Privacy Policy

Gather handles account information such as your email and username; profile information such as a photo and home airport; trip information such as origins, dates, budgets and preferences; invitations and group membership; social content, messages, friend/block/follow relationships and reports; and technical product events used to understand whether core app flows work.

Gather also stores account-type records used to distinguish Traveler and Professional accounts. A Professional application can include a private legal name, selected Professional specialties, a proof summary, privately stored proof files, reviewer decisions, appeals, state-change audit history and an eligible-content monetization eligibility flag. Approved Professionals can also create public Professional posts, drafts, disclosure fields, accessibility text, content analytics, earnings-ledger entries, payout history and earnings disputes. Gather's earnings ledger uses a private random ledger-account identifier rather than storing the Gather user id inside each immutable ledger entry. Travel Business organizations have separate organization, membership and verification records; private application/review data is not part of the public Business profile.

When you use Duffel flight checkout, Gather can handle the passenger details required for the airline order, including legal name, date of birth, gender, title, phone number and email. When an airline requires or supports travel documents for the selected offer, Gather can also handle passport details, Known Traveler Number or Redress Number as applicable. Guest bookings use a private high-entropy retrieval credential instead of requiring a Gather account. For trip intelligence, Gather can store limited monitoring snapshots such as fare checks, booked itinerary times, terminal information when supplied, and group arrival timing so it can detect meaningful changes. Legacy Square Sandbox records may remain from earlier checkout testing.

Gather uses this information to create and coordinate trips, match travelers into group flight options, operate account and social features, provide safety controls, process supplier-connected flight checkout, troubleshoot reliability and improve the product.

Gather identifies whether a Duffel checkout is using test or live provider inventory. Test-mode checkout does not create a real charge or airline ticket. A live-mode checkout can create a real card charge and airline order only after the provider confirms the transaction.

Gather currently uses Base44 to host and operate the app. Flight searches, secure card entry, 3D Secure authentication, and airline-order flows use Duffel in the provider mode configured for Gather. Card details entered in Duffel's embedded secure form are handled by Duffel rather than Gather's servers. In live mode, the airline charge is real; in test mode, test cards and test inventory are used. Legacy Square Sandbox references may remain only for older test transactions created before the Duffel card checkout migration. Professional payout onboarding is designed to use Stripe Connect when configured: identity, tax and bank requirements are collected by Stripe's hosted flow, while Gather stores only the connected-account identifier and high-level readiness/status fields needed to operate payouts. Gather does not store a Professional's bank-account number or tax number in its Professional workspace. Information necessary to perform requested provider actions can be sent to the applicable provider. When a commercial weather provider is configured, Gather Trip Intelligence may send destination coordinates and travel dates to that provider to obtain a nearby forecast; it does not need to send traveler identity or booking-profile information for that weather request.

Gather Intelligence uses OpenAI for streaming traveler answers when the app’s server-side OpenAI API key is configured; otherwise the traveler assistant uses Base44’s AI service and its model providers. The OpenAI model can be configured by Gather. Gather uses OpenAI for CEO/admin product intelligence and for the traveler-facing Gather Intelligence assistant. Before a traveler message, recent conversation history or limited personal trip context is sent to an AI provider, the traveler-facing assistant presents an explicit disclosure and records the traveler's consent. With that consent, the assistant can send the message being asked about, scoped recent messages and planning notes from that private conversation, its visible editable trip context, and departure airport, budget, cabin or travel interests the traveler explicitly chose to remember. Only an explicitly attached, currently authorized Trip Room or personal booking snapshot is used; unrelated trips, bookings and conversations are excluded. Attachments do not share private history with trip members. Saved assistant preferences are separate from profile preferences and conversation history, are never learned automatically, and can be corrected or deleted in Saved preferences. Deleting a conversation leaves separately remembered preferences; account deletion removes both. The traveler-facing assistant is designed not to send payment details, passenger booking profiles, passport information, Known Traveler Numbers, Redress Numbers, direct messages or the traveler's private friend list. Turning off AI privacy access disables chatting until the traveler consents again. Gather saves assistant questions and completed answers privately to the traveler’s account so conversations can be resumed across visits. Saved chat text is not written to browser local storage. Unsynced drafts, edit drafts and questions awaiting acknowledgement are temporarily stored in account-scoped IndexedDB on the current device for connection-loss recovery. They are removed after successful synchronization, on this device’s sign-out or account deletion, or when recovery storage is next opened after seven days. Other devices clear a deleted conversation’s recovery when it is next opened. If device storage is unavailable, recovery lasts only during the current app run. Revised questions create linked conversations preserving the original’s later replies; earlier confirmed planning details can be included in AI context. Stopped output is marked incomplete and is not reused as planning context. Answer feedback is saved privately with the answer. Conversation history in Inbox includes privately saved drafts and reading positions. Archive hides a conversation from the main history and keeps it available under Archived. Delete permanently removes the conversation, its messages and draft from the account across devices, including while AI access is off; account deletion removes saved conversations, turns and workspace records. Turning off AI access keeps those records until the traveler deletes them. Streaming requests to OpenAI set store to false; this does not promise deletion of provider-controlled logs or override provider retention policies.

Trip information is shared with the people participating in that trip as needed for coordination. Profile visibility follows the privacy choices available in Settings. Username discoverability does not expose your account email. Home-airport sharing is limited to accepted Gather friends, and airport-based friend matching also requires the relevant friend-suggestion and airport-sharing settings to allow it. Travel Experiences are not placed into the Travelers feed by default; you can explicitly opt in from Settings, and that feed is currently limited to accepted Gather friends while honoring blocks.

After Gather approves Professional verification, a public Professional page can show the account’s display name, username, photo, bio, Professional headline, specialties, public links, verified status, follower/following counts and Professional content the account explicitly publishes. Published Professional content can include photos, optimized video playback links, poster images, guides, trip summaries, sponsorship or affiliate disclosure text, image alt text, video captions/transcripts, destination and capture-date metadata, media-rights information, distribution links, planning-action links, and visible correction information. Drafts, earnings, payout records, provider identifiers, verification application text, reviewer notes, email, home airport, tax information, bank information, trip booking data and earnings disputes are not included in the public Professional API. Existing personal Travel Experiences remain governed by their Friends/private rules and are not automatically converted into public Professional content.

A Travel Business public page appears only after Gather verification and uses a public organization profile kept separate from restricted organization administration. It can show approved organization fields such as name, category, description, website, logo, accessibility information and a public support link. Business-member account data, organization roles, verification application/review notes, audit history and server-owned commerce capability state are not included in the public Business projection. Business verification by itself does not enable live inventory, booking checkout, settlements, Business payouts or paid promotion.

Gather does not state that it sells personal data or uses it for cross-company advertising tracking.

Gather keeps data while it is needed to operate the current app and its test workflows. Because the final production retention schedule has not been adopted, Gather does not promise a fixed production retention period here. This section describes what the current Gather-controlled deletion workflow actually does today.

You can start account deletion from Settings and then confirm permanent deletion. The current workflow first disables the signed-in user’s Gather push-device registrations, then deletes those device records. It deletes the built-in Base44 User account and supported Gather-controlled profile, social, message, saved assistant conversation and turn, notification, support, product-event, intelligence and solo-booking database records linked to that user. Professional public-profile records, drafts/published-content records, content-analytics records, private application records, verification records, applicant-owned verification-history records, eligible-content monetization-eligibility records, payout-provider setup records, earnings-dispute records and follow relationships tied to the deleting user are removed. The mapping between a Gather account and its random earnings-ledger account is deleted. Append-only ledger entries are not rewritten or deleted by account deletion, so they remain as unlinked financial-reconciliation records without the Gather user id. Payout and payout-event records retained for reconciliation are changed to a deleted-user marker rather than left linked to the original account. Reviewer audit entries on another applicant are anonymized when the deleted user was the reviewer. Account-role audit references and retained Business verification reviewer/submitter references are anonymized rather than left attached to the deleted user.

Travel Business membership is removed when a member deletes their personal Gather account. A multi-member organization remains available to its other active managers; if the deleting user is the final active manager, the current workflow deactivates that organization and suspends any active submission/review/verified state rather than leaving an unmanaged verified Business page online. Where deleting a shared record would damage another traveler’s trip history or a safety/moderation record, Gather removes the user link or substitutes a deleted-user/deleted-member marker instead. The completed deletion-request record is retained without the original user id, email or note so Gather can record that the workflow completed.

Profile images, Travel Experience media and published/draft Professional content media currently use Base44’s public UploadFile storage. Professional verification proof uses Base44 private file storage and is opened for reviewers only through short-lived signed URLs. The documented Core file API available to this project exposes upload and signed-access operations but no delete-file operation, so the current account-deletion code removes Gather’s database references to those uploads but cannot yet verify deletion of the underlying stored file object. Gather must resolve and verify that storage-retention/deletion procedure before production launch rather than claiming those uploaded objects are already erased.

Deleting a Gather account does not automatically cancel a flight and does not mean Gather has deleted records held independently by airlines, Duffel, payment processors, Apple, Base44 or another provider. Those providers may retain records under their own legal, security, accounting, fraud-prevention or operational obligations. Gather will not claim to erase provider-controlled records it cannot control. See Providers & data sharing for the current provider map.

Settings lets you control discoverability, home-airport sharing, friend trip suggestions, optional reminder categories and whether your Travel Experiences may appear in the Travelers feed for accepted friends. Feed visibility is off by default. You can apply for Professional verification or create a separate Travel Business; a legacy profile role label does not make an account verified. Essential booking and airline-change records remain transactional in Gather’s in-app inbox, while iOS push delivery still depends on the device-level notification permission.

You can also manage blocked travelers, choose what you post or send through Gather's social features, and initiate account deletion.

Use the Gather Support page for the currently available support path and product help. A permanent public support email/address will be added before production launch; Gather does not invent one here.