Privacy
What we commit to, in plain language
A group roster holds real photographs of real families. That deserves to be settled up front, in plain language, rather than buried in a policy nobody reads.
Everything past your name is optional
A bio, a family photo, your kids, your dog — every one of those fields can stay empty forever, and the app works exactly the same if it does.
Group-members-only, by default
Whatever you do fill in is visible to the people in your group and nobody else. That is the default setting, not a preference you have to go find.
The group directory is opt-in, and it never lists people
A leader can list a group in Find a group so signed-in people looking for one nearby can ask to join. It is off unless the leader turns it on. A listing shows the group’s name, town, when it meets, how many people are in it, its description and, for a Bible study that names one, its church. It never shows the meeting address or who is in the group, there is no way to search for or browse people, and the directory is not on the open web.
You can remove your own information at any time
Any field, any photo, your whole profile, your whole account. Deleting your account is a button on your own profile page: no support ticket, no waiting period, no dark pattern between you and it.
Email only when you have asked for it
Every group you belong to has its own switch on your profile page. Turn one off and that group can no longer reach your inbox — not its leader, not a reminder, not a board post — while everything stays readable in the app.
We do not sell data, and there is no ad business
The business model is software subscriptions from group leaders, and from the schools, clubs, churches and organizations who find the tool useful. Nothing about it depends on knowing more about you.
Children's photos get extra care
Family photos in a group roster, such as a homeschool co-op or a family book club, often include children. Specific legal guidance on child-image and data-privacy handling is being sought now rather than worked out after something goes wrong.
How that is enforced
Commitments are cheap. These are the mechanisms behind them.
- Uploaded files — handouts and profile photos alike — are stored under opaque ids and served only through an endpoint that checks your group membership first. Nothing in the uploads directory has a public URL.
- A profile photo is visible to you and to people who share a group with you. Nobody else can fetch it, guessed URL or not.
- Private notes are filtered out of every query that another member can reach. Sharing a note with the group is a separate, deliberate choice on the form.
- The leader's dashboard is visible to leaders only. Members never see how far behind anyone else is.
- The directory query never selects a group’s address, lists only groups whose leader ticked “Let people find this group”, and sits behind sign-in. An administrator can take any group off it.
- Passwords are stored as scrypt hashes with a per-account salt. Changing your password signs out every other device.
- Deleting your account removes your profile, photo, notes, board posts, prayer requests, RSVPs and uploads in one transaction, and takes you off every roster. There is no soft delete and no recovery window, because a recovery window is a copy.
- Sign-in, sign-up and password-reset forms are rate limited by address and by source, so a password cannot be guessed by patience and the reset form cannot be used to discover who has an account.
- The record of email the app has sent keeps only the address, the subject line and whether it got out — never the body — and rows older than 90 days are dropped.
- Everything an administrator does to a group or an account — pausing it, taking it out of the directory, promoting someone — is written to a log with their name on it. Administrators see counts about a group, never what was written in it.
This is not yet the privacy policy
This page is a plain-language statement of principle and practice, not a lawyer-reviewed document. See our Terms of Service for the rules governing accounts, the 4-active-group free tier, and organizational use. Until then, treat the software as early: it works, and it is small enough to read, but it has not been through a legal or a security review.
What the app stores is what you put into it — your account, your groups, your plans, your notes, and any files you upload. Nothing is sold, and there is no advertising business. Deleting your account and everything in it is a button onyour profile page. If something there does not work the way this page says it should, write tohello@gatherandstudy.com.