Privacy & Data

The boundaries we build around

No advertising business: we do not sell gathering data or use it to target ads.
A guest link grants limited access, not a view of the host's private workspace.
A gathering must not silently become a permanent circle or a reputation profile.

1. Accounts and guest links

A verified account is required to own a gathering. An invited guest can participate through a scoped link without one. Anyone holding the link may be able to use its access; share it carefully.

2. Where details live

The server keeps owned gathering and guest coordination records; the device holds a cache and choices such as reminder lead time. Clearing a device does not delete the server record. Photos added through the current close-out screen stay on that device unless private account saving is explicitly enabled. A guest-submitted need is shared for that gathering within its disclosed scope.

3. Outside services

Supabase runs authentication and the database; Cloudflare delivers the site and its Turnstile challenge. A messaging, calendar, map or photo service you choose handles its own part. Paid purchasing is not active in this preview. The final notice must name the production email and diagnostic providers after they are verified.

4. Deletion and records

Account deletion is designed to remove attributable personal details and solely owned gatherings. A shared gathering with another owner may retain non-identifying facts. Deleting a link to a photo held elsewhere does not delete the original, and revoking access cannot remotely wipe a device's cache. The complete deletion flow remains under live acceptance testing. If you spent an app-store purchase on an Occasion Pass, a one-way fingerprint of that purchase is kept after your account is deleted, with nothing that links it to you, so the same purchase cannot be spent twice.

5. Questions and security reports