How we protect your data

OurGathering is in beta. This page says plainly what we have built to protect the people who use it, and what we have not done yet. Last updated 6 November 2026.

Health and access answers get extra care

• Questions about allergies, dietary or access needs are marked with a lock. Nobody has to answer them, and answering needs a tick agreeing to us storing them.
• Only the people named for a question can read its answers. On a team’s event, finance never reads them, and only people the organisation has chosen as trusted readers (a first aider, say) do. Organisers cannot give themselves that access.
• Changing who can read a question after people have answered can only narrow it, and anyone mid-reply is told before they save.
• Health answers are erased automatically 30 days after an event ends, checked every day. A finished event takes no new ones. Exports follow the same rules as the screens.

Guests and links

• Personal links are long random codes, stored only as one-way hashes. Opening one on a second device needs a code emailed to the invited person.
• On a team’s event, organisers are never handed someone’s personal link: it is emailed straight to that person.
• Removing someone, or changing their address, ends their access straight away.

Accounts and sign-in

• Passwords are stored as one-way hashes and checked against known leaked passwords. Repeated wrong guesses slow an account down.
• Every change needs a request that came from our own site. Cookies are secure and cannot be read by scripts on the page.
• The site loads nothing from advertising or tracking companies, and a strict content policy blocks scripts from anywhere else.

Email

• We send only what an event needs: invitations, reminders, changes and sign-in links. Each address can receive only a handful of event emails a day, and bounces and complaints are tracked so we stop writing to addresses that don’t want it.

Where your data lives

• The database runs in London (Fly.io). Photos are kept in a private store in Western Europe (Cloudflare R2). Email goes through Resend’s Ireland region.
• The database is copied continuously to a private off-site store, and a restore from it has been tested. Copies can hold erased answers until they age out, as our privacy notice explains.
• You can download your data and delete your account from your account page.

Teams

• Each organisation is separate: nobody in one can reach another’s events, people, budgets or receipts. Approvals record who agreed what, and spending records on an organisation’s event are archived, not deleted.
• The demo uses made-up people only, sends no email, and is deleted after a day.

What we checked

In October and November 2026 we reviewed the whole product for security weaknesses: the code, and the live site. The review was done by us with AI assistance, not by an outside firm. It found no critical problems, and everything it rated high or medium that we could fix has been fixed and is live. The few remaining items are listed on our own tracker, and none of them involve another customer’s data.

What we have not done yet

• We are not certified (for example ISO 27001 or SOC 2), and no outside firm has tested the product.
• Our terms and privacy notice have not yet been reviewed by a solicitor. Until they have, we are not taking on companies with real employee health information.
• We are one small company running one server, so there can be short breaks when we release updates.

Found a problem?

Tell us at hello@ourgathering.co.uk (see also security.txt). We will reply as quickly as we can, and thank you.