Privacy Policy

Version 2026-10-15.3 · Last updated October 15, 2026

Gather (https://gatherspace.app) is run by Masud Ahmed Uddin, an individual, not a company (“we”, “us”). This policy explains what we collect, why, who processes it, and your choices. Gather is for adults 18+ only. We do not knowingly collect data from anyone under 18. If you believe a minor has signed up, email contact@gatherspace.app and we will delete the account.

Notice at collection (summary)

When you sign up and use Gather we collect: identifiers (name, email), profile and matching information (city, skills, goals, availability, interests, about-me text), activity (crews, messages, reports), device and technical data (timezone, push subscription, salted device and IP hashes used only for referral-fraud checks), and consent records. We use it to run and secure Gather, match you with crews and enforce our rules. We do not sell or share it for advertising. How long we keep each type is in section 7. Your rights are in section 8.

1. What we collect

• What you give us: name, email, city (city only, never your exact location), skills, mission, goals, what you're looking for, availability slots, hours per week, work style, deal-breakers, your “about me” text and its earlier versions, and optional interests, platforms, group-size and group-home preferences.
• Onboarding answers: your answers to the Gather bot's questions, used to draft your profile. Nothing is saved to your account until you approve the profile.
• What you do on Gather: crews and groups you create or join, roles, crew-room chat messages, check-ins, votes, tasks, feedback, notifications, and invites you approve.
• Consent records: when you confirmed you are 18+, when you accepted the Terms and this policy, and which version you accepted.
• Safety records: reports and blocks you make or receive.
• Device and technical data: your timezone offset, last-active time, and, only if you turn on notifications, a push subscription (a browser-issued endpoint address and keys). Our host, Cloudflare, processes your IP address and browser details to deliver the site, protect it from abuse and keep short-lived logs.
• Referral fraud checks: when someone opens an invite link or signs up through one, we store a salted, one-way hash of the IP address and of a random device ID kept in your browser (local storage key g_dev). We never store the raw values. We use the hashes only to stop fake referrals and delete them after 30 days.
• Approximate location: Cloudflare tells us the country and region your connection comes from. We use this at the moment of your request to apply our service area (see section 9). We don't save it to your profile.
• Waitlist for unavailable areas: if you are in an area where sign-up is closed and you ask to be notified, we store only your email, that area and the date. This does not create an account.
• Optional crew preference: if you turn on a same-gender crew preference, we store the gender you choose (or your own description) only to apply that preference when forming private crews. It's never shown to other members, never used for ads, and you can turn it off (which deletes it) at any time.
• What we don't collect: we do not check government ID, take photos or selfies, collect payment card details, or use your precise location.

2. How we use it

We use it to run Gather: to build your profile, suggest matches, form crews, run the crew room and its AI host, send the notifications and emails you've allowed, apply our service area, prevent abuse, enforce our Terms and Community Standards, keep backups, and improve matching. Other members see only your approved profile, first name and city. Your email is never shown to other members.

3. AI processing

We use Cloudflare Workers AI, running open models (currently Meta Llama 3.1 8B for text and BAAI BGE for matching), on Cloudflare's network. What we send to it:

• your onboarding answers, so it can ask follow-up questions and draft your profile;
• your profile text (about me, mission, goals, who you're looking for, skills, interests, work style and what you're seeking), turned into a numeric “embedding” that we store and use to calculate matches;
• a crew's mission and needs, so it can suggest a first task;
• recent crew-room messages, with senders' first names, so it can post recaps and task lists in that crew room.

Cloudflare states that it does not use customer data sent to Workers AI to train models. We don't send your email address or your private sign-in link to the AI. We currently use no other AI provider. If we add one, we'll update this policy first.

Automated suggestions. Matches, crew suggestions, recaps and tasks are generated automatically and can be wrong. They are suggestions only: you can always decline, leave a crew or edit your profile. You can ask a person to review any automated suggestion by emailing contact@gatherspace.app.

4. No sale, no sharing, no ads

We do not sell or rent your personal information. We do not “share” it for cross-context behavioral advertising, and we don't use it for targeted ads. We don't show ads.

5. Who processes data for us

• Cloudflare: hosting, database storage, logs and AI models.
• Browser push services (for example Google, Apple and Mozilla) deliver notifications only if you turn them on. We send only a short wake-up signal to them. The notification text is fetched from Gather by your device.
• Resend: email delivery, used only once email is switched on.
• Stripe: payment processing, only once paid plans are switched on. Stripe holds your card details; we never see or store them.
• Google (Gemini API): not used today. If we turn it on, we'll use only the paid tier, under which Google doesn't use our data to improve its products, and we'll update this list first.

These providers process data on our behalf. We disclose data to law enforcement or others only in response to valid legal process (a subpoena, court order or warrant, as applicable), when required by law (including reports of child sexual exploitation to NCMEC), or voluntarily in a good-faith emergency involving danger of death or serious physical injury. Where lawful and safe, we tell you before disclosing. We may also use or disclose data to enforce our Terms. Your data is also stored in our own backups (see section 7).

6. Cookies and local storage

Gather itself sets no advertising, analytics or tracking cookies. Your browser's local storage keeps your private sign-in token, your member and referral codes, any open-spot link you followed, your light/dark theme choice and whether you've dismissed tips or pop-ups. These are needed for the site to work or to remember your choices. Cloudflare may set strictly necessary security cookies to block bots. Clearing your browser data removes all of these. Because we use only essential storage, we don't show a cookie banner.

7. Retention

Child-safety records: if content appears to involve the sexual exploitation of a child, we hide it, suspend the account and keep a secure, access-logged record (the content, account details, timestamps and surrounding messages) for 1 year, as U.S. law (18 U.S.C. §2258A) requires. These records are kept even if the account is deleted, are excluded from routine backups, and may be reported to the NCMEC CyberTipline and law enforcement after human review. If your own text suggests you are under 18, we pause matching while a person reviews your account.

Referral checks: when you sign up, open your Invites page or follow an invite link, we store a salted, one-way hash of your IP address and of a random browser ID (never the raw values) to catch self-referrals and duplicate accounts. These hashes are deleted after 30 days. Auto-renew consent: if you ever subscribe, we keep a minimal record of your consent to automatic renewal (the plan, the version and when you agreed) as the law requires, even after you cancel or delete your account. We keep your data while your account is active. If you delete your account, we immediately delete your profile, earlier “about me” versions, crews you own, memberships, notifications, invites, check-ins, feedback, push subscriptions and blocks, and we replace your crew-room messages with “[deleted]”. Copies in our backups are deleted as those backups expire. We keep backups for up to 90 days. Crew-room and channel messages are deleted 180 days after they are sent, unless they are part of an open safety case or legal hold. If we report suspected child sexual exploitation to NCMEC, we preserve the related records for one year, as US law requires. Records of moderation actions and bans (with your email stored only as a one-way hash after deletion) are kept for up to 2 years to keep banned users off Gather. Hosting logs are kept only briefly, under Cloudflare's retention settings. We may keep minimal records, such as abuse reports, longer if needed for safety or legal reasons. We may delete accounts that have been inactive for 24 months. Waitlist entries are deleted once we have sent the one notice, or when you ask us to delete them.

8. Your choices and rights

• Optional crew preference: if you turn on a same-gender crew preference, we store the gender you choose (or your own description) only to apply that preference when forming private crews. It's never shown to other members, never used for ads, and you can turn it off (which deletes it) at any time (Matching settings on your Gather page).
• Settings controls: on your Settings page you can see and manage your blocked list and report history, sign out everywhere, pause matching, and turn email and push notifications on or off by type.
• Edit or delete: edit your profile or permanently delete your account at any time from your private profile page (“Delete my data”).
• Copy of your data: email contact@gatherspace.app and we'll send you a copy in a portable format (JSON).
• Notifications: turn push notifications on or off on your profile page or in your browser. You can change email preferences, or unsubscribe, using the link in every email.
• US state privacy rights: depending on where you live (including California under the CCPA/CPRA, and states such as Virginia, Colorado, Connecticut, Utah, Texas and Oregon), you may have the right to know what we collect and how we use it, and to access, correct, delete and port your data. You may also have the right to opt out of sale, sharing, targeted advertising and profiling, and to limit the use of sensitive information. We don't sell, share or target ads. You can remove them at any time.
• To make a request, email contact@gatherspace.app. We may need to confirm you control the account, for example by asking you to send the request from your account email. You can use an authorized agent. We'll respond within 45 days, and we won't treat you differently for asking. If we refuse, you can appeal by replying to our answer.

Global Privacy Control: we honor the Global Privacy Control (GPC) browser signal as a request to opt out of the sale or sharing of your personal information and of targeted advertising. We already don't do any of these, and we'll keep treating a GPC signal as a standing opt-out if that ever changes.

9. Where Gather is available

Gather is run from the United States and its data is stored and processed by Cloudflare in the US and other countries. New sign-ups are currently closed in some places, including Florida, Tennessee and Mississippi, the EU/EEA, the UK, Australia, Russia, Belarus, mainland China, and sanctioned countries and regions. The full list is in our Terms. Gather is not offered to people in those places, and we don't intend to collect their data. People there aren't offered the email waitlist either, except in the US states listed above and Australia.

10. Security

Data is encrypted in transit, admin access is restricted, and sign-in links are long random tokens. Keep yours private. No system is perfectly secure. If a breach affects you, we'll notify you as required by law.

11. Changes

We'll post updates here with a new version and date. For material changes, we'll tell you in the app or by email before they take effect, and ask you to accept them again where required.

12. Contact

Masud Ahmed Uddin, contact@gatherspace.app