Privacy Policy

What we collect

If you host an event: your name, email address, and the event details you enter — title, date, venue, and theme. If you sign in with Google, we receive your name, email address, and profile photo from Google; we never receive your Google password.

If you RSVP as a guest: the name you type, your attendance answer, seat count, and anything you choose to add — meal choice, dietary notes, a song request, a message to the host. Guests do not create an account and we do not ask for your email or phone number.

Photos: images you upload to an event gallery, plus the caption and any people you tag.

Purchases: if you buy Premium on the web, payment is handled by Stripe under Stripe’s own privacy policy. We receive only an identifier confirming the purchase — never your card details. On the mobile apps, Apple or Google handle the payment instead.

How we use it

To run the event: show the invite page, tally RSVPs for the host, and display the shared gallery to that event’s guests. That is the whole purpose. We do not use your information for advertising, and we do not sell it to anyone.

Who can see your information

Hosts see the RSVPs and photos for events they own, and nothing from anyone else’s events.

Guests see the invite page and — once they have RSVP’d — that event’s photo gallery. A guest of one event cannot see another event’s guests or photos. This is enforced by our database, not only by the app.

Photos are private by default. They are stored in a private bucket with no public web address. Viewing one requires a short-lived signed link, issued only after we confirm you are a guest of that event. Hosts can additionally turn off guest uploads, downloads, or comments, or make a gallery visible only to themselves.

How long we keep photos

Event photos are deleted automatically:

• Free events — 90 days after the event date
• Premium events — 365 days after the event date

Hosts are emailed 14 days before deletion. Download anything you want to keep before then. Deletion is permanent and we cannot recover photos afterwards.

Event details and RSVP records are kept while your account exists, so you can look back at past events.

Where it is stored

Event data and accounts are stored with Supabase (Postgres), and photos in a private Cloudflare R2 bucket, both protected in transit and at rest. Payments are processed by Stripe, and transactional email is sent via Resend. These processors act on our instructions and may store data in the EU, UK, or US; where data leaves the UK/EEA it is transferred under standard contractual clauses.

Cookies & local storage

We use only strictly necessary cookies and browser storage — no advertising, no analytics, no third-party tracking. Because these are essential to run the service, they don’t require a consent banner.

• A sign-in cookie that keeps hosts logged in.
• A guest session token so guests can use a gallery without an account.
• Small preferences in local storage — e.g. remembering the name you type on a shared photo link, or whether a panel is open.

Clearing your browser storage signs you out and forgets these.

Your choices

Hosts: you can edit or delete an event at any time from the app. Deleting an event permanently removes its guest list and photos. To delete your whole account and everything in it, email us at the address below and we will action it within 30 days.

Guests: ask the host to remove your RSVP, or contact us and we will remove it for you. Clearing the app or your browser storage signs you out of a gallery on that device.

Your rights

If you are in the UK or EU, you have the right to access a copy of your data, correct it, have it deleted, restrict or object to how we use it, and receive it in a portable format. To exercise any of these, email us at the address below and we will respond within 30 days.

The data controller responsible for your information is GatherAt. If you believe we have mishandled your data, you can complain to your local data protection authority — in the UK, the Information Commissioner’s Office (ICO) at ico.org.uk.

Children

GatherAt is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

Changes

If we change this policy in a way that materially affects you, we will update the date above and notify hosts in the app.

Contact

Questions, deletion requests, or anything else: [email protected]