunteer applicants and protect participant health and safety.
• Operate, secure, troubleshoot, improve, and prevent abuse of our website and administrative systems.
• Meet legal, accounting, safety, insurance, dispute, and recordkeeping obligations and enforce our rules and agreements.

We share information only as needed to operate the services, protect people and the business, or comply with law. Service providers currently include Stripe for payments and identity verification, Supabase for database and authentication services, Resend for transactional and requested marketing email, Vercel for website hosting and server execution, and Cloudflare Turnstile for bot and abuse protection. Links such as Google Maps are governed by the destination’s own privacy practices.

We may also disclose information to professional advisers, insurers, law enforcement, courts, regulators, or other parties when reasonably necessary for safety, legal compliance, fraud prevention, claims, or a business transaction. We do not sell personal information for money.

We retain records for only as long as reasonably necessary for the purposes described above, including ticket operations, safety, accounting, fraud prevention, legal claims, and waiver evidence. Different categories may have different retention periods. Volunteer health and safety information is restricted to authorized administrative access.

Stripe retains Identity information under its role and policies. Where legally permitted and technically available, we can request redaction of a Stripe Identity session after it is no longer needed or in response to a valid deletion request. Some transaction, waiver, safety, or legal records may need to be retained even when other information is deleted.

• You can unsubscribe from marketing messages using the provided unsubscribe method. Transactional, verification, ticket, safety, and order messages are not marketing.
• You can clear cart and preference data through your browser’s local-storage controls.
• Depending on where you live, you may have rights to request access, correction, deletion, or a copy of personal information, or to object to certain processing.
• If you cannot or do not wish to use matching-selfie verification, contact us. Where appropriate, staff may offer a manual review at the ticket counter using the confirmation email and physical government-issued photo ID. Admission remains subject to all attraction requirements and our right to refuse entry.

Insanity is limited to persons who are at least 18 on the attraction date. Other attraction offerings may be available to families. A parent or legal guardian should supervise a minor’s website use and ticket purchase. Volunteer applications may involve minors and should be submitted with any consent required by Creepy Hollow Woods.

We use administrative, technical, and physical safeguards designed to protect personal information, but no system can guarantee absolute security. We may update this policy as our operations, vendors, or legal requirements change. The effective date above identifies the current version.

To ask a privacy question or request access, correction, or deletion, use the Creepy Hollow Woods contact page. We may need to verify your identity before acting on a request.