✦ By invitationRequest an inviteI have a code
Privacy

Who can see this, and who cannot

What people share here is unusually exposing — a diagnosis in a health note, a tradition they practise quietly, a report about someone they still see weekly. A page of legal prose does not answer the question anyone actually has. So this starts as a matrix instead: pick who is looking and see exactly what they get.

Who is looking

A facilitator, looking at their own gathering

The person holding the room on Thursday. They need enough to run the room safely and nothing that would let them build a picture of your life. Attendance and safety are the only defaults in this view.

6 of 12
things on this list they cannot see at all.
Your name
They are letting you into a room. A name is the minimum.
Yes
Your photo
So they can recognize you at a door in the dark. Optional to upload.
Yes
Your email address
Messages go through the platform. They can write to you without holding your address.
No
Your city
Off by default. Some people like it known they travelled; most do not care to say.
Only if you show it
That you booked this gathering
Obviously. It is their register.
Yes
Other gatherings you have attended
They see the times you have sat with them — that is continuity, and it is useful. They cannot see anybody else’s room.
Only theirs
A health note you wrote at checkout
Written for them, visible to them, never to a co-host or helper unless you say so. Deleted a set period after the date.
Yes, and only them
Which sliding-scale band you paid
Structurally impossible in this view. If they could infer it from a refund figure, we hide the figure too.
Never
Your practice log and streak
It is a private record. Nobody teaching you is shown how disciplined you have been.
Never
A report you made
They are told there is a concern and what it concerns. Your name and your text are not handed over unless you choose to be named.
Not as your words
Your card details
Facilitators never see payments, payouts, or anything resembling a card.
Never
Your exact location
We do not collect it. Proximity search runs on a city or an area you choose, not a device fix.
Never
Never

Six things we do not do, written as commitments rather than exclusions

A privacy policy is mostly a list of permissions a company has given itself. These are the opposite — each one is a thing we could do, that would make money, and that we are saying no to in a place we can be held to.

We do not sell anything
Not names, not interests, not the fact that you searched for grief circles. There is no data business here and the 9% is the whole model.
No pixels on report or health pages
The report route and any page carrying a health note load no third-party script of any kind. Not anonymised — none.
No tradition-based advertising
What you practise is not a targeting segment. That someone attends a Sufi circle or a grief group is not something to build an audience from.
No seeker lists, ever
Not to facilitators as a social feature, not to seekers, not as “three people you follow are going”. There is no version of this we will ship.
No dark patterns on deletion
Deletion is a button, not a conversation. No retention offer, no “are you sure you want to lose your streak”, no thirty-day guilt window disguised as a grace period.
No inferring anything from a sliding scale
We do not model who is likely to pay more, and we never show a facilitator a distribution small enough to identify one person.
The three hard cases

Data this platform holds that most do not

Health notes
People write real medical information into a checkout field — pregnancy, epilepsy, insulin, medication, a heart condition — because a facilitator needs it to keep them safe. This is special-category data and most marketplaces would not knowingly hold it.
Rule: One facilitator, for one date, deleted on a schedule after it. Not searchable, not in analytics, never in a helper’s view, and never used to decide what you are shown.
Religious and spiritual practice
Everything anybody does on this platform reveals belief. In several jurisdictions that is protected in the same tier as health, and it is the single most sensitive thing here even though it looks like ordinary browsing.
Rule: Attendance is private by default with no public history setting. Practice is never a targeting segment, and a person’s tradition is never inferred and stored as an attribute.
Reports
A report is a person naming something that happened to them, often about someone they will see again next week. If it leaks, the harm is immediate and physical.
Rule: Held on a separate system, kept apart from your profile, no analytics on the page, and never shown to the facilitator as your words unless you choose to be named. Kept even after you delete your account, minus your identity, because a pattern across several people is the only way some things are ever seen.
Your controls

Five things you can do, from one screen

All of these live in your account and none of them require writing to support. A right you have to request is a right with a gatekeeper.

See everything we hold
A real export, readable, in one file — not a JSON dump that technically complies.
Make your profile public or private
One switch. Private is the default even for facilitators until they publish a listing.
Delete a health note yourself
Before or after the gathering, without asking the facilitator or us.
Turn continuity off
A facilitator stops seeing that you have sat with them before. Some people want to arrive as nobody, and that is allowed.
Delete the account
A button. Bookings ahead of you are canceled and refunded under the normal terms first, and you are told which before you confirm.
Account and privacy settings →

The legal layer, kept short on purpose

The formal notice has to exist, but it must not bury the matrix above. Four headings, each one paragraph, each pointing to the full text in our Terms & safety rather than expanding here.

What we hold and why
Bookings, payments, messages, and what you chose to put on a profile. Each with a stated purpose, and nothing collected on the grounds that it might be useful later.
Where it lives
Named processors — payments, email, hosting — with the country each sits in, and what happens when you book in a country other than your own.
How long we keep it
A number per category, not “as long as necessary”. Health notes shortest, financial records longest because tax law requires it.
Your rights and who to write to
Access, correction, deletion, portability, objection, and a named human with a real address rather than a form.