OHVTrips Privacy Policy

Effective date: TODO: EFFECTIVE DATE

This policy explains what information OHVTrips (ohvtrips.com), operated by AJW Ventures LLC ("we," "us"), collects, how we use it, and your choices.

Short version: we collect only what we need to run a trip planner. We don't sell your personal information. You can ask us to delete your data at any time by emailing hello@ohvtrips.com.

1. What we collect

Information you give us

• Email list: your email address (and name, if you provide it) when you sign up for launch news or updates.
• Account and saved itineraries: if you create an account or save trips, your login details (such as your email) and the trips, routes, and notes you save. TODO: Confirm whether accounts launch at go-live.
• AI trip guide: the questions you type into the AI guide and its answers are sent to xAI to generate each reply (Section 4). We don't store the text of your conversations on our servers. Your chat history stays in your open browser tab and is gone when you close it. For each request we keep only a usage log: a scrambled (hashed) version of your IP address, your user ID if you're signed in, which guide feature was used, the AI model, the amount of processing (tokens), the cost, timing, whether the request succeeded, and a short technical status note (such as "started" or a brief error code or message). We use it to prevent abuse and manage costs. The usage log never includes what you typed or the guide's answers.
• Shared trip pages: if you share a trip, we create a hard-to-guess link to a page showing that itinerary.
• Itinerary emails: if you ask us to email an itinerary to yourself, the email address you enter and a record that the email was sent.
• Photo uploads: photos you upload, captions, any credit name you provide, and the photo's file data (see Section 4 on location data).
• Shop orders (merch): if you buy something in our shop, we collect your name, shipping address, and email address, and what you ordered (items, sizes, quantities, prices, sales tax, and shipping). We don't collect your phone number. Your card details go directly to Stripe, our payment processor. We never see or store your full card number. We receive only a payment confirmation, the amount, and (from Stripe) the card brand and last four digits.
• Tips: if you use the "Tip the trail crew" link, you pay on a Stripe payment page (a Stripe Payment Link). Stripe collects your payment details and email. We receive the amount, the date, and the name or email you give Stripe. Tips are voluntary payments to AJW Ventures LLC. They are not charitable donations and they are not tax-deductible.
• Messages to us: anything you send us by email.
• "Suggest a correction" form: the category you pick, the details you type, a snapshot of the page information you're correcting, your email address if you choose to give it for follow-up, and whether you checked "I'm the business owner." To stop spam and abuse, we also record a scrambled (hashed) version of your IP address, which we use only to limit how many corrections can be sent (currently 5 per hour and 15 per day). Corrections are stored privately and are never shown publicly. Please don't include sensitive personal information in a correction.

Information collected automatically

• Usage and device data: pages viewed, the page address (including campaign tags such as utm_source), referring site, approximate location (country, region and city, derived from your IP address), browser, operating system, and device type, collected through our analytics tool and server logs. Our analytics doesn't use cookies and doesn't store your IP address.
• Cookies and similar tech: used to keep the Site working, remember preferences, track affiliate referrals, and (if we run ads) show and measure ads. We don't use cookies to measure traffic. See Section 5.
• Affiliate link clicks: when you click a lodging, activity, or gear link, the partner or its affiliate network (such as Stay22 and the booking site it sends you to, or GetYourGuide) learns that you came from OHVTrips and may set its own cookie. We don't log your clicks on these links ourselves. Some lodging and activity links are prefilled with the trip details you entered (such as dates, number of adults and children, and the trip area) so the partner's search opens ready to go. Those details go to the partner when you click. We never pass your name, email, or payment details to partners.
• Location (only if you allow it): if you choose to share your device location on the map, we use it to show nearby trails. TODO: Confirm whether location is stored; if not, say "we don't store it."

2. How we use it

• run the Site, save your trips, and answer your AI guide questions;
• create shared trip pages and send itinerary emails you ask for (an itinerary email is a one-time message, and we won't add your address to our mailing list unless you sign up separately);
• send launch news and updates you signed up for (you can unsubscribe any time);
• review and display photos;
• understand how the Site is used and improve it;
• track affiliate referrals and featured-listing performance (so partners can pay us);
• take and fulfil shop orders: process payment and sales tax through Stripe, send your order to Printful to print and ship, send order confirmations and shipping updates, handle returns and support, prevent fraud, and keep the tax and accounting records the law requires;
• show "People also rode" suggestions, using only aggregate counts of trails saved together (Section 4B);
• review corrections you send, update the Site's information, and follow up with you if you gave us your email (we won't add it to our mailing list unless you sign up separately);
• keep the Site secure and prevent abuse;
• comply with law and enforce our Terms.

3. Who we share it with

We share information only with service providers that help us run the Site, partners as described below, or when required by law:

Shop orders. We share your order information only with Stripe (payment and tax) and Printful (printing and shipping), and Printful passes your name and address to its shipping carriers. We don't share it with anyone else, and we don't use it to add you to our mailing list unless you sign up separately. Stripe's privacy policy is at https://stripe.com/privacy and Printful's is at https://www.printful.com/policies/privacy.

Each provider handles data under its own terms and privacy policy. We may also disclose information to comply with law, respond to legal process, protect safety, or as part of a sale or reorganization of the business (the buyer would be bound by this policy for data collected under it).

We don't sell your personal information, and we don't share your email list with advertisers.

4. AI trip guide: please don't enter sensitive info

Messages you send to the AI guide, together with the chat history from your open browser tab, are sent to xAI with each request so it can generate a reply. xAI processes them under its own API terms and privacy policy. xAI's published API policy (checked Oct 27, 2026) says it stores API requests and responses for 30 days for auditing in case of suspected abuse or misuse, then deletes them automatically, and that it doesn't train its models on API inputs or outputs without permission. xAI may keep data longer where the law requires or a request is flagged for a safety or compliance review. See https://docs.x.ai/developers/faq/security. TODO: TO-DO for Iris: if AJW turns on xAI's Zero Data Retention option, replace the 30-day sentence with "xAI doesn't store them after the reply is delivered."

We don't store the text of your conversations. Your chat history lives only in your open browser tab and disappears when you close it. We keep only the usage log described in Section 1, which never contains what you typed, and we delete it after 90 days. If you save an AI-suggested plan to your trip, we save only the stops (the place, day, and time, and a note that the AI guide suggested it), and that becomes part of your saved itinerary.

Don't enter sensitive personal information into the AI guide, such as health information, financial or ID numbers, or exact home addresses.

4A. Shared trip pages

When you share a trip, anyone who has the link can see that itinerary (routes, dates, stops, and notes you've included), even without an account. The link is hard to guess, and we ask search engines not to index shared pages, but anyone you give it to can pass it on. You can turn sharing off or create a new link at any time, and the old link will stop working. Don't put anything in a shared trip that you wouldn't want others to see, such as your home address or when your house will be empty.

4B. "People also rode" suggestions

Some trail pages show "People also rode" suggestions. To build them, a nightly job counts how often pairs of trails are saved together in saved itineraries. This is aggregate only:

• a pair is kept and shown only if it appears in at least 5 different trips saved by at least 5 different users;
• the results table holds only the two trails, the two counts, and the date it was last updated. It holds no user IDs, trip IDs, email addresses, dates, or notes;
• pairs below the threshold are never stored or shown;
• the counts are rebuilt in full each night from current saved trips, so a trip you delete drops out of the next count.

We keep these counts de-identified, use them only to suggest trails, and don't try to re-identify anyone from them. Your saved itineraries themselves are not shown to other users (except through a share link you create, see Section 4A). Because the counts contain no personal information, there is no separate opt-out. You can delete your trips at any time.

5. Cookies, analytics, affiliate links, and ads

• Essential cookies keep you logged in and the Site working.
• Analytics: we use Vercel Web Analytics, which doesn't set cookies or store your IP address. It counts page views so we can see which pages are used, and gives us only aggregated statistics. We don't use Google Analytics, the Meta (Facebook) pixel, or other advertising trackers. If we ever add one, we'll update this policy first and ask for your consent where the law requires it.
• Affiliate links: when you click a partner link, the partner (or its affiliate network, such as Stay22 or GetYourGuide) may set or read a cookie to credit OHVTrips if you buy or book. That cookie is set by the partner, under its own policy, and the partner may collect information directly from you and may show you ads. We don't control those cookies. Stay22's links pass through Stay22's redirect before reaching the booking site, so both Stay22 and the booking site may set cookies (Stay22's privacy and cookie policies: https://www.stay22.com/privacy and https://www.stay22.com/cookies). GetYourGuide uses its own first-party cookie, which credits us for bookings within about 31 days of your click (GetYourGuide's partner help center). If we later join Amazon Associates or impact.com, those networks set their own cookies too (Amazon's Privacy Notice is linked from amazon.com, and impact.com's is at https://impact.com/privacy-policy/). We mark affiliate links "(paid link)". See our Affiliate & Advertising Disclosure.
• Sharing and social links: when you use Share, the link you copy or send carries a tag (such as utm_source=share) so we can tell shared visits from other traffic. The tag doesn't identify you. Links we post on social media carry similar campaign tags, and your browser keeps the first tag you arrived with in temporary session storage, which clears when you close the tab. We don't set a cookie for it. Our analytics may count that tag as part of the page address, without identifying you. We don't record when you press Share.
• Ads: if we show ads, ad networks may use cookies to show and measure ads, which may be based on your visits to this and other sites. [If Google AdSense is used, add: "Google's use of advertising cookies lets it and its partners serve ads based on your visits to this and other sites. You can opt out of personalized advertising at https://adssettings.google.com." and link "How Google uses information from sites that use its services."]

You can block or delete cookies in your browser settings, and you can opt out of many interest-based ads at https://optout.aboutads.info. Blocking cookies may break some features.

6. Photos and location data

Phone photos often include hidden location (GPS) data. We remove location metadata from uploaded photos before they're displayed TODO: TO-DO for Iris: implement EXIF/GPS stripping before launch; until then, change this sentence to tell users to remove location data themselves. Remember that a photo itself can reveal where it was taken.

7. How long we keep it

• Email list: until you unsubscribe. After that, we keep only your email address on a do-not-email list so we never add you back or email you again.
• Account and saved itineraries: while your account is active, and deleted within TODO: 30 days after you ask us to delete it.
• AI guide conversations: not stored by us. Chat history stays in your browser tab. xAI's own retention is separate (Section 4).
• AI guide usage logs (hashed IP, user ID if signed in, feature, model, tokens, cost, timing, success flag, short status note; never message text): 90 days, then deleted by a nightly job.
• Saved trips made from an AI plan (stops only): kept like any saved itinerary (above).
• "People also rode" counts: no personal information. Rebuilt each night (Section 4B).
• Shop orders (name, shipping address, email, items, amounts, sales tax): TODO: X years: CPA to confirm. Colorado requires sales-tax records to be kept at least 3 years, and many businesses keep tax and accounting records 7 years for tax, accounting, returns, and disputes, then deleted. Stripe and Printful keep their own records under their own policies.
• Tips: the payment record is kept as a business income record for the same TODO: X years as shop orders. Stripe keeps its own records.
• Shared trip links: until you turn sharing off, regenerate the link, or delete the trip.
• Itinerary email send records: 30 days in our systems. Resend keeps its own delivery logs under its policy.
• Photos: until you or we remove them.
• Correction submissions: up to 24 months after we finish reviewing them, then deleted. Your follow-up email is deleted within 12 months after we finish reviewing your correction, unless we're still in touch with you about it. The hashed IP address is deleted after 30 days. Facts we confirm and publish become part of the Site's content and aren't linked to you.
• Analytics data (aggregate only): up to 12 months. Server logs: 1 day.

We may keep limited information longer if the law requires it or to resolve disputes.

8. Your choices and rights

• Unsubscribe from emails with the link in any email.
• Access, correct, or delete your data: email hello@ohvtrips.com from the email address you used with us. We'll respond within TODO: 30 days, and we may need to confirm it's you.
• Delete saved itineraries or photos in your account TODO: if available, or ask us to.
• Shop orders and tips: if you ask us to delete your data, we'll delete what we aren't required to keep. We may need to keep order and payment records for tax and accounting. Stripe and Printful keep theirs under their own policies.
• Depending on where you live, you may have additional rights under your state's privacy law. We'll honor valid requests as the law requires.

9. Children

OHVTrips is for general audiences and is not directed to children under 13. We don't knowingly collect personal information from children under 13. If you believe a child under 13 has given us information, email us and we'll delete it. You must be 18 or older to upload photos (see the Photo Upload Terms) or to place a shop order. Users under 18 may use the planner with a parent's or guardian's permission. We don't show personalized ads to anyone we know is under 18.

10. Security

We use reasonable safeguards, such as encrypted connections (HTTPS), access controls, and reputable hosting providers. No system is perfectly secure, so we can't guarantee absolute security. If a breach affects your personal information, we'll notify you as required by law.

11. Where data is processed

We are based in Colorado, USA, and our providers may process data in the United States and elsewhere. The Site is intended for users in the United States.

12. Changes

We may update this policy. We'll post the new version with a new effective date, and for significant changes we'll notify subscribers or registered users.

13. Contact

AJW Ventures LLC (OHVTrips) TODO: MAILING ADDRESS Email: hello@ohvtrips.com