Privacy policy

1. What we collect

If you visit the website

• Usage data. Pages you visit, rough location from your IP address, your browser and device, and when. Our hosting and security provider (Cloudflare) sees every request, and measures page speed without cookies. With your OK in the cookie notice, Google Analytics measures how the site is used with cookies; without it (or if your browser sends Global Privacy Control), nothing is sent to Google Analytics and no analytics cookies are set. Some reviewers' photos load from Google's servers, which see your IP address.
• Your settings. Your light or dark theme and your cookie choice, kept in your browser.

If you join the waitlist

• Your email address, the page you joined from, and that page's activity and place, or the place you searched for there or named to our concierge, as you typed it (for example, fishing in Montana). Your IP address is used only to limit how often the form can be sent.

If you ask our concierge to find a guide

• Your contact. The phone number or email address you write to us from.
• Your messages. What you write to us and what we write back, with times and delivery status.
• Your request. What you tell us about the trip you want: the activity, where, dates (or your words for them), how many people, a note, and your name. Request to book on a guide's page writes these into a message in your own messages or email app: we get it only when you send it, and the page keeps none of it.
• Your consent. Before we pass a request to any guide, we ask you in fixed words, and keep a record of the question, its version, your answer, and when.
• What our concierge remembers about you. So you don't have to repeat yourself next time: what you told it you want (the activity, where, when, your group, experience, budget, and short notes), the guides it suggested and the ones you said no to, the trips you booked through it, and, to answer your questions about them, the trip group chats you're in. Guides never see it. Ask our concierge what it knows about you anytime, or ask it to forget you.

If you book a trip on a guide's page

• Some guides on Barb take bookings right on their page here (Book now). What you enter goes, through our server, to Barb, the booking service the guide uses: the trip, date, and time you pick, how many guests, your name, email, mobile number, and any notes, your choices about texts, and that you agreed to the booking terms. Only if you turn texts on, your IP address and browser are kept with that opt-in as evidence of it. Your IP address is also used, for a day at most and not kept with your booking, to limit how many bookings can be made from one place.
• Your booking goes to that guide. The guide's Barb holds it for them and sends your booking updates (by text only if you turned texts on, otherwise by email), under Barb's privacy policy (barbed.ai/privacy). You pay at secure checkout, through Stripe; we never see your full card number.

If you sign in to see your trips

• The phone number or email address you sign in with, and a one-time code we text or email you (kept for 10 minutes, used once). We only send a sign-in code to a number or address we already know from your trips, requests, or messages with Barb.
• Your other numbers and emails. When you add another number or email of yours on the page, we send it a code to make sure it's yours, then link them: signing in with any shows all of them, and the others get a message that one was added. Taking one off unlinks it.
• What you do there. A change or cancellation goes through your guide's Barb, as if you'd texted it, and your guide is told. A message you write to a trip group chat is kept with the chat and sent to everyone in it by text, from you. A tip by card goes through Stripe to your guide.
• While you sign in, a cookie holds the number or address you typed for 15 minutes, until you enter the code. Then a sign-in cookie keeps you signed in for up to 30 days: it says who you are (your number or address) and nothing else, and you can sign out here or everywhere at once. To stop code guessing and texting abuse, we count code requests by your number or address and your internet address for a day. The page shows your trips with guides on Barb, your requests, your trip group chats, and what our concierge remembers about you, to you alone.

If you sign in with Google, Apple, or Facebook

• Where we offer it (today: Apple and Google in the Barb Outdoors app), you can sign in with your Google, Apple, or Facebook account instead of a code. We get only what that account shares for signing in: your name, your email address (with Apple, possibly a private relay address), whether that email is confirmed, an ID for your account with them, and, with Google, your profile picture. We keep only the account ID and email, and, with Apple, a token Apple gives us (kept encrypted) so that when we forget you (you ask, or a year after you last wrote or signed in), we also end Barb Outdoors' sign-in at Apple; your name and picture aren't kept. We don't get your password, contacts, photos, posts, calendar, or anything else from those accounts, and we never post or do anything there for you.
• We use it only to sign you in and to link the sign-in to your trips. If that email already belongs to someone on Barb Outdoors, we send a code to that email first, so no one can take over another person's trips. We don't share it with anyone or use it for advertising.
• Google. Barb Outdoors' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Stopping it. Sign out, or remove Barb Outdoors from your Google, Apple, or Facebook account's connected apps; then that account can't sign you in. To delete the account ID and email we keep, ask us to forget you (section 6); with Apple, that also ends Barb Outdoors' sign-in there, as deleting it after a quiet year does.

If you use the Barb Outdoors app

• Signing in. In the app, you sign in with a one-time code by text or email, as on the site, or with your Apple account (on iPhone) or Google account, as described above. Facebook sign-in isn't in the app.
• Staying signed in. After you sign in, the app keeps a session token in your phone's secure storage (the iPhone's Keychain, or Android's encrypted storage) and sends it with each request. It says who you are (your number or address) and nothing else, lasts up to 30 days, and is deleted from the phone when you sign out. Signing out everywhere, or having Barb forget you, ends it on every phone.
• Notifications. Only if you allow notifications, the app gives us your phone's push notification token, with the app version and whether it's an iPhone or Android phone, so we can tell you about Barb's replies, your bookings and trips, and new messages in your trip group chats. Apple or Google delivers them to your phone.
• The install ID. When it's installed, the app makes a random ID for that install and sends it with each request, with the app version and whether it's an iPhone or Android phone. We use it to limit how often things can be done from one phone, to make sure a sign-in finishes on the phone it started on, to send notifications to the right phone, and for app usage (below), where we keep only a scrambled code of it. It isn't your phone's advertising ID or anything else from the phone itself, and deleting the app deletes it.
• Checking it's the real app. When you sign in, the app may ask Apple (on iPhone) or Google (on Android) to confirm it's a genuine copy of the app on a real phone, and sends us their answer with a request for a code by text, so no one can make us text codes to numbers they choose. On iPhone we keep the key the app makes for that install; it says nothing about you.
• App usage. The app tells us when you open it, which of its screens you open, when you take certain steps (such as signing in, starting or making a booking, sending a message, or opening a notification), and, when something goes wrong, what kind of problem it was (such as no connection), with the app version, whether you use an iPhone or Android phone, and an ID for that install of the app. It never sends what you search for or type, or who you're writing to beyond whether it's Barb or a group chat. We use it only to understand how the app is used and to fix and improve it. It's linked to your account when you're signed in, isn't sold or shared with anyone else, and isn't used for advertising.

If someone adds you to their trip

• The person who booked can add the people coming with them. We keep the name, phone number or email address they give us for you, and when you were added, emailed, reminded, or taken off. Your guide sees your name and contact on their trip list. If we have your email, we send you the trip's details, a reminder before the trip, and word if it moves or is called off; every one has a link to stop them. We never text you because of this. With that number or email, you can sign in to see the trip.
• We clear your phone and email from the trip 30 days after it (or when you're taken off it, or ask us to forget you); your name stays on the guide's record of the trip. Ask us to remove you sooner at [email protected].

If you review a trip

• Your rating and review, how you chose to show your name (first name and last initial, or "A client"), whether you agreed to publish it, and a scrambled code made from your device's address and browser (to spot one person writing many reviews). The review stays linked to your booking.

If you report a review, or claim or remove a listing

• What you tell us; your name, email, and phone if you give them; and, as evidence, your IP address (and, for claims and removals, your browser).

About businesses we list

• We build listings from public information about guide businesses: their websites, public directories and maps listings, and public reviews. That can include a business's name, description, area, activities, prices, ratings, photos, website, phone number, email address, and street address. Some of it (phone numbers, email addresses, street addresses) is never shown publicly unless the business claims its listing and chooses to show it. See For businesses we list.

2. How we use it

• To run the site and the apps, and show guides.
• To answer you and find guides who fit your trip. Our concierge is an automated assistant: it uses an automated service (Anthropic's Claude) to read your messages and write replies. It looks at our listings and, for you alone, at what it remembers about you, the trips you booked through it, and the trip group chats you're in (only the messages that reached you).
• To pass your request to the guides you choose, only after you say yes, and to tell you how it went.
• To email a business we list that a client asked to book it (never with the client's name or contact).
• If you join the waitlist, to email you that you're on it, and once when guides are bookable.
• To check and show reviews, and to handle reports, claims, and removals.
• To keep the service safe: limits on how often things can be done, records of what happened, and spotting abuse.
• To meet legal duties.

We don't sell your personal information, share it for anyone's advertising, or use it for advertising ourselves. Anthropic doesn't use what we send it to train its models.

3. Who we share it with

• The guides you choose. When you say yes to sending a request, each guide you chose gets your name, how to reach you, and what you asked for. A guide on Barb gets it through their Barb, and their Barb may text or email you about that trip. A guide not on Barb yet first gets an email saying a client asked for a trip, without your name or contact; they get those only if they sign up and claim their listing. A guide uses what you send under their own privacy practices.
• The guide you book, and their Barb. When you book on a guide's page, your booking and how to reach you go to that guide through their Barb, which handles the booking under Barb's privacy policy (barbed.ai/privacy). The guide uses them under their own privacy practices.
• Your guide, for the people on your trip. The names and contacts of the people you add to a trip go to that trip's guide, for their list of who's coming.
• Everyone, for published reviews. A review you agree to publish is shown on the guide's page with the name you chose. When it goes up, we let the guide know, and they can post a public reply under it.
• Service providers, each getting only what it needs: Twilio (texts and the automated calls that read out claim codes), SendGrid (email), Anthropic (the concierge's replies), Stripe (payments for bookings and tips), Apple and Google (signing you in with your account there, delivering the app's notifications, and checking it's the real app), Cloudflare (website delivery, security, photos, and page-speed measurement), DigitalOcean (servers and database), Google (analytics as our service provider, with advertising features off), and Sentry (error reports, which can include data from the request that failed).
• The law, and a sale of the business. When the law requires it, or if Barbed.ai LLC is merged or sold (with notice).

4. Texts and email

From Barb Outdoors' own number and email address, we text or email you only after you write to us first (or ask to join the waitlist), and only about finding and booking your trip. Texts about a trip you book on a guide's page come from that guide's Barb number, only if you turned texts on when you booked, under Barb's SMS terms (barbed.ai/sms-terms). Reply STOP to any text to stop them from that number, or reply "stop" to an email. See the SMS terms. Mobile information and text opt-in data are never shared with anyone for their marketing.

The waitlist is email only: one email to say you're on it, and one when guides are bookable. Each has an unsubscribe link. We never text you because of it.

5. How long we keep it

• Requests: your name and contact come off a request 90 days after it ends (sooner if you ask). A request left open 180 days is closed and cleared. The request itself stays, without them, as a count.
• Consent questions: what you asked for is forgotten from a question 7 days after it's asked, its words after 90 days, and a question that never led to a request is deleted after 90 days. The record of your yes stays with any request it made.
• Messages with our concierge: deleted a year after your last message, or sooner when you ask. What it remembers about you: deleted a year after you last wrote to us or signed in, or sooner when you ask.
• Reviews: kept with the trip's record. Taking yours back with the link we sent you takes it down; we keep it on our record unless you ask us to forget you.
• People added to a trip: their phone and email come off the trip 30 days after it, or when they're taken off it; their name stays on the guide's record of the trip. An address that stopped our trip emails is kept as a scrambled code, so they stay stopped.
• Your linked numbers and emails: kept together while you use the page, deleted with what our concierge remembers, or when you take one off or ask us to forget you.
• Google, Apple, or Facebook sign-in: the account ID and email we got from it (and Apple's token) are kept while you use Barb Outdoors, and deleted when you ask us to forget you, or with what our concierge remembers about you.
• Bookings made on a guide's page: Barb Outdoors keeps no copy of its own. The booking, and the record of your choices about texts and the booking terms, are kept by Barb for the guide, as Barb's privacy policy describes (booking and payment records for up to 7 years, as the law requires).
• App usage: kept for 90 days, then only as daily totals that don't identify anyone. Having Barb forget you deletes yours.
• Your phone's notification token: deleted when you sign out in the app, when you ask us to forget you, or with what our concierge remembers about you.
• The waitlist: your email is kept until you unsubscribe, ask us to delete it, or ask us to forget you. Then we keep only a scrambled code of it, with the dates you joined and left, so it's never emailed or added again. Once guides are bookable and we've sent that email, the rest of the list is deleted 90 days later.
• Review reports: your email and IP address are cleared 90 days after we resolve the report.
• Claims and removal requests: the details you give are cleared a year after the request, once it's been answered.
• Businesses that asked to be removed: we keep a scrambled code of their phone and email, and their website address and source references, so they aren't added back. Businesses that asked not to be emailed: we keep a record of that, and a scrambled code of the address.
• Security records: a record of what happened (for example, that a request was sent or a review was approved) is kept as long as needed to keep the service safe and to show we followed the law.

6. Your rights

Wherever you live, you can ask to see, correct, or delete your personal information. To have us forget you on Barb Outdoors, email [email protected] with the phone number or email address you used; we'll call off your open requests, clear your contact from them, take down your reviews, close your open questions, and delete your messages with our concierge and what it remembers about you, your Google, Apple, or Facebook sign-in, your phones' notification tokens, your app usage, and your email on the waitlist; every sign-in ends. You can also do it yourself: sign in to Your trips (barboutdoors.com/account) and use "Have Barb forget you". We answer within 30 days, and first check it's you by asking you to confirm from that phone number or email address. You can also reply STOP to any text, and turn analytics cookies off with "Cookie settings" at the bottom of any page.

You can also ask our concierge itself to forget you. It asks you, in fixed words, to reply DELETE with a code it sends you; your DELETE and that code, from the same phone number or email address, do all of the above at once, for every number and email linked to it. Each code works once, for an hour. After a few asks in a month without the code, it asks you to email [email protected] instead.

7. California residents

Under the California Consumer Privacy Act, you have the right to know what personal information we collect, use, and share; to delete it; to correct it; and not to be treated differently for using these rights. We collect the categories listed in section 1 (identifiers like a phone number, email, or app install ID, the content of messages and reviews, booking details such as the trip, date, guests, and notes for a trip you book on a guide's page, and internet activity on our site and in our apps, including IP addresses and browsers) from you, from your device, from the guides you contact (their replies), and, for businesses we list, from public sources. We use them for the purposes in section 2, keep them as in section 5, and share them with the categories of recipients in section 3. We don't sell personal information or share it for cross-context behavioral advertising. To make a request, email [email protected]; someone you authorize can make it for you with your signed permission. We honor Global Privacy Control: if your browser sends it, we treat it as a no to analytics cookies. Our site doesn't respond to Do Not Track signals.

We don't ask for sensitive personal information or use it to infer anything about you. If you tell us something sensitive, like a health condition that matters for a trip, we use it only to answer you and to pass on your request to the guides you choose.

8. If you're in the EEA, UK, or Switzerland

Barb Outdoors is for trips in the US, but you can use it from anywhere. If you're in the European Economic Area, the United Kingdom, or Switzerland, and data protection laws such as the GDPR apply to how we handle your information, this section explains how. Barbed.ai LLC is responsible for your information on Barb Outdoors. A booking you make on a guide's page is handled under Barb's privacy policy (barbed.ai/privacy), and a guide uses what you send them under their own privacy practices.

Why we use your information.

• To give you what you ask for (contract): answering you and finding guides, signing you in, passing on your requests, and the messages you ask for, such as our concierge's replies.
• Our legitimate interests: keeping the service safe and preventing fraud and abuse (limits on how often things can be done, and records of what happened), service messages such as a link to review your trip, what our concierge remembers so you don't have to repeat yourself, listing guide businesses from public information and emailing them, improving Barb Outdoors (such as app usage and error reports), and keeping the records US law requires of us, such as records of your consent to texts. You can object to these (below).
• Your consent: analytics cookies, the waitlist's emails, texts about your booking and about a guide's future trips when you turn them on, sending your request to the guides you choose, publishing your review, and the app's notifications. You can withdraw your consent at any time; this doesn't affect what we did before.

Your rights. You can ask us to give you a copy of your personal information, correct it, delete it, or send it to you in a format you can take elsewhere (portability). You can also ask us to restrict how we use it, object to how we use it for our legitimate interests, and withdraw any consent you gave. You can complain to the data protection authority where you live or work (in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner), though we'd like the chance to help first.

Transfers to the US. We and the service providers in section 3 handle your information in the US, and some providers in other countries too. Where the law requires a basis for this, we rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss counterparts, where a provider is certified to them) for Twilio, SendGrid, DigitalOcean, Sentry, and Google; on both it and the European Commission's Standard Contractual Clauses for Stripe; on the Standard Contractual Clauses for Anthropic and Cloudflare; and for Apple, as described in their data processing terms. Email us for a copy.

How to ask. Email [email protected], or use the ways in section 6 and on Delete your data (in the app, on Your trips, or by asking our concierge to forget you). We answer within 30 days, and first check it's you by asking you to confirm from your phone number or email address.

9. Security, and where we are

We protect what we keep with encryption in transit, limited staff access, and providers held to security commitments. No system is perfectly secure; if a breach affects you, we'll tell you as the law requires. Barb Outdoors is for trips in the US and is run from the US, so your information is handled in the US.

10. Children

Barb Outdoors is for adults. We don't knowingly collect information from anyone under 18. If you think a child has given us information, email [email protected].

11. Changes

We'll post any change here with a new date.

Contact

Barb Outdoors is run by Barbed.ai LLC. Email [email protected].