GatherGather

Privacy

Privacy Policy

Effective Date: September 24, 2026

1. Who we are and what this covers

Gatherfan, Inc., a Delaware corporation ("Gather", "we", "us"), operates the Gather mobile application and the gather.fan website (together, the "App"). This Privacy Policy explains what information we collect when you use the App, why, who we share it with, how long we keep it and what choices you have. By creating an account you confirm that you have read it. Questions and requests: info@gather.fan.

2. Information we collect

Information you give us when you sign up and use your account:

  • Sign-in details: your email address, or your phone number (we send a verification code by SMS), or the identifier and name that Apple or Google share with us when you sign in with them. We do not see your password for Apple or Google sign-in.
  • Year of birth, asked once at sign-up to check that you meet the minimum age. We keep only whether the check passed.
  • Profile: username, display name, bio, avatar photo, cover image, social links, and whether Gather has verified you as a creator.
  • Content you create: card artwork and card templates, drops, packs, sets and hunts and their settings, and the names and descriptions you give them.
  • Photos you choose from your library or take with the camera for your avatar or your cards. The App only reads what you pick; cropping happens on your device before upload.
  • Messages you send us and reports you file about content or users.

Information created as you use the App:

  • Collecting: the cards you claim, the packs you open, the editions you hold, the cards and packs you gift or receive, the sets and hunts you complete, and the awards you receive.
  • Standing: your experience points, level, streaks, badges (including any badge Gather grants you, such as the Early Contributor badge and its serial number) and your fandom standing with each creator.
  • Social activity: the creators and fans you follow and who follow you, drops you like, bookmark, repost or set reminders for, and the accounts and content you report.
  • Searches you run and what you open, which we use to order Discover and recommendations.
  • Creator API: if you are a verified creator and create API keys, we keep the key's metadata (when it was created, when it expires, when it was last used) and a record of what was done with it, including by software or AI agents you connect.
  • Notifications: the notifications we send you and whether you read them.
  • Blockchain records: when a card you claim is minted, its mint address and minting status. See Section 6.

Information collected automatically from your device:

  • Device and app information: device model, operating system version, app version, language, a Firebase installation identifier, an App Check token that proves the request comes from a genuine copy of the App, and a push notification token if you allow notifications.
  • Usage analytics: which screens you open and which actions you take, collected through Firebase Analytics, on by default and switchable off in Settings.
  • Crash reports: if the App crashes or hits an error, a report with the device information above, the screen you were on, and identifiers of the account, drop, pack or card involved, collected through Firebase Crashlytics, on by default and switchable off in Settings.
  • Server logs: your IP address, the time of each request, the request made and its result, kept by our servers and our providers.
  • Update checks: at launch the App may ask Shorebird, a service we use to deliver code updates between App Store and Google Play releases, whether an update is available. That request carries the app version, the update version and an installation identifier, and no account information.
  • Biometric unlock: if you lock the App with Face ID, Touch ID or your device's biometric unlock, the check is done by your device. Gather never receives your biometric data.

On the website (gather.fan) our hosting provider records the requests it serves, including IP address and time, and the site remembers your light or dark theme choice on your device. The website sets no tracking cookies.

3. Why we use it (and our legal bases)

  • To create and run your account, deliver drops, cards, packs, sets, hunts, badges and gifts, and show you and other fans what you collected (performance of our contract with you).
  • To order Discover, the Live Drops feed and recommendations by what you follow and do (our legitimate interest in making the App useful, and your contract with us).
  • To send you push notifications about drops, gifts, awards, badges and activity, which you can turn off in your device settings and in the App (your consent).
  • To keep the App secure, prevent fraud and abuse, enforce our Terms and respond to reports (our legitimate interest and our legal obligations).
  • To understand how the App is used and to fix crashes and errors (our legitimate interest; both are on by default and can be switched off in Settings).
  • To answer your messages and requests (our legitimate interest and our legal obligations).
  • To mint cards on the Solana blockchain where a drop is configured for it (performance of our contract with you).

Where we rely on legitimate interests you can object at any time by writing to info@gather.fan. We do not use your information for advertising and we do not sell it.

4. Automated processing

We order what you see (Discover, the Live Drops feed, suggested creators) automatically from what you follow and do in the App. Claim eligibility for gated drops is checked automatically against the conditions the creator set (for example following the creator, your standing with them, holding a card or scanning an event code). None of this produces legal or similarly significant effects on you.

5. Who we share it with

We share information with service providers that process it for us under data processing terms, and with the platforms you sign in through:

  • Google (Firebase): sign-in and phone verification, our user database and file storage, push notifications, remote configuration, analytics, crash reporting, App Check and website hosting. Google is our processor for these, except that Google Sign-In is Google's own service under Google's privacy policy.
  • Amazon Web Services: our servers, databases, media storage, message queues, APIs and logs, in the United States (us-east-1).
  • Apple: Sign in with Apple and push notification delivery, under Apple's own privacy policy, and the App Store.
  • Google Play: app distribution, under Google's own privacy policy.
  • Shorebird: delivery of App code updates (Section 2).
  • The Solana blockchain and the RPC providers we use to reach it: the public record of minted cards (Section 6).
  • SMS carriers used by Firebase to deliver phone verification codes.
  • Other fans: what Section 15 lists is visible to other users of the App.
  • Software you connect through the Creator API: if you create an API key, whatever you connect it to receives what that key can read.

We also disclose information when the law requires it, to protect Gather, our users or the public, and as part of a merger, acquisition or sale of Gather, in which case this Policy continues to apply.

6. Blockchain records

When a drop is configured for minting, each card claimed from it is minted as a token on the Solana blockchain into a wallet Gather controls. The blockchain record contains the card's name, its artwork reference and its collection, and it is public and permanent: it cannot be deleted, including after you delete your account. It does not contain your name, username or profile, but a mint address shown on your profile or in a link you share can be looked up by anyone on a public explorer.

7. Your choices

  • Collection visibility: your collection is public by default; you can hide it in Settings (pinned cards stay visible).
  • Notifications: turn push notifications off in your device settings; in the App you can choose which kinds of notifications you receive.
  • Analytics and crash reports: both are on by default and can be switched off in Settings; switching them off stops new collection from that device.
  • Creator API keys: view, revoke and regenerate your keys in Settings.
  • Export: Settings offers an export of your profile, collectibles, packs, standing (experience, levels, badges), follows and followers, and notifications as a data file. For anything not in the export, write to info@gather.fan.

8. Account deletion and retention

You can delete your account in Settings. Immediately: your sign-in credentials are deleted, your profile is removed and no one can see it, your identity reservations and push notification tokens are deleted, and your in-app notifications and your entries in other fans' activity feeds stop being shown to anyone. Those notifications and feed entries are removed from our database within 90 days by expiry, or sooner by our team's deletion procedure. Retained: records of the cards you claimed, the packs you opened, the gifts you sent or received, the accounts you followed, your activity, your badges and levels, and the artwork of cards you created that other fans hold. These records no longer appear under any profile; we keep them so that other collectors' histories, the supply of each drop and the cards other fans hold stay accurate. If you want the retained records removed as well, write to info@gather.fan after deleting your account and we will remove what we are not legally required to keep; we do this by hand.

How long we keep other information:

  • Server logs: between 14 days and 3 months depending on the system.
  • Crash reports: 90 days (Firebase Crashlytics).
  • Usage analytics: 3 months for event data tied to a user, the retention we configure in Firebase Analytics.
  • Database backups: our production database keeps point-in-time recovery for 35 days, so deleted records can persist in backups for up to 35 days.
  • Sign-in records: Google states that some Firebase Authentication data may take up to 180 days to be removed from its live and backup systems after deletion.
  • Push tokens: deleted when you sign out, delete your account, or the token is replaced. Revoking the notification permission on your device stops delivery but does not by itself delete the token.
  • Blockchain records: permanent (Section 6).

We may keep information longer where the law requires it, for example to comply with a legal hold or to prevent fraud.

9. Your rights

Depending on where you live, you may have the right to access the information we hold about you, to correct it, to have it deleted, to restrict or object to its processing, to receive it in a portable format, and to complain to a data protection authority. To exercise any of these rights, write to info@gather.fan; we may ask you to confirm you control the account.

California residents: we do not sell your personal information and do not share it for cross-context behavioral advertising. You have the right to know what we collect, to correct it, to delete it and to opt out of any future sale or sharing. The App does not respond to browser Do Not Track signals; because we do not sell or share information for advertising, Global Privacy Control signals do not change what we do.

Artwork that is part of cards other fans hold may be retained after a deletion request so that those collectors keep what they collected; we will tell you if this applies to your request.

10. Security

We protect your information with encryption in transit (TLS), access controls on our systems, App Check to keep unauthorized clients out, and monitoring with alerts. No system is perfectly secure; if a breach affects your rights we will notify the authorities and, where the law requires, you, within the time the law sets.

11. Children

The App is not directed to children under 13, and not to children under 14 in South Korea. At sign-up we ask for your year of birth and do not create the account if you are under the minimum age. If we learn that an account belongs to someone under the minimum age, we close it and delete the personal information associated with it. To report such an account, contact info@gather.fan.

12. Where your information is processed

Our servers run in the United States (AWS, us-east-1), and Firebase Authentication data is stored in the United States. Other Firebase services we use run on Google's global infrastructure. If you use the App from outside the United States, your information is transferred to and processed in the United States and, for Google services, wherever Google operates them. Google LLC and Amazon Web Services participate in the EU-US Data Privacy Framework; for users in the EEA, the UK and Switzerland we rely on that framework and on standard contractual clauses in our providers' terms.

13. Changes to this Policy

We may update this Policy. For changes that do not materially change how we use your information, we post the new version in the App and at gather.fan/privacy with a new effective date at least 7 days before it takes effect. For material changes (new categories of information, new purposes, new recipients, or changes to your rights or our retention) we ask you to acknowledge the new version in the App before you continue.

14. Geographic availability

The App is offered through the Apple App Store and Google Play in the territories we select and is not available where use would violate applicable law, including U.S. sanctions administered by OFAC.

15. What other fans can see

Your profile is public. Other users of the App can see your username, display name, bio, avatar, cover image, social links, creator verification, your level, streaks and badges (including any Gather-granted badge and its serial number), your top fandoms, the sets and hunts you completed, who you follow and who follows you, the drops you published if you are a creator, and, unless you hide it in Settings, your full collection; cards you pin stay visible even when the collection is hidden. Hiding changes what others see and does not delete anything.

Claim activity is public: when you claim a card or a pack, your display name, username and avatar appear with the drop, the item, its rarity and the time in the App's feeds and in the drop's claim history, even if you have hidden your collection, and the claim stays attributed to you if you later gift the item. The fans who follow you also see, for 30 days, what you do in the App: the cards and packs you claim, the sets and hunts you complete, the badges you earn, the cards a creator awards you and which creator awarded them, and the accounts you start following. Your level and experience may appear in leaderboards visible to other fans. Reposting a drop shows your name on it to your followers.

16. Contact

Gatherfan, Inc., a Delaware corporation. For privacy questions, requests and to exercise your rights: info@gather.fan.