Privacy policy

Draft: this page is still being agreed and is not yet in force.

Gather is our church's app for chats, groups and channels. This page explains what data Gather processes, what for, for how long, and what rights you have. The German version is the binding one.

At a glance

• Gather shows no ads, doesn't track you and doesn't sell data. There are no analytics or tracking services, neither in the app nor on this website.
• The servers are in Frankfurt am Main, Germany.
• Only the people in a chat see its messages. They are encrypted in transit and on the server, but not end-to-end encrypted.
• What you delete is gone for everyone at once. For the protection of children and young people it stays stored, hidden, for 30 more days and is then erased for good.
• You can delete your account at any time, in the app or on the Delete your account page.

Who is responsible

To be added.

For any question about privacy and for your requests: hallo@gather.paiss.me

What data Gather processes, and what for

Account and sign-in

You sign in with your email address. Gather sends you a six-digit code for that; there is no password. The code is stored only as a check value, never in plain text, together with the IP address that asked for it. This lets Gather limit how many codes an address or a network can request, and protects your account against guessing. Codes and IP addresses are deleted after 7 days.

Your profile holds your name, a profile photo if you like, your date of birth, your local church and the app's language. Other members only see your name and your profile photo. A profile photo you replace or remove is deleted by the next day, unless it was reported (see below).

Gather needs your date of birth to protect young people: it decides who may write to whom. For example, adults and minors don't write to each other one to one, and a group with adults and minors needs at least two adults whose enhanced criminal record certificate the church has on file. You can enter your date of birth once; after that only the people responsible can correct it.

Your account also has a status (guest, member or suspended) and, if the church has your enhanced criminal record certificate on file, a note saying so, with the date. Gather doesn't store the certificate itself.

When you sign up, Gather asks whether you agree to the privacy policy and the terms. Gather records which version you agreed to and when. After signing up you are a member at once. Whoever approves accounts at your church gets a notification with your name that you joined, and can remove your account again. Gather records who removed an account, with their name and the time. The church may later bring back approving each new account first; this page will then say so.

Messages, groups and channels

Gather stores what you send so that it reaches the others and is on all your devices: texts, photos, videos, voice messages and files, with file name, size, image dimensions, duration and a small preview image. Then there are the chats themselves: title, description, photo, members and their roles, when someone joined or left, and your settings such as mute and your chat folders.

When you react to a message with an emoji, Gather stores who reacted how. In direct chats and groups the others see who reacted; in channels they only see how many.

When you forward a message, the other chat gets a copy with its files and a note of where it came from: the person who wrote it, or the channel it was posted in. So whoever forwards a message of yours passes your name on with it. The copy is a message of its own: it stays when the original is deleted, and is deleted like any other.

Gather remembers how far you have read. In direct chats and groups the others see from this whether their message was read (the check marks). In direct chats and in groups of up to 100 members, Gather also stores when you read: whoever sent a message sees for a week who read it and when. These times are deleted after 7 days. In channels Gather only counts how many saw a post, not who. That you are typing is shown to the others in the chat only at that moment; it isn't stored.

When you edit a message, Gather keeps the earlier version, so an edit can't hide what was written. Others only see that the message was edited.

When you delete a message, it is gone for everyone at once. Its text, earlier versions and files stay stored, hidden, for 30 more days, so that the people responsible can follow up a concern about the safety of children or young people, and are then erased for good. When its owner deletes a group or channel, the same goes for every message in it; after those 30 days its title, description and photo are erased too. Files you upload but don't send are deleted after 24 hours. In a group or channel its admins see under "Recent actions", as in Telegram, what changed in the last 48 hours: title, description, photo and settings, who joined, left or was removed, who became an admin, what was pinned, and the text of a message an admin deleted. These entries are deleted after 48 hours.

Search runs on the server over the messages of the chats you are in. What you search for isn't stored.

Messages are encrypted in transit (TLS) and encrypted at rest. They are not end-to-end encrypted, so technically the operators could read them. They do so only when it is needed to run Gather, to follow up a concern about the safety of children and young people, or when the law requires it.

Telegram

You can sign in with Telegram and you can connect Telegram to bring the church's Telegram chats into Gather. Both are optional; you can always sign in with your email address instead.

When you sign in with Telegram, you enter your phone number and the code Telegram sends you. Gather's server logs in to your Telegram account once, reads your name, phone number, date of birth and profile photo from it for your new account, and then stays logged in: your Telegram is connected as described below once you are a member, and you can disconnect at any time. If your Telegram account is already connected to Gather, or you don't become a member within 7 days, it logs out again. Your phone number is stored only while you log in.

When you connect Telegram (Settings → Telegram), Gather's server stays logged in to your Telegram account until you disconnect. It keeps your Telegram login, encrypted with a key of its own for each person; whoever has it could use your account, so it never leaves the server, every use is logged, and it is deleted when you disconnect or delete your Gather account. While you are connected, Gather:

• reads which groups and channels you are in on Telegram, and the one-to-one chats with their members, and shows you which of them come into Gather (you can switch each one off);
• copies the messages, files, reactions and members of these chats into Gather, including what people wrote who don't use Gather themselves, with their Telegram name and photo;
• sends what you write, react or change in these chats in Gather to Telegram in your name, so the people there see it as coming from you.

Messages copied from Telegram are stored and deleted like any other message in Gather. When you disconnect, nothing more is copied in either direction; what was already copied stays in the Gather chats. What you send to Telegram is then stored by Telegram under its own privacy policy.

Translate, transcribe and location

When you tap Translate on a message, Gather sends its text to Amazon Translate in Frankfurt am Main; Amazon doesn't keep it. When you send or search for a location, Gather gets the map, address and places nearby from Amazon Location Service in Frankfurt am Main; Amazon only gets the coordinates and search words, not who you are.

When someone has a voice or video message transcribed, Gather sends the recording to ElevenLabs (see Who else receives data), which turns it into text without learning who recorded it. Gather asks ElevenLabs to keep neither the recording nor the text, and where it can't, deletes the text there right after. Very long recordings, and all of them while ElevenLabs can't be reached, are transcribed by Amazon Transcribe in Frankfurt am Main instead; Amazon doesn't keep them. Gather keeps the text with the message, for everyone who may hear it, and deletes it with the message.

Calls

For calls and video chats, Gather stores who called whom and in which chat, whether with video, when the call started, whether and when it was answered, when it ended and how (missed, declined, busy). For video chats in groups and channels it stores who joined and left when. These details are deleted 30 days after the call ended. The chat shows a note such as "Missed call" or "Call, 5 min", which stays like a message until it is deleted.

Sound and picture go through Gather's own media server in Frankfurt am Main, also when a network blocks direct connections. Calls between two people are end-to-end encrypted: the two devices agree on a key as they connect, which the server doesn't know, and both show the same four emoji, by which you can check it; the server only passes on what is encrypted. Gather never records calls between two people. Video chats in groups and channels are encrypted in transit (DTLS-SRTP), but not end to end: the server passes them on. Video chats in groups and live streams in channels can be recorded by the admins who may manage video chats, as in Telegram. While one is recorded, everyone in it sees a red dot and a note. The recording (picture and sound, or sound alone) goes to the Saved Messages of the person who started it and stays there like a message until it is deleted. It is recorded on Gather's own servers in Frankfurt am Main; anything of it left behind, as when something went wrong, is deleted after 2 days. Those admins can also stream into a video chat or live stream from another app, such as OBS, with a stream key only they see, as in Telegram: the stream comes in encrypted (RTMPS) to Gather's own servers in Frankfurt am Main, which put it into the sizes the apps play and pass it on without storing it. Otherwise Gather stores neither sound nor picture. When someone calls you, your devices get a notification saying who is calling; with Preview turned off it only says "Incoming call".

Your devices

For each device you are signed in on, Gather stores the platform (iPhone, Android, web), the device name, the app version, and when you signed in and last used Gather. You see the list in the app's settings and can sign out other devices there. Signed-out devices are deleted after 30 days.

On the device itself, your sign-in key is in the system's protected storage (Keychain on iOS, Keystore on Android), and your chats are in the app's private storage so they are there without a connection. Signing out removes both from the device. In a browser, both are in the browser's storage for this site.

Notifications

If you allow notifications, Gather stores the device address that Google (Android) or Apple (iPhone) issues for your device. A notification travels through the servers of Google (Firebase Cloud Messaging) or Apple (Apple Push Notification service) to your device. It says who wrote, in which chat, and the beginning of the message. If you turn off Preview in the settings, it only says "New message". When you read a chat on another device, your other devices get a silent notification with the number of unread messages.

On Android devices, Google's notification service also gives the app an installation ID for this.

Server logs

When the app or this website reaches the server, it logs the IP address, the app's or browser's identifier (user agent), the time, the request without its content and its result, and for errors the error message. This is for security and troubleshooting. Logs are deleted after 30 days.

Email

Gather sends the codes for signing in and for deleting an account through Amazon SES from noreply@gather.paiss.me. It sends no other email, such as ads or newsletters.

Reporting and blocking

When you report something, a message, a group, a channel or a person, Gather stores the reason, your note, who reported it and when, and a copy of what was reported: for a message its text, who sent it when and in which chat, and its files; for a group or channel its title, description and photo; for a person their name and profile photo. So nothing is lost if what was reported is changed or deleted afterwards. While the report is open, a deleted message and its files aren't erased after 30 days either, and a reported photo is kept even if it was replaced.

Only the moderators see reports: people from the church with an enhanced criminal record certificate who are appointed for this. They see the reported message, also from chats they are not in, but not the rest of the chat. They can delete the message for everyone, remove a reported photo and suspend accounts. Whoever was reported doesn't learn who reported them. For each new report, the moderators get a notification and an email to hallo@gather.paiss.me, both without what was reported. Closed reports are deleted after 365 days, so that during that time it can be seen whether someone is reported again and again.

When you block someone, Gather stores whom you blocked and since when, until you unblock them or one of the two accounts is deleted. The blocked person can then no longer write to you one to one, find you or add you anywhere. In your direct chat they see that they can't write to you.

MyShare: your balance in your local church

Only where your local church has switched MyShare on: the church's treasurer keeps a balance for each member. For that, Gather stores your name, your reference number, the church's bank statements (date, amount, the payer's name and IBAN, the transfer's text), the IBANs you pay the church from, your bookings (payments, costs of events, bookings by hand) and who made each booking when. Your balance and your bookings are seen only by you and your local church's treasurer, that is whoever has the role with the permission "Keep the accounts". For the worldwide church, the treasurer exports only reference, name and balance. Like everything else, the data is in Frankfurt (AWS eu-central-1).

Calendar: your local church's events

Only where your local church has switched the Calendar on: Gather stores its events (planned in Gather, or read in from the calendar feeds your church chooses, without the e-mail addresses and meeting links that forwarded invitations carry) and your answer to each one (going, maybe, not going). Everyone in your local church sees how many come; who answered what is seen only by whoever has the permission "Plan events" there. The events are shown to you by your age on the day, from your birth date. Reminders of the events you come to go to your devices like other notifications, unless you turn them off. If you make your own calendar link (for Outlook, Google or your phone), whoever has that link can read the events you come to; a new link stops the old one. Like everything else, the data is in Frankfurt (AWS eu-central-1).

This website

This website sets no cookies and loads nothing from other providers. The hosting provider processes your IP address to deliver the pages to you. If you use the form on the Delete your account page, your email address and the code go to Gather's server.

Legal bases

• Art. 9(2)(a) and Art. 6(1)(a) GDPR, your explicit consent: using Gather shows that you belong to our church or are in touch with it. That can reveal your religious belief, a special category of personal data. That is why Gather explicitly asks you when you sign up whether you agree. You can withdraw your consent at any time by deleting your account or writing to hallo@gather.paiss.me. What happened until then stays lawful (Art. 7(3) GDPR).
• Art. 6(1)(b) GDPR, so you can use Gather: account, sign-in, messages, devices and notifications, and signing in with or connecting Telegram, translating, transcribing and locations when you ask for them.
• Art. 6(1)(f) GDPR, from our legitimate interest in safe operation and in protecting children and young people: the youth rules based on the date of birth, notifications about new accounts, keeping deleted and edited messages, reports and blocks, limiting codes, and the server logs.
• Art. 7(1) GDPR and Art. 6(1)(c) GDPR, to be able to show that consent was given: when you agreed.
• Art. 6(1)(f) GDPR, from our legitimate interest in improving the app with the people who use it: feedback you give (see Who else receives data).
• Art. 9(2)(d) and Art. 6(1)(b) GDPR for MyShare: your local church's treasurer keeps your balance as part of its activities for its members; Art. 6(1)(c) GDPR with Section 147 AO and Section 257 HGB (German tax and commercial law) for keeping the bookings.
• Art. 9(2)(d) and Art. 6(1)(b) GDPR for the Calendar: your local church plans its events for its members, and you answer whether you come.
• Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) for what the app stores on your device: it doesn't work without it.

Who else receives data

Gather works with these service providers, with whom data processing agreements are in place:

• Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg: runs the servers in Frankfurt am Main where everything is stored and runs, and sends the emails with the codes.

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: delivers notifications to Android devices.

• Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland: delivers notifications to iPhones.

• Eleven Labs Inc., 169 Madison Ave #2484, New York, NY 10016, USA: turns voice and video messages into text when someone asks for it. It gets only the recording, without a name or chat, and keeps neither it nor the text.

Only if you give feedback (the bubble at the edge of the screen, which you can switch off in Settings), two more services take part. They never get your chats or anything other people wrote:

• Eleven Labs Inc., 169 Madison Ave #2484, New York, NY 10016, USA: runs the assistant you talk or write to. It gets what you say or write to it, your first name, which screen of the app is open, with the app's own words on it, your last steps in the app (which screens and buttons), and your device and app version. It keeps no recordings of the conversation and deletes the transcript after it.
• GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA: your feedback becomes a task for the developers there. It holds the summary you agreed to or your own text, the screen, your last steps, device and app version, and a sketch of the screen with only the app's own words. Your name isn't in it.

Only if you sign in with Telegram or connect Telegram (see Telegram), Telegram FZ-LLC, Dubai, United Arab Emirates (with the other companies of the Telegram group), takes part: your own Telegram account is logged in from Gather's server, and what you write in a connected chat goes to Telegram in your name. Telegram is not a processor for Gather but processes this as the provider of your Telegram account, under its own privacy policy and terms.

If you download Gather from the App Store or Google Play, Apple's or Google's privacy policy applies to that.

When you sign up, whoever approves accounts at your church learns your name and can remove your account. The people responsible for Gather also note whether a criminal record certificate is on file, and can suspend accounts. For this they see your account details, but not your messages. The moderators also see what was reported (see Reporting and blocking).

Your data is not sold and not used for advertising. Gather gives data to authorities only when the law requires it or to avert a danger to children and young people.

Transfers outside the EU

The data is stored in Frankfurt am Main. Amazon, Google and Apple belong to groups based in the United States, so access from there can't be ruled out entirely. Feedback you give also goes to ElevenLabs and GitHub in the United States, and voice and video messages someone has transcribed go to ElevenLabs. Amazon, Google, Apple and GitHub are certified under the EU-US Data Privacy Framework, for which the European Commission has found an adequate level of protection (Art. 45 GDPR). The EU's standard contractual clauses apply as well (Art. 46 GDPR). If you sign in with Telegram or connect it, data also goes to Telegram, whose company is based in the United Arab Emirates, a country without an adequacy decision; Gather sends it there because you ask for it (Art. 49(1)(b) GDPR).

How long Gather keeps data

Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), erased (Art. 17), its processing restricted (Art. 18), and to receive it in a common format (Art. 20). Where we rely on a legitimate interest, you can object to the processing (Art. 21). Write to hallo@gather.paiss.me. You can delete your account yourself, in the app's settings or on the Delete your account page.

You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example in the state or country where you live.

Children and young people

Gather is for ages 13 and up. Special protection rules apply to minors, see Account and sign-in above. Parents can write to hallo@gather.paiss.me at any time; at their request their child's account is deleted.

Security

Connections are encrypted, and the database and the files are stored encrypted on the servers. The server stores sign-in keys and codes only as check values. Only a few people responsible have access to the servers, and every change to how they are run is logged.

Changes

When Gather changes, we update this policy. The date at the top shows when that last happened.