Privacy policy

Gather is sign-up sheet, booking and survey software operated by JRAM Productions. This policy covers this site and everything under it. It describes what the software actually does, checked against the code rather than written from a template.

Two kinds of people, treated differently

Organizers hold an account and run sheets, booking pages and surveys. Invitees are members of the public who signed up for a slot, booked a time or answered a survey. They never hold an account.

For invitee data, the organization that collected it decides what happens to it. Gather processes that data on the organization's instructions. If you signed up for something and want your details changed or removed, ask the organization that ran the sheet first. They can do it themselves from inside Gather, and they are the ones who owe you an answer.

What organizers give us

• Name and email address, from the iUtils account used to sign in.
• The IP address and browser user agent recorded at sign-in, so an account holder can spot a session they do not recognise.
• Two-factor secrets, if two-factor authentication is turned on. These are encrypted.
• Whatever is typed into an organization: event types, availability, questions, survey wording, branding, and settings.

What invitees give us

• Name and email address, to take a sign-up sheet slot or book a time. Both are required there, because the organizer has to know who is coming and how to reach them about it.
• For a survey, only what the organizer chose to ask. A survey can require an email address, offer it as optional, or not ask at all, and a name is never required. Leaving both blank answers the survey anonymously.
• A phone number, when the organizer asks for one or turns on text reminders.
• Answers to the questions the organizer wrote, and any note left when booking. These are free text, so their contents are the organizer's choice rather than ours.

What is collected automatically

Very little, on purpose. There is no analytics product, no advertising tracker, no session replay and no heatmap tooling on any page, public or signed-in. The cookies set are the session cookie and the CSRF token, both needed for the site to work at all.

Server logs and error reports are kept for operating the service. Error reports carry account and organization identifiers plus the route that failed, not names or addresses.

Google Calendar data

Connecting a calendar is optional and personal. Nothing is read from anyone's Google account until that person connects it themselves from the Calendars screen, and one organizer connecting a calendar does not give Gather access to anyone else's.

Gather asks Google for these permissions, and no others:

• See free and busy times on your calendar. Used so your booking page stops offering times you are already busy. Google returns start and end times only for this permission. It does not return event titles, guests, descriptions or locations, and Gather therefore never sees them. The busy times themselves are held in a short-lived cache and are not written to the database.
• Create and manage events on your calendar. Used to put a confirmed booking on your calendar, to remove it if the booking is cancelled, and to create a Google Meet link when the event type is set to meet that way. The event Gather creates carries the event type name, the invitee's name, the start and end time, any note the invitee left, and the invitee's email address as a guest.
• See your email address. Used to label the connection on your Calendars screen and to recognise a reconnection of the same account rather than duplicating it.

What is stored, and where

• The access and refresh tokens Google issues. These are encrypted at rest with the application key.
• The email address of the connected account, and the identifier of the calendar being used.
• The Google event identifier for each booking Gather created, so the right event can be removed later if the booking is cancelled.
• A notification channel registration, so Google can tell Gather that something on the calendar changed. Google sends a channel identifier and a token in that notification, never the contents of an event.

Who Google user data is shared with

Google user data is shared with, transferred to, or disclosed to the following, and only for the purpose given:

• The invitee who booked the time, and any guests they added. They receive the Google Meet link Google created for the booking, in the confirmation and reminder emails Gather sends them. Google also sends the invitee the calendar invitation Gather created, because they are its guest. The booking page the invitee chooses from shows open times worked out from your busy times. It never shows the busy times themselves, or anything else from your calendar.
• Owners and admins of your own Gather organization. The organization's activity log records that a calendar was connected or disconnected, with the email address of the Google account, so the people responsible for the organization can see which accounts are linked to it.
• JRAM Productions, as the operator. Gather is self-hosted. The servers, the database, its backups and the mail server run on the operator's own infrastructure. Stored Google data (the encrypted tokens, the connected email address, the calendar identifier and the event identifiers) lives there and is not handed to an outside hosting or email company.
• Cloudflare, as the network provider. Traffic to and from this site passes through Cloudflare's network, encrypted in transit. Cloudflare processes it only as far as delivering and protecting that traffic requires, and Gather does not ask Cloudflare to store it or give it to Cloudflare for any other purpose.
• Anyone the law requires. Only when compelled by a valid legal process, and only what that process requires.

That is the complete list. Google user data is not shared with Microsoft, Zoom, Stripe, Twilio or any other service Gather connects to, is not included in error reports, and is not shared with any other organization.

What never happens to it

Google user data obtained through these permissions is not sold, not used for advertising, not used to train or improve any artificial intelligence or machine learning model, and not transferred to anyone other than those listed above.

Gather's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Read the Google API Services User Data Policy.

Disconnecting

Disconnect on the Calendars screen. That deletes the stored tokens and tells Google to stop sending change notifications. Events Gather already placed on your calendar stay where they are; they are yours, and silently deleting a past meeting would be the wrong default.

You can also revoke access from your Google account at myaccount.google.com/permissions. Doing it there stops the sync immediately, and the connection will show a sync error in Gather until you remove it. Your booking pages keep working either way. They simply stop checking your calendar for conflicts, so double bookings become possible again.

Microsoft 365 and Zoom

A connected Microsoft 365 calendar works the same way as Google: busy times in, confirmed bookings out, tokens encrypted, connection made and broken by the individual organizer.

Zoom receives a meeting title and time when an event type is set to create Zoom links, and the invitee's email address when that event type adds them as a participant. No Zoom connection means no data goes there.

Payments

An organization can charge for bookings using its own Stripe account. Where that is turned on, the invitee pays on a page hosted by Stripe and the money goes straight from the invitee to the organization. Gather never holds the funds and never sees or stores card details. What Gather keeps is the payment status and the Stripe checkout session identifier, which is what lets a paid seat be confirmed and an abandoned one released.

Email and text messages

Confirmations, reminders, invitations and organizer broadcasts go out by email through the operator's own mail server. Text reminders, where an organization has turned them on, go through Twilio.

Every bulk message carries an unsubscribe link. Unsubscribing adds the address to a suppression list that is kept deliberately, even after an erasure request. Forgetting that somebody asked not to be contacted would mean mailing them again on the next send, which is the opposite of what they asked for.

Who else can receive data

• Google, for a connected Google calendar: confirmed bookings are written to that calendar. What Gather receives from Google, and who that is shared with, is covered under Google Calendar data above.
• Microsoft, for a connected Microsoft 365 calendar.
• Zoom, for event types that create Zoom links.
• Stripe, for organizations taking payment, under that organization's own Stripe account.
• Twilio, for text reminders.
• Cloudflare, which carries traffic to and from this site encrypted in transit.
• Sentry, when an error occurs and error reporting is configured, receiving identifiers and a route rather than personal details.

Gather is self-hosted: the servers, database, backups and mail server are the operator's own, so none of those is an outside company.

Nobody else. Gather does not sell personal data, has never sold personal data, and has no advertising business that would give it a reason to.

How long things are kept

An organizer account lasts until it is deleted. Invitee data is kept for as long as the organization chooses on its own settings page. The default is to keep it, because most organizations want their own history.

Where an organization sets a retention window, a daily job anonymises invitee details once that window has passed. It only touches records whose activity has fully finished, so nobody who is still expected to turn up can be erased out of a schedule.

Anonymising replaces the name and email address rather than deleting the row. The organization keeps accurate counts and history, and nothing identifying is left behind. The audit log is the exception: entries there are retained, because a record that the person it describes can rewrite is not an audit trail.

Your rights

If you signed up for something, ask the organization that ran it. They can export everything held about one email address, or erase it, from inside Gather, and they are the ones responsible for answering you.

If you hold a Gather account, or the organization is not responding, write to [email protected].

How it is protected

• Calendar tokens are encrypted at rest.
• Passwords are hashed, and two-factor authentication is available on every account.
• API keys are stored as hashes. The key itself is shown once at creation and never again.
• Each organization's data is isolated from every other organization's.
• Traffic is served over HTTPS.

No system is beyond breaking. If personal data is ever exposed, the affected organizations are told without undue delay, with enough detail to meet their own obligations.

Children

Gather is not directed at children and does not knowingly collect data from them directly. An organization may well collect a child's name through Gather, as a school running a sign-up sheet does, and that organization is responsible for the consent behind it.

Changes

Material changes are announced to organization owners by email, and the effective date at the top of this page is updated. Continuing to use Gather after a change means accepting the revised policy.

Contact

Questions about this policy, or about data held about you, go to [email protected]. Gather is operated by JRAM Productions.