Privacy Policy

Who this policy covers

Tarn is booking software for outdoor adventure companies. That means two kinds of people interact with us: operators — the companies that run trips and use Tarn to manage them — and guests, the people who book those trips through an operator's booking page.

For operators, Tarn decides how account information is collected and used. For guests, the operator you book with owns your booking relationship — Tarn stores and processes your information on that operator's behalf so they can run your trip. This policy explains both, plus what we collect from visitors to this website.

Information we collect

From operators: your name, email, company details, and the information you and your staff enter to run your operation — trips, schedules, bookings, guest records, and settings.

From guests: what you provide when you book — your name, email, phone number, party size and participant details, and anything the operator's booking form asks for. If a trip requires a waiver, we store the signed waiver as part of the booking record: the waiver text you agreed to, your typed signature, the time, and technical details such as network address and browser that help the operator verify the signature later.

When you agree to something — a cancellation policy, saving a card, receiving text messages — we keep a record of that consent: what you agreed to and when. These records exist to protect you and the operator.

From everyone: standard technical information such as device type, browser, and pages visited, used to keep the service secure and working.

How we use information

We use information to operate Tarn: to process bookings and payments, send booking confirmations, reminders, and receipts, help operators manage their trips, provide support, and improve the product. We do not sell personal information, and we do not use guest information for advertising.

We also look at usage in aggregate — counts, trends, and de-identified statistics that no longer identify anyone — to understand how the product is used and make it better.

If you start a booking and don't finish

If you begin booking a trip and enter your email but don't complete checkout, the booking is saved as an unfinished cart and you may receive a single reminder email on the operator's behalf with a link to pick up where you left off. Unfinished carts that never turn into bookings are deleted automatically.

Payments and saved cards

Payments are processed by Stripe. Your card details go directly to Stripe over its PCI-compliant infrastructure — Tarn never sees or stores full card numbers. If you choose to save a card during checkout for future charges, the card is stored with Stripe and Tarn keeps only a summary (card brand and last four digits) along with a record of your consent.

Email and text messages

Booking-related emails — confirmations, payment receipts, trip reminders, waiver requests — are sent through our email provider on the operator's behalf. If you opt in to text messages at checkout, trip updates may be sent by SMS through our messaging provider; reply STOP at any time to opt out. We don't send marketing messages to guests.

Analytics and cookies

This website and the Tarn application — including operator booking pages — use Google Analytics for Firebase to collect aggregate usage statistics: pages visited, device and browser type, and general region. It sets an analytics cookie to tell visits apart. We use the data to understand how Tarn is used and improve it, and we don't sell it.

When our own advertising brings an operator to this website, we also share conversion events — such as submitting the contact form or creating an operator account — with Google Ads so we can tell whether those ads work. That measurement applies only to prospective operators arriving from our ads; we don't build advertising profiles, and guest booking data is never used for advertising.

Here's what gets set in your browser and why:

Service providers

We share information only with the providers that help us run Tarn, and only as needed to provide the service:

• Google Cloud / Firebase — application hosting, database, and file storage
• Stripe — payment processing and payouts
• Postmark — transactional email delivery
• Twilio — text message delivery
• Google Analytics for Firebase — aggregate usage analytics on this website and the application
• Google Ads — conversion measurement for our own advertising on this website

Where data lives and how it's protected

Data is stored on Google Cloud infrastructure in the United States, encrypted in transit and at rest. Each operator's data is isolated to their own account, and access within an operator's team is controlled by roles they assign. We may disclose information if required by law.

Retention and your rights

Operators own their operational data and can export it at any time. If an operator closes their account, we retain data only as long as needed for legal and operational purposes, then delete it.

You may request access to, correction of, or deletion of your personal information. If you're a guest, the fastest path is usually the operator you booked with, since they own the booking record — but you can also contact us directly and we'll help, working with the operator where their approval is needed. We respond to requests within 30 days.

Waiver records are an exception to deletion in most cases: operators keep them as legal evidence connected to a trip that happened, so they're retained with the booking record.

US state privacy rights

If your state's privacy law (California's CCPA or similar) gives you specific rights, here's the summary in plain terms. What we collect falls into these categories: identifiers (name, email, phone, IP address), commercial information (bookings and payments), internet activity (pages visited), approximate location (city-level, from your device settings or IP), and — in limited cases — information those laws treat as sensitive: your account sign-in credentials if you're an operator, and messages between you and an operator through the platform.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we don't use it for profiling that produces legal effects. Because there's no sale or sharing, there's nothing to opt out of.

You have the right to know what we've collected, get a copy, correct it, or delete it, and we won't treat you differently for asking. Email us to exercise any of these; an authorized agent can submit for you with written permission. Guests can also go through their operator, and we'll support the request either way.

Children

Tarn's booking and account services aren't directed at children under 16, and we don't knowingly collect their information except when a parent or guardian provides it — most commonly a minor participant's name on a waiver that the guardian signs. That information stays part of the booking record and isn't used for anything else. If we learn we've collected a child's information without a guardian's involvement, we'll delete it.

Changes to this policy

If we make meaningful changes to this policy, we'll update the date at the top and notify operators by email. Continued use of Tarn after a change means the updated policy applies.

Contact

Questions about privacy? Email support@tarnbooking.com and we'll help.