Privacy policy.

Who operates Gather

Gather is a collaborative travel planner operated by M3GA Studios LLC, principally located in Mahoning County, Ohio, United States. We are responsible for the personal information described here. This policy covers the Gather website at gatheraway.app, its API, administrator dashboard and the Gather iOS app. Contact support@gatheraway.app with privacy questions or requests.

Information you provide

• Account and preferences: your username, display name, optional contact email and settings, including notification preferences and a preferred display currency. Manual organizer-tool testing grants also record feature access, expiration, revocation and bounded operator audit information. Those testing grants are separate from purchased subscriptions. Public registration is available only when the operator enables it; a username-based account does not require an email address for verification.
• Sign-in information: a password hash, session records, invitation/recovery records and any enrolled passkey public credentials. Gather does not store your password in readable form or receive your Face ID or fingerprint data.
• Travel plans: trip details and header taglines, membership, ideas, comments, poll choices and votes, itinerary entries, packing lists, preparation tasks and deadlines, bookmarks, saved preparation, packing and itinerary templates, shared notes and links that you choose to enter.
• Costs: expense descriptions, amounts, currencies, agreed exchange rates, participants, allocations, settlement records, personal spending allowances and alternative budget-scenario estimates and assumptions. Gather stores planning targets and shared costs; recording them does not transfer money. Gather does not receive full payment-card numbers through these planning features or hosted subscription checkout.
• Notification registration: browser push subscription details or an Apple push device token when you enable the corresponding feature, together with the account/session needed to deliver updates.
• Agreement and support records: accepted terms and acknowledged privacy versions, a server timestamp and the acceptance source, plus messages you send to support, dispute notices and opt-out requests. Agreement controls include an adult eligibility agreement through the Terms; we do not ask for a full date of birth or independently verify age through that agreement. Core agreement receipts do not store a separate IP address or raw browser fingerprint.
• Subscription records: when you choose paid web access, Stripe customer, checkout and subscription identifiers; plan frequency, currency and amount; payment status, paid-period end and cancellation state; and a separate recurring-billing consent receipt containing the plan quote, policy versions, server timestamp and request identifier. These records connect the purchase to your account and support billing administration. Gather does not add a separate IP address or raw browser fingerprint to that consent receipt. Stripe may collect payment, billing-address, email, tax, transaction, device and fraud-prevention information directly in its hosted pages.

Please avoid putting passports, payment credentials, passwords or other unnecessary sensitive information in trip notes or support messages. Location details are places you enter or import; Gather does not collect a live device-GPS location through these planning features. Other travelers may enter shared information about you. Your device, network requests and our operational providers also supply the records described below.

How information is used and shared

We use this information to authenticate accounts, enforce trip access, keep shared plans and balances consistent, deliver requested updates, provide support and protect the service from abuse. Trip members can see the shared content made available to their trip and role. Private bookmarks, packing templates, preparation templates and itinerary templates are account-specific. Applying a private template shares its selected content and notes with the chosen trip’s members. Voting records support each account’s choices and the results shown in the trip.

Gather does not include advertising or cross-site advertising trackers. We do not sell personal information or share it for cross-context behavioral advertising, including as those terms are used by applicable California privacy law. Exchange rates are entered manually; Gather does not automatically send your expenses to an exchange-rate provider. When you choose a paid web plan, we send Stripe the account reference and the selected server-verified subscription offer needed to create checkout. We receive provider status updates and use saved subscription records to enable owner-funded premium tools, prevent duplicate subscriptions, show billing status and provide the billing portal. Private trip content, expense details and optional usage statistics are not sent to Stripe as part of this integration.

Authorized application administrators can manage accounts, recovery and service operations under their role. This does not give trip administrators application-wide permissions. We may disclose necessary information to comply with lawful demands, establish or defend legal claims, investigate misuse or protect people and the Service. Information may transfer in a merger, acquisition or restructuring, subject to applicable law and appropriate notice; it does not become unrestricted advertising data.

Opening a map, external link, shared trip link, exported calendar or private trip brief can disclose information to the destination you choose. Those websites, apps and recipients have their own privacy practices. A shared trip URL does not by itself grant trip membership.

Trip briefs are generated only from the itinerary items you select. Notes and reservation references are excluded unless you explicitly include them. The generated brief is not saved as a public link or automatically cached as a private offline pack. Copying, printing, downloading or using the native share sheet creates a copy under your or your recipient’s control; it does not update or revoke automatically after a trip changes or membership ends. Review its contents and intended recipients before exporting.

Optional place lookup

When you submit a place search, Gather sends only the phrase you enter to Wikidata through our backend. We do not automatically send your trip name, member list, private descriptions, account details or your device location. Search phrases may still reveal information you choose to type, so use public place names.

Lookup uses public structured facts, not copied Wikipedia articles or reviews. A short-lived, bounded server cache reuses public results; it stores hashed query keys without a per-account search history. Search text is not added to optional usage statistics. Selected facts and a source link become part of the shared idea only when you save it. Review those facts before saving; admission costs and hours are not verified by this lookup.

Wikimedia processes requests under its own privacy policy. You can enter every location manually without searching. The operator can disable lookup if the service is unavailable or its terms change.

Hosting, delivery and security records

Amazon Web Services hosts the backend and database. Cloudflare provides website delivery, DNS/proxy services and edge protection. When native push is enabled, Apple Push Notification service receives the device token and notification payload needed for delivery. Browser push uses your browser’s push provider. These providers process the network and delivery information needed to perform those services. Support email is handled through the operator’s mailbox service and may include the information you choose to send. We use service providers to perform these functions rather than give them permission to advertise using private trip content.

Stripe provides optional web subscription checkout, recurring billing and the hosted billing portal. Stripe collects payment credentials directly and processes transaction and security information under its privacy policy. Its checkout and portal may use cookies or similar storage for payment functionality, fraud prevention and the choices made on those pages. Gather does not embed Stripe's payment form or load its advertising scripts across ordinary planning pages.

Security and operational records can include request metadata, IP addresses, client/device labels, timestamps, delivery status and account actions. Core API session history uses broad client/device labels; hosting, web-server and edge records may separately contain IP addresses, request information and approximate country derived from network traffic. These are distinct from the optional statistics setting.

Native push alerts use a generic update message rather than including your password, trip text or expense details. You can control notification permission in your device/browser settings and notification preferences in Gather. Permissions and delivery are separate from trip access.

Cookies and device storage

The website uses necessary session and CSRF cookies for sign-in and protected changes. Theme preferences may be saved locally. The installed web app can cache public application assets so its shell opens offline; private API responses are not deliberately stored in that public offline cache.

The session lifetime is configured by the operator, ordinarily seven days and at most 30 days in this implementation; sessions can be revoked earlier. Before sign-in, a short-lived CSRF cookie can last up to one hour. Browser or device controls can clear cookies/storage, but blocking necessary cookies prevents browser sign-in and protected changes. No advertising cookie is required. Since we do not sell or share information for cross-context advertising, there is no advertising sale/share opt-in required to use Gather; a browser signal does not replace the separate optional-statistics choice.

The native app keeps its session credential in the device Keychain in builds that support saved sign-in. Signing out or revoking the session ends API access. Device verification, where available, is performed by the operating system or credential provider; Gather receives no biometric template. Calendar sharing creates a temporary file for the share destination you select.

Native passkeys use the system’s credential provider and device verification. When you choose a saved password in the native system picker, the app sends it directly to Gather’s sign-in API; it does not return that selected password to the embedded page. If you explicitly choose to save a manually entered password in Apple Passwords, iOS handles that save under your Passwords and synchronization settings. Gather briefly holds the successful sign-in inputs in native memory for that offer and does not create its own persistent password vault. Signing out of Gather ends the app session; credentials saved in your password manager remain under your control there.

Optional usage statistics

Usage statistics are off by default. You can choose “Share usage statistics” in Settings to help M3GA Studios LLC understand which screens and planning features people use. Participation is optional and does not change your access to Gather.

When enabled, Gather sends a small set of activity labels: app visits, screen views, trips created, ideas added, idea vote actions, expenses added and poll vote actions. Daily counters include a general screen name and whether you used iOS or the website. They are linked to your account to enforce your choice and support deletion. They do not include trip names, destinations, text, prices, URLs, search terms, passwords, advertising identifiers or precise location. Administrators see aggregate reports.

This first-party system sends no usage events to Google Analytics, Firebase or an advertising service, and does not track you across other companies’ apps or websites. Reports cover up to 90 UTC calendar days. Older live counters are excluded from reports and removed during bounded maintenance; downtime or a maintenance backlog can delay physical removal. Turning the setting off stops new collection and removes your live counters. Account deletion also removes them. Existing protected backups follow the operator’s backup-retention schedule. Necessary security records are separate from this optional choice.

Retention and account deletion

Retention depends on the information’s purpose, account/trip lifecycle, shared history, security needs, recovery requirements and applicable obligations. There is no single deletion period for every category:

• Account and private planning records generally remain while your account is active; shared trip and financial history can remain for the group after you leave or delete your account, as explained below.
• Sessions have configured expiration times and are pruned during sign-in maintenance. Optional statistics use the separate 90-UTC-day reporting and bounded-removal process above, rather than an unlimited activity history.
• Live agreement receipts remain with the account and are removed by account deletion. Support correspondence, dispute notices, security/audit records and records needed for legal obligations are retained according to their purpose and applicable requirements; they do not share the statistics cutoff. Billing identifiers, checkout consent and subscription history may remain linked to the non-login deleted-account record for accounting, dispute, fraud-prevention and legal requirements; deletion does not require Stripe to erase financial records it has an independent obligation to retain. These billing references can still connect records to your transaction information through Stripe. They do not contain full card numbers or private trip content.
• Protected backups, hosting logs and provider records follow their operational retention schedules and are not immediately rewritten when live records change. Access to retained copies is restricted. Contact us for information about the schedule applicable to your request.

You can start account deletion in Settings. The confirmation explains any required ownership handover, sole-participant trip deletion or administrator handover before proceeding. Deletion requires your current password and explicit confirmation. Billing accounts must first stop future renewal and finish or expire any open checkout so deletion does not leave a new charge underway. The deletion flow then ends any remaining provider subscription before removing login access. Contact support if saved billing status has not yet caught up or you cannot reach the portal.

Account deletion removes your profile credentials, sessions, private bookmarks/templates, votes, agreement receipts, manual feature-access grants, optional statistics, notification inbox and device registrations. Your membership ends, and retained shared content and financial history are associated with “Deleted traveler” so the group keeps its history and accurate balances. Text you wrote in shared fields is not automatically searched and scrubbed of personal details; edit or remove those details before deleting your account.

Deleting an eligible solo trip is a separate, explicit choice during deletion. A trip with another traveler’s membership or shared history is not treated as a solo trip. Shared trips need ownership transferred to another active participant; deleting your account does not silently delete other travelers’ shared plans. Contact us if you cannot sign in or need help with a privacy or deletion request.

Age eligibility and children’s information

Gather accounts are for adults who are at least 18 and legally able to enter the Terms of Service. The Service is not directed to children, and we do not knowingly collect personal information from children under 13. An invitation or an age-confirmation checkbox does not permit an otherwise ineligible person to use an account. If you believe a child has supplied information, contact support without sending more sensitive information than necessary. We will investigate and take appropriate steps to restrict access and remove information where required by law.

Your privacy rights and applicable legal bases

Depending on where you live and which laws apply, you may request access to personal information, correction, deletion, a portable copy, restriction of processing or an objection to processing. You can withdraw optional-statistics consent in Settings without losing ordinary service access; withdrawal does not make earlier lawful processing unlawful. Access or export requests beyond the available controls are handled through verified support requests, not an automatic all-account download button.

Where EU or UK data-protection law applies, our purposes and corresponding legal bases are providing the requested account/planning service (contract), reasonable account security, abuse prevention and service operation (legitimate interests, balanced against your rights), complying with legal obligations, and your consent for optional usage statistics. Acknowledging this policy is notice, not blanket permission for every use of data. We do not use these planning features to make solely automated decisions that have legal or similarly significant effects on you.

For California residents, the categories described above include identifiers, account access credentials, internet/network activity, user content, financial information and preferences. Sources include you, your devices, authorized travelers and operational providers; purposes and recipient categories are described in this notice. We use sensitive account credentials to authenticate and protect accounts, not to infer personal characteristics. Where the CCPA applies, you may request to know/access, correct or delete covered information, use an authorized agent subject to verification, and exercise rights without unlawful discrimination. We do not sell personal information or share it for cross-context behavioral advertising, and do not require you to waive privacy rights to use Gather.

We may verify your identity and an agent’s authority, and apply lawful exceptions needed to protect others, preserve shared records or meet legal duties. We respond within applicable legal deadlines and explain a denial or extension where required. If your jurisdiction provides an appeal, send it to support with the subject “Privacy appeal.” You may also contact your state privacy regulator, EU supervisory authority, the UK Information Commissioner’s Office or another competent authority.

International processing

Gather is operated from the United States. Information may be processed in the United States and other countries where our hosting, security, delivery and support providers operate, which may have different data-protection laws from your home country. Contact support for information about processing locations and transfer safeguards applicable to your information. This notice does not represent that every country has equivalent laws or that a particular international-transfer certification covers Gather.

Reasonable security and incident handling

We use reasonable technical and organizational measures, including account access controls, protected credentials and request safeguards, to protect personal information. No networked service or method of storage is fully secure. Keep your credentials and devices protected and report suspected unauthorized access promptly.

We investigate suspected security incidents, take appropriate containment and recovery steps, and notify affected people or authorities when applicable law requires. The information, timing and method of any notification depend on the incident and legal requirements; not every unsuccessful attack constitutes a reportable breach. Report concerns to support@gatheraway.app without including passwords or private keys.

Your choices and contact

You can edit account details, manage notification preferences, revoke sessions and use the available deletion controls in Settings. For access, correction, deletion or other privacy requests, email support@gatheraway.app. We may need to verify the request before disclosing or changing private data.

We will update this page when the service or its practices change. The date and version above identify this notice. We provide appropriate notice of material changes and seek additional consent where the law requires it; posting a changed notice does not silently enable optional statistics. Visit Support for help with accounts, notifications or shared costs, or read the Terms of Service.