Who we are
This privacy policy applies to Gatherly, the online invitation and RSVP web app at https://gatherly.thimral.com, which is operated from South Africa. It covers everyone who uses it: the hosts who design invitations and the guests who reply to them. For anything in this policy, write to contact@thimral.com.
In short: we collect what is needed to run your event and nothing more. We do not sell personal information, we show no advertising, and we do not use your information to train artificial-intelligence models.
What we collect
If you create an account (organisers)
- Your name and email address.
- Either a password, which we store only as a scrambled value that cannot be turned back into your password, or your Google sign-in, if you choose that instead.
- The events you create: title, date, time, place, description, design and settings.
- Pictures you upload for your invitations.
- Your own guest list: the names and contact details you choose to add.
If you reply to an invitation (guests)
- Your name, and your email address if you give one.
- Whether you are coming, your meal choice, and your answers to the host’s questions.
- Any dietary or allergy notes you write. These can say something about your health, so only write what you are comfortable sharing with the host.
- Gift list activity, and your arrival if the host uses door check-in.
Technical information
- A sign-in cookie, so you stay signed in. We use no advertising or analytics cookies, and we run no third-party trackers.
- Your network address, used only to stop floods of automated requests. It is stored as a scrambled value and deleted within minutes.
Google user data
What Google user data Gatherly accesses
If you choose “Continue with Google”, Gatherly accesses the data you provide to us through Google sign-in. It asks Google for three things, and nothing else:
- Your email address (
email): this is your account name in Gatherly, it is how we tell your events apart from everyone else’s, and it is where we write to you about your own events. - Your basic profile (
profile): your name and profile picture, shown to you in the app so you know which account you are using. - Your Google account identifier (
openid): a reference number that lets us recognise you the next time you sign in.
We do not ask for, and cannot see, your Gmail, your contacts, your calendar, your Drive files or anything else in your Google account. We never post anything to your account, and we do not ask for your Google password: the sign-in happens on Google’s own pages.
How Gatherly uses Google user data
We use this data only to provide the service you asked for: to create and sign you into your Gatherly account, to show you the events that belong to you, to display your name and picture back to you in the app, and to write to you about your own events. We do not use Google user data for advertising of any kind, and we do not use it to decide anything about you.
Who we share, transfer or disclose Google user data to
We do not transfer or disclose your Google user data to third parties for purposes other than the ones described in this policy. We do not sell it, we do not give it to data brokers or information resellers, and we do not share it for advertising. It is stored by Cloudflare, which hosts the service for us and processes it on our instructions only. We will disclose it where the law requires it, or where you ask us to.
Limited Use
Gatherly’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Gatherly does not use Google user data, including any data obtained through Google Workspace APIs, to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models. No human reads your Google user data, except where you ask us for support, where you have given permission, or where the law requires it.
How we protect Google user data
Security procedures are in place to protect the confidentiality of your data. It travels over encrypted connections, it is stored encrypted at rest, and only the signed-in account holder can reach it; we check this on every request. The security measures described under How we protect it below apply to Google user data as well.
How long we keep Google user data, and how to delete it
We keep the name, email address, picture and account identifier from Google for as long as you have a Gatherly account, because they are what your account is made of. When the need ends, we delete the data.
You can withdraw Gatherly’s access at any time in your Google account permissions. That stops future sign-ins. To have the data already stored deleted, delete your account in Gatherly, or ask us to delete it by writing to contact@thimral.com from that address. We delete it, and everything attached to the account, within 30 days.
Why we hold it
To run the service you asked for: to show your invitation, to pass your reply to the host, to keep your account secure, and to prevent abuse. We do not sell your information, we do not use it for advertising, and we do not build profiles of you.
Who else sees it
- The host. Your reply, meal choice and notes are shown to the organiser of that event. That is the point of an RSVP.
- Other guests. Nothing is shown to other guests, except that a gift can be marked as already bought, which is anonymous.
- Cloudflare, which stores and serves the site for us. Their systems are spread across the world, so your information may be handled outside South Africa.
- Google, only if you choose to sign in with Google, which tells us your name, email address and profile picture.
- Anyone we are legally required to tell, such as a court order.
How we protect it
- Everything travels over an encrypted connection (HTTPS), and is stored encrypted at rest by Cloudflare.
- Passwords are never stored. We keep only a one-way scrambled version, made with 210,000 rounds of PBKDF2-SHA-512, which cannot be turned back into your password.
- Only the organiser of an event can see its replies and guest list. We check this on every request.
- Uploaded pictures are stored under random identifiers that cannot be guessed.
- Sign-in and reply forms are rate limited, to make automated abuse impractical.
How long we keep it
- Events, replies, guest lists and gift lists: until the organiser deletes them. Deleting an event deletes all of it, immediately and for good.
- Your account, including anything from Google sign-in: until you delete it. Deleting your account deletes your events with it.
- Sign-in sessions: 30 days, or until you sign out.
- Anti-abuse records: deleted within minutes.
To have everything removed, write to contact@thimral.com from the address on your account and we will delete it within 30 days.
Your rights
Under South Africa’s Protection of Personal Information Act you may ask what we hold about you, ask us to correct it, and ask us to delete it. Write to contact@thimral.com and we will answer within a reasonable time. You may also complain to the Information Regulator of South Africa.
If you are an organiser
The guest list you build is yours. You decide who goes on it and what you do with the replies, and you are responsible for having a reason to hold those people’s details. We hold them on your behalf and use them only to run your event.
Children
Gatherly is meant for adults arranging events. A child may of course be invited to a party and be named on a guest list by their parent, but accounts are for adults.
Changes
If this policy changes we will update the date at the top of this page, and for important changes we will say so in the app.