How Holler handles data

Updated 9 October 2026

Holler collects feedback on links you share. This page explains, in plain words, what that involves. The privacy policy has the formal version.

In short

• Reviewers never need an account. We keep the words they say or type, not their voice recordings.
• Builders sign in with Google or an emailed link. We only receive your name, email address and profile picture.
• No advertising, no tracking cookies, no selling or sharing data for marketing.
• Coding agents and automations only get the access you grant, with keys you can revoke at any time.
• You can delete a project, with everything in it, whenever you want.

If you’re giving feedback

• Voice notes are sent to be transcribed, then discarded. Only the text is kept.
• What’s kept: your words, the name you choose to give (optional), screenshots you add, and your device type, operating system, browser and screen size, so the builder knows whether a problem happens on phones.
• Screenshots you attach are redrawn from their pixels before they’re stored. Hidden details such as a photo’s location, camera and author are removed, and only images are accepted.
• Screenshots of the tab and walkthroughs (computers only) happen only when you choose to share a tab. Holler takes still screenshots of that tab, never video or the tab’s sound. When the link shows inside the feedback page, it keeps only the part showing the link, not your notes. You see every walkthrough screenshot and can remove any before sending, and sharing stops when the walkthrough ends.
• On a site with the Feedback button, a note also includes the page you were on, the label of the element you pointed at or last tapped, recent page changes and clicks, and error messages from the page. The button never records what you type into the site’s own fields.
• A random ID in your browser groups your notes so the builder can tell you when something you raised is fixed. It isn’t linked to who you are.
• Your feedback goes to the builder who shared the link. Don’t include passwords or other secrets.

If you’re a builder

• We store your account (name, email, picture), your projects and their settings, and the feedback they receive.
• Signed-in projects only open in your account. Projects made without signing in open with a private link; save them to your account to make them private.
• Agent keys only read issues you approved, mark them fixed and link tickets. They’re stored as one-way hashes and shown to you once.
• Webhooks are signed so your receiver can check they came from Holler, and only go to public https addresses.
• The Feedback button is one versioned script (/w/v1.js). It only appears for people who open your feedback link. For everyone else it just reports, once per tab, that it’s installed. Screenshots replace typed field values with dots, and anything marked data-holler-private is blanked. Long random tokens in page addresses (invite links, private keys) are replaced with :token before a note is sent. What the script does, in detail, with its source and a prompt to have your coding agent check it.
• Reviewer notes reach the sorting AI and your coding agent marked as untrusted text from outside your team, with a rule to treat them as descriptions of problems and never as instructions. Still review what an agent changes before you ship it.

Who processes data for us

Under their API terms, OpenAI and Anthropic don’t use this data to train their models.

Security

• All traffic uses HTTPS. Private pages aren’t indexed by search engines, can’t be embedded on other sites, and never send their address to other sites.
• Screenshots are stored privately and shared only through signed, single-image links.
• We check every input and rate-limit sign-in, project creation and other sensitive actions.

Keeping and deleting data

• Projects and their feedback are kept until you delete them. Deleting a project removes its notes, issues and screenshots.
• Projects that were never saved to an account are deleted 30 days after they were made. Sample projects are deleted after 7 days.
• Deleting your account deletes your projects too.

Questions or a security issue

For questions about your data, or to report a security issue, use the contact address that will be listed here before sign-in opens to everyone (for privacy and security). Security researchers can also see security.txt.