Privacy Policy.

This policy describes the information practices of Creepy Hollow Woods and CreepyHollowWoods LLC (“Creepy Hollow Woods,” “we,” “us,” or “our”) for our website, ticketing, attraction operations, volunteer applications, staff apps, and related communications.

• Ticket purchases: purchaser name, email, phone number, selected ticket type, attraction date, order and payment status, fees, and transaction references.
• Insanity ticket holders: each holder’s supplied legal name and email, physical-ID acknowledgment, waiver status, ticket status, and support history. We do not collect or upload the holder’s ID through the website.
• Waivers: waiver version and cryptographic hash, typed legal name, normalized strokes from the drawn electronic signature, agreement statements, signing date and time, IP address, and browser/device information used to preserve evidence of consent.
• Volunteer applications: contact information, date of birth, address, school or organization information, availability, experience, emergency contacts, and health, allergy, medication, respiratory, seizure, strobe-sensitivity, or other safety information the applicant submits.
• News and communications: newsletter subscriber name, email, phone number, subscription status, and information included in messages or support requests.
• Website and security data: IP address, request headers, browser type, device information, timestamps, security and fraud signals, server logs, and authentication records.
• Local browser storage: shopping-cart contents, Insanity-requirement acknowledgment, and administrative display preferences. Cart storage can include holder names and email addresses entered before checkout and remains on that device until the cart is cleared or browser storage is removed.

Our staff apps use administrator-provisioned accounts. We process staff account identifiers, device identifiers, authentication records, attendance times, ticket scan results, cash sales, and related audit records to operate and secure staff tools.

With location permission, the app sends your location and accuracy when you check in or out. While you have a checked-in shift, it also checks and reports onsite presence, including while the app is in the background. Managers can view attendance and onsite status; the app does not display a live location map to managers. Background presence stops after checkout or sign-out. Attendance records may retain the location used for check-in and check-out.

Camera access reads admission QR codes. Camera images used for scanning are not uploaded; the decoded ticket identifier is sent for validation. Staff messages, replies, selected photo attachments, recipients, and read status are stored to provide workplace communications. Only photos you select through the system photo picker are attached.

Firebase Cloud Messaging and Apple Push Notification service process installation identifiers, notification routing information, and message payloads to deliver staff notifications. These notification SDKs also process technical diagnostics and service analytics to operate and improve notification delivery. Notification permission is optional, and staff messages remain available in the app. We do not use the staff app to track users across other companies’ apps or websites for advertising.

The app stores preferences and device identifiers locally. On physical iOS devices, saved sign-in credentials are protected using the system Keychain. Optional Face ID or Touch ID checks are performed by the operating system; we do not receive your biometric data. You can change camera, location, and notification permissions in device settings. Camera is needed for scanning and location for attendance; other staff tools remain accessible without those permissions.

Stripe processes payment-card information directly. Creepy Hollow Woods does not receive or store full card numbers or card security codes.

Creepy Hollow Woods does not use Stripe Identity for Insanity tickets and does not ask holders to upload an ID, selfie, ID number, or birth date through the website.

Every Insanity attendee must bring their original physical government-issued photo ID. Admission staff inspect it at entry to confirm that the attendee is the named ticket holder and meets the age requirement.

• Process payments, manage orders, and issue and scan tickets.
• Record Insanity physical-ID acknowledgments and waivers, prevent ticket misuse, and check age and identity at entry.
• Send confirmations, tickets, waiver invitations, daily reminders through the attraction date, operational notices, and requested marketing communications.
• Evaluate and manage volunteer applicants and protect participant health and safety.
• Operate, secure, troubleshoot, improve, and prevent abuse of our website and administrative systems.
• Meet legal, accounting, safety, insurance, dispute, and recordkeeping obligations and enforce our rules and agreements.

We share information only as needed to operate the services, protect people and the business, or comply with law. Service providers currently include Stripe for payments, Supabase for database and authentication services, Resend for transactional and requested marketing email, Vercel for website hosting and server execution, and Cloudflare Turnstile for bot and abuse protection, plus Google Firebase and Apple for staff push notifications. Links such as Google Maps are governed by the destination’s own privacy practices.

We may also disclose information to professional advisers, insurers, law enforcement, courts, regulators, or other parties when reasonably necessary for safety, legal compliance, fraud prevention, claims, or a business transaction. We do not sell personal information for money.

We retain records for only as long as reasonably necessary for the purposes described above, including ticket operations, safety, accounting, fraud prevention, legal claims, and waiver evidence. Different categories may have different retention periods. Volunteer health and safety information is restricted to authorized administrative access.

Some transaction, electronic-signature, waiver, safety, or legal records may need to be retained even when other information is deleted.

• You can unsubscribe from marketing messages using the provided unsubscribe method. Transactional, waiver, ticket, safety, and order messages are not marketing.
• You can clear cart and preference data through your browser’s local-storage controls.
• Depending on where you live, you may have rights to request access, correction, deletion, or a copy of personal information, or to object to certain processing.
• If you have trouble completing the electronic waiver, contact us or bring the confirmation email and original physical government-issued photo ID to the ticket counter. Admission remains subject to all attraction requirements and our right to refuse entry.

Insanity is limited to persons who are at least 18 on the attraction date. Other attraction offerings may be available to families. A parent or legal guardian should supervise a minor’s website use and ticket purchase. Volunteer applications may involve minors and should be submitted with any consent required by Creepy Hollow Woods.

We use administrative, technical, and physical safeguards designed to protect personal information, but no system can guarantee absolute security. We may update this policy as our operations, vendors, or legal requirements change. The effective date above identifies the current version.

To ask a privacy question or request access, correction, or deletion, use the Creepy Hollow Woods contact page. We may need to verify your identity before acting on a request.