Gathery Privacy Policy
Last updated: 4 November 2026
The short version
- Gathery is run by Fermata FZE, in Sharjah, UAE. We decide how your data is used.
- We collect what we need to run a safe, invite-only community: your account, your profile, your swaps, your chats and any reports.
- There are no ads, no analytics and no tracking cookies. We don't sell your data.
- Chats are stored, and our team can open them if needed. Every access is logged.
- Your data is handled outside the UAE. It may be processed in India, the EU, the US and other countries where our providers operate.
- When you leave, your data is deleted within 30 days, with a few exceptions explained below.
- You can ask to see, correct or delete your data at any time: support@gathery.ae.
Who we are
Gathery ("Gathery by Fermata") is a brand of Fermata FZE. Fermata FZE is licensed in the Sharjah Publishing City (SPC) Free Zone, Sharjah, United Arab Emirates (licence formed 26 March 2025).
- Licence number: 4420000.01, issued by the Sharjah Publishing City Free Zone
- Formation: free zone establishment, formation number 4420000
- Registered address: Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates
- Email for privacy questions and requests: support@gathery.ae
Fermata FZE is the controller of your personal data. That means we decide why and how it is used, and we're responsible for looking after it under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL").
In this policy, "Fermata", "we", "us" and "our" mean Fermata FZE.
When you sign up, you accept this Privacy Policy and our Terms of Use (gathery.ae/terms) by ticking the "I agree" box. This policy is written in English. If it's ever translated, the English version applies.
What this policy covers
This policy covers the Gathery web app and pages at gathery.ae, and the emails Gathery sends. It doesn't cover other websites, such as the work links members add to their profiles.
What we collect
When you sign up
- Your email address and password. Your password is handled only by our sign-in provider (Supabase Auth) and stored as a one-way hash (bcrypt). We never see it.
- Invite details: the invite code you used, who created it, and who referred you. If you create invite codes, we also record who used them.
- Your confirmation that you're 18 or over, and that you've read the Community Guidelines.
Your profile
- Your name, bio, highlights and a link to your work.
- Your photo, if you add one. It's visible only to signed-in members and can't be reached through a public link.
- The skills and resources you offer, and how you work (in person, remote or both).
- Your location: your country, plus your emirate if you're in the UAE, or your nearest main city if you're elsewhere.
Private contact details
- Your contact number.
- Your WhatsApp number, if you choose WhatsApp updates and it's different from your contact number.
Only you, and Fermata team members with the admin role, can see these numbers. The Founder decides who has the admin role. They're never shown to other members, including the people you swap with.
Your choices
- The choices you make when you set up your profile: email notifications for chats, WhatsApp updates, project check-ins and sharing your story.
Swaps and exchanges
- Swap requests, project names and descriptions, notes, the skills, resources and hours involved, dates, and each swap's status.
- Reasons you give if you decline or cancel a swap.
- Your exchange record, such as "12 exchanges completed · 34 hours exchanged". Hours are a record of participation, not currency.
Messages and thank-you cards
- The messages you send and receive in Gathery chat.
- Thank-you cards you send or receive, and whether you show them on your profile.
Safety
- Reports you send through "Report a problem": the category you choose, what you tell us, any screenshot you add, and a copy of the profile, exchange or chat you reported.
- Members you block.
- Our chat access log: which admin opened which chat, when, and why.
When you contact us
- Your emails to support@gathery.ae, including appeals.
Technical data
- Essential sign-in and session data that keeps you signed in, and a bot-protection cookie (see "Cookies and browser storage").
- Short-lived technical logs kept by our providers, which can include IP addresses (see "How long we keep it").
What we don't collect
- We don't use analytics or tracking tools, and we don't show ads.
- We don't ask for sensitive information, such as health, religion or political views. Please don't share it in your profile or chats.
Who can see what
Signed-in members can see your profile: name, photo, bio, highlights, work link, skills and resources, area, how you work, your exchange record (such as "12 exchanges completed · 34 hours exchanged"), and any thank-you cards you choose to show.
The public and search engines can't see your profile. Member pages need sign-in, so profiles aren't visible to search engines or to anyone who isn't a signed-in member. Member pages are also marked so that search engines don't index them.
Other members can't see your email, contact number, WhatsApp number or settings, even when you're swapping with them. Your private "hours given and received" line is visible only to you. Members you block can't see you in the directory or message you.
The Gathery team at Fermata can see what's needed to run the community: reviewing new members, handling reports and support, and keeping Gathery safe. Only team members with the admin role, given by the Founder, can see contact and WhatsApp numbers.
Chats. Chats here are stored, and our team can open them if needed, for example if something's reported. Every access is logged. Use chats to connect and agree swaps, and keep anything confidential elsewhere.
When an admin opens a member chat, a record is written to the chat access log. Admins can't edit or delete that record. An admin must give a reason before opening a chat that hasn't been reported.
Why we use your data, and on what basis
| Why | What data | Basis under the PDPL |
|---|---|---|
| To create and run your account, and review your application | Sign-up and profile details, contact number | To provide the service you signed up for under our Terms |
| To keep Gathery invite-only and safe: knowing who invited whom, and recognising repeat applications | Invite details, declined applications | To provide the service under our Terms |
| To show your profile and help members find each other | Profile details | To provide the service under our Terms |
| To run swaps, chats and thank-you cards | Swap details, messages, cards | To provide the service under our Terms |
| To send account, swap and message emails | Name, email, email content | To provide the service under our Terms |
| To keep the community safe: reports, blocks, removals, appeals, opening chats when needed | Reports, chats, blocks, access log | To provide the service under our Terms, and to protect members' safety |
| Project check-ins, sharing success stories, WhatsApp updates | Name, contact details, your story | Your consent (optional, and you can withdraw it any time) |
| To build, maintain, test and secure Gathery, including with AI tools | Any data needed for the task | To provide and run the service under our Terms |
| To follow the law and respond to lawful requests | Any relevant data | Legal obligations |
Emails we send
Gathery sends emails from notifications@gathery.ae. Account emails and swap emails are always on. Message emails (a first message, a first reply, and one reminder about an unread message) can be switched off on the Profile tab. Our emails never include the text of your messages.
How we use AI
The Gathery app itself has no AI features that process member data.
Fermata does use AI tools to build, maintain, test and support Gathery:
- Fermata's own AI assistants, which run on the Grok Bot platform.
- Lovable's AI app builder, which we use to build the app.
What our AI assistants can do. Our AI assistants can access Gathery's live database when a task needs it. For example: checking a change, fixing a bug, running security tests, handling reports, and admin tasks such as changing a member's role.
How we keep that in check.
- They look at real member records only when a task requires it, and use sample data wherever possible.
- They never export or copy member data outside the system.
- Every change to the database is approved by a person at Fermata first.
Lovable. Lovable builds screens without member data being shared with it, although its tooling is connected to the project's database.
Training. Member data in the Gathery database is not used to train AI models. Where a provider offers a setting that switches off AI training, we choose that setting.
If you have questions about how we use AI, or want to object to it, email support@gathery.ae.
Who we share data with
We don't sell your data, and we don't share it with advertisers. We share it only with:
Service providers that help us run Gathery. They may only use your data to provide their service to us.
| Provider | What they do | Where | Data involved |
|---|---|---|---|
| Supabase | Database, sign-in and file storage (such as profile photos) | Mumbai, India | All account, profile, swap, chat and report data |
| Lovable | Builds and hosts the web app; its AI builder helps us build it | Global edge network (Cloudflare); no single region | Data passing through the app as it runs; its tooling is connected to the database (see "How we use AI") |
| Cloudflare (through Lovable's hosting) | Delivers the app and protects it from bots | Global | Technical data such as IP addresses, and a bot-protection cookie |
| GitHub (code) | Stores the app's code in a private Fermata repository | United States | None. Code and fictional sample or test data only |
| GitHub (backup processing) | Runs our nightly backup on a temporary, single-use machine | United States | For a few minutes each night: a copy of the database (including sign-in records) and stored files, sent over an encrypted connection and encrypted (AES-256) there. The unencrypted copies are deleted straight away and the machine is destroyed after each run. Nothing is kept on GitHub except run logs (90 days) that contain no member data |
| Google (Google Drive) | Stores nightly encrypted backups of the database and stored files (such as profile photos) in a restricted Fermata folder | No fixed region | Encrypted copies of the database, chats included, and stored files such as profile photos |
| Resend | Sends Gathery's emails | Sends from Ireland (EU); Resend stores its customer data in the United States | Names, email addresses and email content |
| Grok Bot platform | Runs Fermata's AI assistants | United States | Data an assistant looks at for a task (see "How we use AI") |
The terms we have with these providers.
- Supabase and Resend: their standard data processing terms apply to us, including the EU Standard Contractual Clauses for international transfers.
- Lovable, GitHub, the Grok Bot platform and Google Drive: we use these providers under their standard terms. Where formal data processing agreements or transfer clauses are available on our plan, we put them in place, and we limit what data they can access.
Other members, as described in "Who can see what".
Authorities, if the law requires it, or to protect someone's safety.
A new owner, if Gathery or Fermata is reorganised or sold. This policy would still apply to your data.
Your data outside the UAE
Fermata is based in the UAE, but your data may be processed in India, the EU, the US and other countries where our providers operate:
- India: our database and sign-in (Supabase, Mumbai).
- Ireland (EU) and the US: our emails are sent from Ireland by Resend, which stores its customer data in the US.
- Worldwide: the app is delivered through Cloudflare's global network (via Lovable), and our encrypted backups are stored in Google Drive, which has no fixed region.
- United States: our code is stored on GitHub (no member data). Each night, our backup runs on a temporary GitHub machine: your data is copied there over an encrypted connection, encrypted within minutes, and the unencrypted copy is deleted straight away. The machine is destroyed after each run, and only the encrypted backup is kept, in Fermata's Google Drive. The Grok Bot platform, which runs our AI assistants, is also in the US.
For these transfers, we rely on our providers' safeguards and terms, as described in "Who we share data with", together with encryption and access controls.
How long we keep it
| Data | How long |
|---|---|
| Your account and profile | While you're a member. Deleted within 30 days after you delete your account (or ask us to), or after we remove you. Your profile photo file is deleted as soon as you leave or are removed. |
| Past exchange records | Kept while your account exists, as part of members' track records. After you leave or are removed, a past exchange is shown only to the other member in it, with your name replaced by "Former member" and notes removed, and it's kept so their record stays complete. |
| Chats | Deleted after 24 months with no activity. If you leave or are removed, the messages you sent are deleted within 30 days. |
| Report copies (snapshots) | 12 months, even if the account is deleted within that time. |
| Backups | Nightly encrypted backups, including chats and profile photos, are kept for 30 days on a rolling basis in a restricted Fermata Google Drive folder. Deleted data may stay in a backup until that backup expires. |
| Chat access log | Deleted automatically after 24 months |
| Applications we decline | Kept for 12 months so we can recognise repeat applications, then deleted automatically |
| Invite records (who created, used and referred) | For as long as your account exists. When you leave, invite codes you created that nobody used are deleted, and the link to the code you joined with is removed. Codes you created that other members used are kept so their records still work, but no longer show your name. |
| Swap status history | Kept for as long as the swap it belongs to (see "Past exchange records"). |
| Email queue (emails waiting to be sent) | Deleted automatically after 24 months |
| Email sending logs (Resend) | 30 days |
| Support emails and appeals | 24 months |
| Technical logs at our providers (can include IP addresses) | Short-lived: Supabase about 1 day (sign-in audit logs about 1 hour); Lovable about 5 days (audit logs about 90 days); Cloudflare request logs, if enabled, 3 to 7 days. GitHub keeps backup-job logs for 90 days; these contain no member content. |
If we remove you, your profile is deleted straight away and the messages you sent are deleted within 30 days. You can still appeal by email within 30 days (see our Terms).
Keeping your data safe
- Data travels over HTTPS (TLS).
- Our database is encrypted at rest (AES-256).
- Every table has row-level access rules, so members only see what they're allowed to see.
- Nightly backups are encrypted (AES-256) before they're stored in a restricted Google Drive folder. They never go to our code repository.
- No admin keys are built into the website.
- Our code repository holds no member data, only fictional sample or test data.
- Only people who need it can access member data.
- Every time an admin opens a member chat, it's logged in a record that admins can't edit or delete.
- Every change to the database by our AI assistants is approved by a person first.
No system is perfectly secure. If a breach puts your data at risk, we'll tell you and the UAE Data Office as the law requires.
Cookies and browser storage
We don't use analytics, tracking or advertising cookies, and our fonts are hosted by us, not loaded from other companies. We only use what's strictly needed for Gathery to work:
- Sign-in (localStorage): keeps you signed in on your device (your Supabase session).
- Sign-up (sessionStorage): briefly holds your invite code and email while you sign up. It's cleared when you close the tab.
- Bot protection (cookie "__cf_bm"): set by Cloudflare to help tell people from bots.
Because these are strictly necessary, we don't ask for cookie consent.
Your rights
Under the PDPL, you can ask us to:
- tell you what data we hold about you and how we use it, and give you a copy;
- correct data that is wrong or incomplete;
- delete your data;
- restrict or stop how we use your data, or object to it (including to AI-assisted processing);
- withdraw any consent you've given, at any time. This doesn't affect what we did before.
You can do some of this yourself: edit your profile in the app, and change email notifications for chats on the Profile tab. You can turn WhatsApp updates off anytime in your Profile, or by emailing support@gathery.ae.
Deleting your account. Use "Delete my account" on the Profile tab, or email support@gathery.ae, and your account will be deleted within 30 days, including the messages you sent. A few things are kept for longer: copies of reports (12 months), "Former member" exchange records, and our 30-day rolling backups (see "How long we keep it").
For anything else, email support@gathery.ae. We may need to check it's really you. We'll reply within 30 days.
If you're not happy with how we've handled your data, please tell us first. You can also complain to the UAE Data Office.
Members outside the UAE
Gathery is rooted in the UAE and open to members around the world. If you live outside the UAE, for example in the European Union or the United Kingdom, your local law may give you extra rights. Email us at support@gathery.ae and we'll help.
Under-18s
Gathery is for people aged 18 and over. If we learn that a member is under 18, we'll remove their account and delete their data.
Changes to this policy
We may update this policy from time to time. The date at the top shows the latest version. If we make important changes, we'll tell you by email or in the app.
Contact us
Questions, requests or worries about your data? Email support@gathery.ae.
Fermata FZE, Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates.