Privacy
What we commit to, in plain language
A group roster holds real photographs of real families. That deserves to be settled up front, in plain language, rather than buried in a policy nobody reads.
Everything past your name is optional
A bio, a family photo, your kids, your dog — every one of those fields can stay empty forever, and the app works exactly the same if it does.
Group-members-only, by default
Whatever you do fill in is visible to the people in your group and nobody else. That is the default setting, not a preference you have to go find.
There is no public directory
Not now and not later. You will never be searchable, browsable, or discoverable across groups. This is a deliberate product decision we are writing down in public so we can be held to it.
You can remove your own information at any time
Any field, any photo, your whole profile, your whole account. Deleting your account is a button on your own profile page: no support ticket, no waiting period, no dark pattern between you and it.
Email only when you have asked for it
Every group you belong to has its own switch on your profile page. Turn one off and that group can no longer reach your inbox — not its leader, not a reminder, not a board post — while everything stays readable in the app.
We do not sell data, and there is no ad business
The business model is software subscriptions from leaders and churches who find the tool useful. Nothing about it depends on knowing more about you.
Children's photos get extra care
Family photos in a Bible-study roster often include children. Specific legal guidance on child-image and data-privacy handling is being sought now rather than worked out after something goes wrong.
How that is enforced
Commitments are cheap. These are the mechanisms behind them.
- Uploaded files — handouts and profile photos alike — are stored under opaque ids and served only through an endpoint that checks your group membership first. Nothing in the uploads directory has a public URL.
- A profile photo is visible to you and to people who share a group with you. Nobody else can fetch it, guessed URL or not.
- Private notes are filtered out of every query that another member can reach. Sharing a note with the group is a separate, deliberate choice on the form.
- The leader's dashboard is visible to leaders only. Members never see how far behind anyone else is.
- Passwords are stored as scrypt hashes with a per-account salt. Changing your password signs out every other device.
- Deleting your account removes your profile, photo, notes, board posts, prayer requests, RSVPs and uploads in one transaction, and takes you off every roster. There is no soft delete and no recovery window, because a recovery window is a copy.
- Sign-in, sign-up and password-reset forms are rate limited by address and by source, so a password cannot be guessed by patience and the reset form cannot be used to discover who has an account.
- The record of email the app has sent keeps only the address, the subject line and whether it got out — never the body — and rows older than 90 days are dropped.
- Everything an administrator does to a group or an account — pausing it, taking it out of the directory, promoting someone — is written to a log with their name on it. Administrators see counts about a group, never what was written in it.
This is not yet the privacy policy
This page is a plain-language statement of principle and practice, not a lawyer-reviewed document. A formal privacy policy and terms of service will be published, and this page will say so when they are. Until then, treat the software as early: it works, and it is small enough to read, but it has not been through a legal or a security review.
What the app stores is what you put into it — your account, your groups, your plans, your notes, and any files you upload. Nothing is sold, and there is no advertising business. Deleting your account and everything in it is a button on your profile page. If something there does not work the way this page says it should, write to hello@gatherandstudy.com.