Legal

Privacy Policy

Effective October 5, 2026

Gatherings is an in-person social network that brings everyone at an event into one private, live network. This policy explains what we collect, why, and the controls you have. Gatherings is operated by Deciten, Toronto, Canada (“we”, “us”). Questions: privacy@gatheringsapp.com.

What we collect

Account information. When you sign in with Apple, Google or email: your name (or the display name you choose), email address, and a user ID. You can use “Hide My Email” with Sign in with Apple.

Profile photo and tags. If you upload a profile photo, we store it for your profile. If you haven't uploaded one and you signed in with Google, we use your Google profile photo (Sign in with Apple and email sign-in give us no photo). Your photo is shown to people in your gatherings: next to your posts and comments, on the gathering's guest list, and on your request to join when a host approves guests. It is not shown while you're in Ghost Mode. If you pick profile tags (where the app offers them), people in a gathering with you see only the tags you have in common with them, and nobody sees your tags while you're in Ghost Mode. Deleting your account removes your photo and tags from your profile.

Location. Precise location, in the foreground only, when a feature needs it: to set where your gathering is when you host one, and, if you allow it, to notice when you leave a gathering you've joined. Checking in doesn't need your location today. We do not collect location when the app is closed or backgrounded.

Content you share. Photos, videos, polls, thoughts, comments and reactions you share inside a gathering. This content is ephemeral: it is automatically deleted within 24 hours of posting, and content tied to a gathering you leave is removed after a short grace period. Song requests you add to a gathering's music queue are deleted when the gathering ends; the short record we keep so we don't tell you twice that your song is up expires 24 hours after it is made (the current setting) and is then deleted automatically, so it can outlast the gathering by about a day.

Door lists. If a host keeps a door list for their gathering, your name and the time you arrived are saved to it — including in Ghost Mode. The host can see the list and download a copy. We keep door lists for 365 days and then delete them. Deleting your account removes the entries your own check-ins created from every door list.

Music taste (optional). If you connect Apple Music or set your taste manually, we read listening metadata — artists, genres, energy — to power the music features you use. If you host and connect Apple Music, Gatherings plays the gathering's playlist through your Music app when you ask it to. We never see your music password.

Technical data. Device model, OS version, crash reports (scrubbed of personal data before they leave your device), and pseudonymous usage analytics (never your name or email).

Usage counts. To count how many people use Gatherings, we record which days your account was active, the day you signed up, when you host or join a gathering (and whether an invite brought you), and when you first connect music. This includes Ghost Mode. These records are tied to your account, never shown to anyone (we only look at totals), kept for 90 days, and deleted with your account.

Website sign-ups. If you join the waitlist on our website, we keep the Instagram handle or email address you give us, the city you pick, which of our sign-up pages you used, and when you signed up — only to contact you about Gatherings. Ask us to delete it at privacy@gatheringsapp.com.

School email (optional). If you choose to verify your school in your account settings (Organization), we collect the college or university email address you enter. We send a one-time code to that address through Postmark, our email provider, to confirm you can receive email there; your school's email system receives that email like any other email sent to the address. We keep, on our servers in the United States, your address (encrypted), the school it belongs to, and a scrambled form of the address that tells us whether it is already verified on another account (one address can verify only one account at a time). When you enter the code, we record that you're verified and when. We use this so that, when a host limits a gathering to members of your school, you can join it; today, it shows only to you, as “Verified” in your account settings. We don't show your school email, or which school you verified with, to anyone else. If another account later verifies the same address, your verification ends.

Age verification (only for age-restricted gatherings). When this feature is available, hosts can mark a gathering as age-restricted (for example 18+, 19+ or 21+, optionally with a maximum age). To join one, you verify your age once, at the moment you tap Join — never at sign-up, and never if you don't join an age-restricted gathering. On iPhone, if you hold an ID in Apple Wallet you can use Verify with Wallet: Apple shares only an “over N” result and your date of birth with us — no photo, name, address or document number. Otherwise you verify through our identity provider, Stripe Identity, which checks your government ID on its own systems and returns the result to us; we never receive or store your ID image or selfie. We keep only the over-N results, your date of birth (encrypted with a per-user key and readable only by the server-side service that compares it against a gathering's age range), the verification method, and when you verified. Your date of birth is never shown in the app, never shared with hosts or other attendees, and never used for advertising. Hosts remain responsible for checking IDs at the door.

Visibility tiers and Ghost Mode

New accounts start at Local: you are visible to people in a gathering you've joined, while you're there. You can switch to Ghost Mode at any time in your settings: you share no location or photo, your posts show as Anonymous, and people in a gathering you've joined see only your name on its guest list. Global arrives with campus discovery; until then it works like Local. You can change tiers at any time. Ghost Mode users are left out of venue insights and of our pseudonymous usage analytics; they are still counted in our own internal totals — how many people use Gatherings and how many are in a gathering at once (see Usage counts).

How we use your information

To run the service (let you host, join and post); to power the music features you use — song search, requests and votes; to verify your school email when you ask us to; to keep the community safe (automated screening of what's posted, and reports that come straight to our team); and to send you essential service communications. We do not use your personal information for advertising.

Sharing

We do not sell personal information. We share data only with:

• Infrastructure providers — Google Cloud / Firebase (hosting, authentication, configuration) and Sentry (crash reporting, scrubbed of personal data), each processing data on our behalf. Google also handles Google Sign-In when you choose it.
• Postmark — our email provider (AC PM, LLC, in the United States), only when you verify a school email: it receives that address, the one-time code and your school's name, and sends you the code email on our behalf. Postmark keeps a copy of each email for 45 days and then deletes it, and keeps addresses that bounce or report the email as spam on a do-not-send list.
• Apple — Sign in with Apple when you choose it, and Apple Music if you connect it. When you search for a song, our servers send Apple the words you typed, without your name or account.
• Spotify — when you search for a song, our servers send Spotify the words you typed, without your name or account.
• Hosts and other people in your gatherings — only what the sections above describe: your name on a gathering's guest list; your profile photo next to your posts and comments, on the guest list and on your request to join (never in Ghost Mode); the profile tags you have in common with them; and, if its host keeps one, your name and arrival time on its door list.
• Venues and organizers — when venues join Gatherings, they may receive aggregated insights only (for example, overall energy of a gathering). These reports use k-anonymity thresholds, never include Ghost Mode users, and never identify individuals.
• Age-verification providers — only when you verify your age for an age-restricted gathering: Apple (Verify with Wallet, when you choose to verify with an ID in Apple Wallet; see Apple's privacy policy) and Stripe, Inc. (Stripe Identity, document verification on Stripe's systems; see Stripe's privacy policy). Each receives only what is needed to verify your age and handles your ID under its own policy; neither shares your ID image or selfie with us.
• Authorities — if required by law, and only to the extent required.

Where we process data. Our servers and databases are on Google Cloud in the United States, and Postmark and Sentry process data there for us too. Some Google services we use, such as app configuration, run on Google's servers around the world. Information held outside Canada is subject to the laws of the country it is in, and that country's courts, law enforcement and national security authorities may be able to access it.

Retention and deletion

• Gathering content: deleted automatically within 24 hours of posting.
• Leaving a gathering: your content in it is removed after a short grace period.
• Age verification: the over-N results, encrypted date of birth, method and timestamp are kept for as long as your account exists (you verify once) and are erased with account deletion. We never store ID images or selfies.
• Door lists: kept for 365 days, then deleted.
• Usage counts: kept for 90 days, then deleted.
• School email: if you don't enter the code, it expires after 10 minutes (the current setting) and the address you entered is deleted automatically, usually within a day. Once you're verified, we keep your encrypted address and your verification until you delete your account or ask us to delete them, including after the verification expires. A verification expires 365 days after you verify (the current setting); verifying again, or with another school email, replaces the old one. Postmark deletes its copy of the code email after 45 days.
• Account deletion: erases your profile, content, music taste profile, social connections, the door-list entries your check-ins created, your usage counts, and your school email and its verification. Pseudonymous usage analytics, which carry no name or email, are not erased with your account today. Some of this, such as your social connections, is erased as soon as you ask, and cancelling does not bring it back; the rest is erased automatically within a day after a 30-day grace period in which you can cancel.
• You can ask for a copy of your data before deleting — email privacy@gatheringsapp.com.

Your rights

Depending on where you live — PIPEDA (Canada), GDPR (EEA/UK), CCPA/CPRA (California) — you have the right to access, export, correct, and delete your personal information, and to withdraw consent. Delete your account in the app (Profile → Account); ask for access, correction or a copy of your data by emailing privacy@gatheringsapp.com. We respond within 30 days. You may also complain to your local data-protection authority.

Security

All data is encrypted in transit. Access to production systems is role-restricted, and administrative changes to them are audit-logged.

Age

Gatherings is for people 18 and older. Specific events may have stricter age policies enforced at the venue, and, once age verification is available, gatherings a host marks as age-restricted will require it to join (see Age verification above). We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.

Changes

We'll post any changes here and update the date above. Material changes will be announced in the app before they take effect.

Contact: privacy@gatheringsapp.com · Deciten, Toronto, Canada