Privacy policy

Effective October 7, 2026

BoonMe helps a circle — a family, roommates, a carpool, a team — plan the week together and help one another. This policy explains what the BoonMe iPhone app, the Gather Rnd app for Apple TV, this website (gatherrnd.app) and our support site (support.gatherrnd.app) collect, where that information goes, how long we keep it, and what you can do about it. BoonMe is run by Matthew Weghorst. If anything here is unclear, write to us at info@gatherrnd.app.

The short version

• We collect what the app needs to work for your circle, and nothing more.
• My circle is yours alone: only you see who’s in it. Someone without the app who takes a favour by link gives only a first name.
• The only thing you can buy is a year of a circle you start. Apple takes the payment, and we never see your card.
• We don’t show ads, sell your information, or use analytics or advertising trackers, in the app or on our websites. The app does report crashes, so we can fix them; the section on crash reports says exactly what is sent.
• A few service providers run parts of BoonMe for us. They are listed below, with what each one handles.
• Members under 13 don’t have accounts. A grown-up in the circle sets them up, and there’s nowhere on their phone to type. The section on members under 13 says what that means.
• You can delete your account in the app at any time, and ask us for a copy of your information or to correct or delete it.

What we collect, and why

Your sign-in

Signing in is handled by Clerk. You sign in with Sign in with Apple, or with a one-time code sent to your email address. Clerk keeps your email address, your name if you give one, and the identifiers it needs to sign you in. If you use Sign in with Apple and choose to hide your email, Clerk receives Apple’s private relay address instead. In our own database your account is the Clerk account ID that links you to your circles; we don’t store your email address there.

Your circle

To run your circle, we store what you and the other members put into the app: the circle’s name, its type in your own words, and its crest; each member’s display name and character, which are made from preset parts; the calendar events, asks, commitments, notes and reactions in your weeks; who took on which ask and whether it got done; and the records the app keeps when a week is closed, including karma. Members of your circle can see what is shared with the circle. Other members’ phones never receive your email address or your Clerk account ID.

This information is stored in a Postgres database hosted by Neon, and the app reaches it through our service hosted by Vercel.

My circle

My circle is your own list of the people you swap favours with. Only you see who’s in it. When you add someone, you choose them with Apple’s contact picker on your phone, and only the first name you choose leaves your phone, with a last initial if you keep one: never their number, their email address or the rest of your contacts.

An ask or a give in My circle is seen by the people you name, the people who take it, and anyone you send its link to. Each favour counts once between two people, and only you see the give and take between you and each person in your list.

People without the app

When you send a link to someone who doesn’t have the app, they can take the favour on a page of gatherrnd.app, with no account. We keep the first name they type, or the name you chose for them (a first name, and a last initial if you kept one), what they took, the thanks waiting for them, and a one-way code for their link. We never ask for or keep their phone number or email address, and the page refuses a name with a number or an @ in it.

Anyone who has a link sees what its page shows: the favour, when it is, your first name, and how many places are left, but never who took the others. The page sets one cookie, which holds their link so the page recognises their browser next time; there’s nothing else, no analytics and no advertising. They can add the favour to their own calendar as a file. The file includes their link, so anyone who can see that event in their calendar can open it.

On the page, Remove my name retires their link and replaces their name with “Guest”. If they later get the app and open their link, what they took moves to their new account. To stop abuse, the pages count requests from each internet address for one hour, using a one-way code that is never kept with anything someone did.

Starting a circle

My circle and joining a circle are free. Starting a circle of your own is a yearly subscription, bought through Apple with your Apple Account. Apple takes the payment under its own terms and privacy policy, and we never see your card or payment details. Apple tells us which account and circle a purchase is for, and when it renews, lapses or is refunded, so the circle’s Weekly Gathering stays on. You manage or cancel it in your Apple Account’s subscriptions.

Calendars you connect

When you connect a calendar, you give us its subscribe link. Our service reads that link to bring the calendar’s events into your week, checks it again every few hours and whenever someone plans the week, and stores the events it reads. We treat the link itself as a secret: the app never shows it back and we don’t write it to logs. A calendar you connect as your own can be seen by everyone when planning, or by you alone; whatever you add to the week from it is seen by your circle.

Disconnecting a calendar stops us reading it at once. We keep its record, including the link, and the events already brought in, so that what your circle put on the week still shows where it came from. Deleting your account deletes them, and you can ask us to delete them sooner.

Adding an event to your own calendar from the app uses Apple’s add-event sheet, which needs no permission.

Your phone’s calendar

If you allow it, the app reads the calendars on your phone while you pick what to add to the week, and shows you their events there. Only you see them. They stay on your phone: they are never sent to us or included in crash reports, and the app doesn’t keep a copy.

When you choose to add one of those events to the week, we store its title, its time and its place, who it’s for and who added it, with your calendar’s own reference for the event and a one-way code for the calendar it’s in, so your phone can find it again. Your circle sees it like any event on the week. Its notes, invitees and links, your calendar’s name and colour, and your other events never leave your phone. Each time you open the app, your phone checks the events you added, and updates them on the week if they moved or changed. If you delete one from your phone’s calendar, it stays on the week marked as no longer in the calendar, until someone removes it.

You can disconnect your phone’s calendar in the app, choose which of its calendars Pick lists, or turn the permission off in your phone’s Settings, at any time. Which calendars you chose stays on your phone. Events you already added stay on the week until you remove them.

Calendars your circle publishes

Your circle can publish its week as a calendar feed, so it shows up in a calendar app. A feed carries the circle’s name, event titles, times and places, the name of the member each event belongs to (for a member under 13, “A member”), and notes along with who wrote them. Anyone who has the feed’s link can read all of that, so share it only with people you trust. You can turn a published link off at any time. We store only a scrambled (hashed) form of the secret part of the link. Links that open a single event in the app (gatherrnd.app/calendar-item) carry no circle information.

Group chat and Messages

The app can address a message to your circle’s group chat, and the iMessage app can put an ask into a conversation. You choose the people in your group chat with Apple’s contact picker, and what you choose stays on your phone: no name, phone number or email address of anyone in the chat ever reaches our servers. When you make a circle link for the chat, the app tells our service only how many people are in it, so the link can’t be used more times than that. Every message is written on your phone and sent only when you tap Send. The share extension, which accepts a calendar’s subscribe link from the share sheet, keeps the link for the app to pick up and sends nothing anywhere itself.

Notifications

If you turn on notifications, we store your phone’s push token with your account, together with a random ID for the installation, and send notifications through Expo’s push service, which hands them to Apple’s Push Notification service to deliver. A notification includes your circle’s name, the name of the member who acted and the title of the ask. You can turn notifications off in the app.

App updates

Each time the iPhone app opens, it checks Expo’s update service for a newer version and downloads it if there is one. Expo sees your IP address and a random ID for the installation when it answers.

Apple TV

When a member pairs an Apple TV with your circle, we store the TV’s name, a hashed version of its access token, and when it last checked in. A paired TV can only read your circle’s week; it can’t change anything, and it never shows a member’s karma. To unpair a TV, email info@gatherrnd.app and we’ll do it for you.

Crash reports

The iPhone app reports problems to Sentry. When it crashes, freezes for a while, or is stopped by the system, it sends a report with the error, where in the app it happened, what the app was doing just before, and details of the device, operating system and app version. Each time the app opens, it also sends Sentry a short session record, so crashes can be counted against launches. Reports carry a random ID for the installation, but no account, email or name. We don’t use Sentry’s performance tracing or session replay, and reports carry neither the app’s log messages nor records of the network requests it made. Nothing is sent to Sentry from a phone set up for a member under 13, and the Apple TV app doesn’t use Sentry.

When the app crashes, it also sends our own service a copy of the error message, where in the code it happened, and when. That copy is stored in our database, and its first lines appear in our hosting provider’s logs, which it keeps for a short time. It carries nothing that identifies a member. To stop anyone flooding that service, we count the reports that arrive from each address per hour, using a keyed one-way hash of the address; a finished hour’s counts are not kept.

AI assistants

If you connect an AI assistant to BoonMe, it can see what you can see in each of your circles that has AI assistants turned on, and act for you there. That includes everyone’s plans on the week, including when and where members under 13 will be; whatever people wrote in events, asks and notes, which can include something like a doctor’s appointment; karma; and members’ names. Members under 13 appear only by their nickname. mcp.gatherrnd.app explains how to connect one.

Clerk handles the sign-in and the permission you give, and the assistant’s access is checked with Clerk on every request, with nothing about it kept between requests. We keep a record that the assistant is connected to your account: its name, when it connected and when it was last used.

What the assistant receives becomes part of your conversations with it, which its provider keeps under their own terms and privacy policy, not ours. You can disconnect it at any time in Settings, then AI assistants: that stops it at once, but it can’t take back what the assistant already received, which stays with its provider until you remove it there. AI assistants are off in every circle until one of its accountable members turns them on, and they can turn them off again at any time.

Screen Time

The app doesn’t send Screen Time or app-usage information to us.

Getting the app

You get BoonMe from the App Store and sign in in the app, as described under Your sign-in. If a member invited you, your account records who it was and how you joined. We don’t send marketing email.

Some people help us try new versions through Apple’s TestFlight. For TestFlight, your name and email address go to Apple, through App Store Connect, so that Apple can send you an invitation. TestFlight is run by Apple under its own privacy policy; when you join, Apple shares details with us such as your email address and name, the builds you install, crash reports, and any feedback or screenshots you choose to send.

Our websites

gatherrnd.app uses no analytics or tracking scripts. It sets two kinds of cookie at most: Clerk’s, on the pages where you sign in (to connect an AI assistant, or to claim favours you took by link), which keep you signed in; and the one that holds a link for someone without the app, described under People without the app. Those sign-in pages are Clerk’s: they load from clerk.gatherrnd.app and, to keep out bots, may run Cloudflare’s check and Clerk’s fraud protection, which see your IP address and browser details. Our support site and mcp.gatherrnd.app have no sign-in and use no analytics or tracking scripts either. Like any website, ours are delivered by a host, Vercel, whose servers process your IP address and browser details to deliver pages and keep the service secure.

Who else handles your information

We use these service providers to run BoonMe. They handle information on our behalf, only to provide their service to us, and they may not use it for anything else:

• Clerk — sign-in and accounts, in the app and on this website.
• Vercel — hosts our service and our websites.
• Neon — hosts the database that stores your circle’s information.
• Expo — relays push notifications and delivers app updates.
• Apple — Sign in with Apple, payment for circle subscriptions, push notification delivery, the App Store, TestFlight and App Store Connect, and the info@gatherrnd.app mailbox (iCloud Mail).
• Sentry — crash reports from the iPhone app, never from a phone set up for a member under 13.
• Cloudflare — the bot check on the sign-up form, through Clerk.

We don’t sell or rent your information to anyone, we don’t share it for advertising, and we don’t let anyone else collect it through the app or our websites. Besides these providers, the only others who see what you put into BoonMe are the members of your circle, and any AI assistant a member of your circle connects, as described above.

Identifiers, and what they are for

The app uses a few identifiers that are not your name: your Clerk account ID, to sign you in and link you to your circles; random installation IDs for push notifications, app updates and the iMessage app, to reach the right phone; a random installation ID in crash reports, to count crashes against launches; a hashed access token for a paired Apple TV; the hashed pairing code of a phone set up for a member under 13; the hashed form of a published link’s secret; a one-way code for a phone calendar you added an event from; a one-way code for each link held by someone without the app; and a record of each AI assistant you connect. We use them for signing in, delivery, keeping the service running and secure, and fixing crashes, and for nothing else: never to build a profile, to advertise, or to track you across other apps or sites.

How long we keep it, and deleting it

• Your account and memberships: until you delete your account.
• Your circle’s information: for as long as your circle uses BoonMe. A circle only you are in is deleted with your account.
• Calendars you connected, including ones you disconnected, and the events brought in from them: until you delete your account, or ask us to delete them.
• Events you added from your phone’s calendar: until you remove them or delete your account.
• Your list in My circle: until you delete your account. Someone without the app: their first name and what they took, until they choose Remove my name or ask us; nothing deletes unused links automatically yet.
• Records of a circle’s subscription: while the circle exists.
• Crash reports: Sentry keeps them for our plan’s retention period, at most 90 days. Our own copies aren’t deleted automatically yet; ask us and we’ll remove them.
• Records that have stopped working, such as expired invitations, unpaired TVs, signed-out phones and notifications already sent, aren’t deleted automatically yet; ask us and we’ll remove them.
• A profile for a member under 13 with no activity for 12 months is deleted after we tell the grown-up who set it up.
• Our database host keeps a restore history for at most 30 days, so what you delete can stay in it until that time runs out.

Deleting your account. In the app, go to Settings and choose Delete my account; it’s also on the screen you see before you join a circle. Deleting removes your sign-in, your name, your character, any calendars you connected, what you wrote (the words of your asks and stickies, your notes and your reactions), this app’s notifications on your phones, your list in My circle, and any circle only you are in. Each circle keeps its record of what happened, with your name taken off: what you did shows as done by “A former member”, karma that moved to others stays with them, and yours goes back to the circle. If the app can’t delete your account, for example because you’re the last accountable member of a circle others are still in, or if you’d rather, email info@gatherrnd.app from the address you sign in with and we’ll delete it within 30 days.

Members under 13

BoonMe accounts are for people 13 and older. A member under 13 doesn’t have an account: a grown-up in their circle sets them up. If we learn that someone under 13 has made an account themselves, we’ll delete it, and a grown-up in their circle can set them up instead.

• How they join. A grown-up in the circle adds them under People with a nickname, which doesn’t need to be their real name, and sets up their phone from the grown-up’s own phone, the way an Apple TV is paired. The member under 13 gives no email address, has no password, never signs in, and is never asked their age; the grown-up says they are under 13.
• What they do. They see the circle’s week, take asks and mark them done, give reactions from a fixed set, make their character from preset parts, and ask for help with something already on the week by choosing which grown-up, when and how much karma. There is nowhere on their phone to type, and the app takes no photos, voice, location or contacts from it. Their phone never asks for access to its calendar, they have no My circle, and nobody can add them to theirs. The pages for people without the app say they are for people 13 and older, and never ask anyone’s age.
• What their phone sends us. What they do in the app (what they took on and finished, the reactions they gave, the asks they made from the week, and their character), kept with their profile in the circle. Like every phone on the internet, it also sends its internet address, and its push token if notifications are on. We recognize the phone by a pairing code we make for it: a random code that only our service uses, kept only in a scrambled (hashed) form, never shared, and never taken from the phone or from Apple.
• What the identifiers are for. Only to recognize the paired phone, deliver the circle’s week and notifications, and keep the service secure. We never store the phone’s internet address or push token with anything the member does, and we use them for nothing else.
• Who sees it. The other members of their circle; any AI assistant a member of their circle connects, which sees them only by their nickname; and the service providers listed above, in the roles described there. Nobody can contact them privately through the app: anything addressed to them can be seen by the whole circle. In a published calendar feed their nickname is replaced by “A member”. Nothing from their phone goes to Sentry; a crash there is reported only to our own service.
• What a grown-up can do. See what their profile holds, change their nickname and character, unpair their phone, and delete their profile, in the app under People, then their name, or by asking us by email, mail or phone (see Contact, below). Deleting the profile deletes their nickname, their character and everything their phone recorded: what they took on and finished, the asks they made and the reactions they gave. Only what grown-ups recorded for them stays on the circle’s record, as done by “A former member”.
• How long. A profile with no activity for 12 months is deleted after we tell the grown-up who set it up.

Security

Your information travels encrypted between the app, our websites and our providers, and is stored by providers who encrypt it at rest. Access to the database and to our providers’ dashboards is limited to the people who run BoonMe. If there’s a breach that affects you, we’ll tell you.

Your choices

• Change your name and your character, and your circle’s crest and type, in the app.
• Choose who sees your calendar when planning; disconnect calendars; turn published links off.
• Turn notifications off, in the app or in your phone’s Settings.
• Disconnect an AI assistant, in Settings, then AI assistants.
• Hide someone in My circle. Manage or cancel a circle’s subscription in your Apple Account. Connect or disconnect your phone’s calendar, and choose which of its calendars Pick lists; allow or remove the app’s calendar access in your phone’s Settings.
• Delete your account, in the app under Settings.
• Ask us for a copy of your information, or to correct or delete it, at info@gatherrnd.app.

Changes to this policy

If we change this policy, we’ll update this page and the date at the top. If a change affects how we use information you’ve already given us, we’ll tell you in the app or by email first, and for a member under 13 we’ll tell the grown-up who set them up before anything new is sent from their phone.

Contact

BoonMe is run by Matthew Weghorst.
Email: info@gatherrnd.app
Mail: 6210 Wilshire Blvd Ste 200 PMB 578, Los Angeles, CA 90048
Phone: (818) 574-3018