Privacy notice

Last updated 6 November 2026.

This notice describes what this directory actually does with data. It is written to match the software, not to cover every eventuality, and it is kept in step with the code when the code changes.

What we collect, and when

When you send a business a message. Your name, email address, an optional phone number, and the message. We pass these to the business so it can reply, and keep a copy so an editor can forward it by hand if automatic delivery fails.

When you write a review. Your display name, rating, optional title and review text. The form also asks for an email address, which is used to check the submission and is not stored — it is discarded once the review is created. Approved reviews are published with the display name you choose.

When you submit or claim a listing. Your name, email address, an optional phone number, your stated role at the business, and the listing details you provide.

When you report a problem. The reason, any details you write, and your email address if you choose to give one.

When you open a business owner account. Your name and email address, and a cryptographic hash of your password. We never store the password itself. If you add photos to a listing, we store the image files and their dimensions alongside the account that uploaded them.

When you are signed in. A session record holding a hash of your session token, a coarse hashed form of your IP address, and your browser's user-agent string. These let us keep you signed in and let an editor recognize an abandoned session.

When you open a business listing. We add one to our own counter for that listing and that day, so the business can see how often its page is looked at. We also count which broad kind of place you came from: a search engine, social media, this directory, another website, or none. Your browser works out that category and sends only the category, never the address of the page you came from. If you tap the phone number, website or directions link, we add one to a counter for that link. These counters store only a listing, a date and totals; they store no visitor identifier. Google Analytics separately measures page visits, including visits to listing pages, as described below.

Your browser remembers which listings and links it has already counted for the length of the tab, so a reload is not counted twice. That is kept in your own browser's session storage and never sent to us.

Automatically, on public forms. A coarse, hashed form of your IP address, used only to rate-limit against abuse. The address is reduced to a network block before hashing, so it does not identify you individually. It is not used for analytics or profiling.

Email we send. Messages we send you are queued in our own database before delivery, which means a copy of the recipient address, subject and body is retained. An editor can read that queue.

When you browse the site. We use Google Analytics 4 to measure page views and site usage. Google receives information such as the page URL, browser and device information, and analytics cookie identifiers. We use these reports to understand traffic and improve the directory. The Google tag loads on every public page.

Google Ads measurement. We advertise the directory to business owners on Google. The same Google tag also reports to Google Ads, so Google Ads receives the same kind of page-visit information as Google Analytics: the page URL, browser and device information, and cookie identifiers. That lets Google tell us how many people who clicked one of our ads went on to create a business owner account. When an account is created, the tag sends Google a "sign-up" event; it does not send your name, email address or anything you typed into the form. We have turned off Google's ad personalization signals for this tag, so these visits are not used to build advertising audiences or to target ads at you.

Password-reset and email-confirmation links contain a one-time code. Your browser removes it from the address before the Google tag loads, so that code is never sent to Google. Reloading one of those pages afterwards will ask you to request a new link.

Cookies

Google Analytics sets first-party cookies, including `_ga` and a `_ga_...` cookie, to distinguish visitors and sessions. Google Ads may also set cookies, such as `_gcl_au`, and read the ad-click identifier in the page address, so that a sign-up can be matched to the ad that led to it. We use this only to measure our own ads. The Google tag loads when you browse the site.

The site also sets a strictly necessary cookie when you sign in — `hmva_owner` for business owners, `hmva_session` for editors. It holds a random session token, nothing about you, and is marked `HttpOnly` and `Secure`. It expires after 60 days, or immediately when you sign out or change your password.

If you save a listing, the saved list is kept in your own browser's local storage. It never leaves your device, is never sent to us, and does not sync between devices. When you create an account, your browser also stores that account's id in local storage, so the sign-up is reported to Google Ads only once. The id is not sent to Google.

What we do not do

• We do not sell personal information, and we do not share it for targeted advertising
• We do not use analytics data to make automated decisions about you
• Our own listing counters record only totals for each listing and day, not who viewed it; Google Analytics separately receives page URLs
• We do not add you to a mailing list because you used a form
• We do not run advertising trackers beyond Google Ads conversion measurement for our own ads, described above
• We do not require an account to browse, search or contact a business

Third parties

Map tiles on business profiles are loaded from OpenStreetMap, which receives your IP address as a normal consequence of loading those images. This happens only on a listing page that has a map.

Email delivery uses Resend, a US provider, which processes the recipient address and message content in order to deliver it. Until delivery is configured, messages stay in our database and an editor forwards them by hand.

Fonts are served from this domain. They are compiled into the site at build time, so loading the fonts does not send a request to Google.

Google Analytics receives usage data through the Google tag on public pages. Google processes this information for site measurement. Google Ads receives page-visit information, the sign-up event and ad-click identifiers through the same tag, as described above, to measure our ads. See Google's privacy information.

How long we keep things

• Customer messages and listing submissions — while the request is live and for as long as needed to resolve a dispute about it
• Published reviews — as long as the listing exists
• Owner accounts — until you ask us to close the account
• Session records — deleted when they expire, when you sign out, or when you change your password
• Listing view and link counts — kept as long as the listing exists. They contain no personal data, so there is nothing in them to delete on request
• Google Analytics data — retained in the Google Analytics property according to its configured retention settings
• Rate-limit records — held in memory only and lost whenever the site restarts
• Sent email — the queued copy is kept for delivery troubleshooting

We do not currently run automated deletion. Data is removed when you ask us to remove it, or when an editor removes it. If that matters to you, ask us through the contact page and we will delete what we hold.

Your rights

Use the contact page to ask what we hold about you, to correct it, to get a copy, or to have it deleted. We will answer within 45 days.

The Virginia Consumer Data Protection Act applies to businesses that, in a calendar year, control or process the personal data of at least 100,000 Virginia consumers — or at least 25,000 where more than half of gross revenue comes from selling personal data. A directory of this size does not reach either threshold, and we sell no personal data, so the Act does not currently impose its obligations on us.

We intend to honor those rights anyway: access, correction, deletion, a portable copy, and an appeal if we turn a request down. If we refuse a request we will tell you why and how to appeal, and you may contact the Virginia Attorney General.

Security

Passwords are hashed with scrypt and are never stored or logged in readable form. Session tokens are stored only as hashes, so a copy of our database does not let anyone sign in as you. The site is served over HTTPS.

Children

This site is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has given us personal information, tell us through the contact page and we will delete it.

Changes

If this notice changes in a way that matters, we will update the date at the top of this page.

Questions: use the contact page.