Privacy
Your privacy
Last updated 30 October 2026. This page covers Gather Upstairs before its public launch.
The short version
- Players don't make accounts. To join a game you type a display name and pick a character, and the others in the game see them. Our server forgets your name when the game's room closes and never stores it. Your phone remembers your last one, and forgets it the first time you open this site more than 30 days after you last used it.
- Our server logs record IP addresses for security and to stop abuse, and keep a record of each game under random numbers. We keep those logs for at most 30 days.
- No adverts and no tracking. When something goes wrong in a game or on our server, an error report goes to Sentry, with nothing in it that says who you are. We count visits to our pages with Cloudflare Web Analytics, which uses no cookies and keeps nothing that says who you are. Visitors and players get no cookies.
- We never sell personal information.
- Who we are
- What we collect
- Who handles it
- How long
- Children
- Keeping it safe
- Your rights
- Complaints
- Changes
Who we are
Gather Upstairs runs party games for Bible and church-history nights at gatherupstairs.com.
Gather Upstairs is in a private test with invited players. The company that will be responsible for your information under POPIA is being registered, and its name, information officer and postal address will be shown here before Gather Upstairs opens to the public.
- hello@gatherupstairs.com
What we collect, and why
When you join a game
- A display name. You type it to join, and it shows on the big screen and on the other phones in the game, so everyone knows who is playing. Please use a first name or a nickname, never a full name, especially for children.
- A character, one of twelve (a lamb, a dove, a lantern and so on), shown next to your name.
- Your team, if the host plays the night in teams: a team the host deals you into or moves you to, shown with your name.
- Your answers, scores, reactions and votes, which run the game. Votes for the idea games tell us which games to build next.
Our game server holds all of this in its memory while the game's room is open, and shows it on every screen in the game. When you leave (after a minute's grace in case your connection drops) or the room closes, it forgets your name.
A screen in another home can show the same game when someone opens it there with the room code. It shows the same names, characters, teams and scores as the main screen, and sends nothing about anyone.
To check the scoring is fair and to fix problems, our server logs keep a record of each game under a random player number made for that visit, never your name: when each phone joined, dropped out, came back or left, each answer and how long it took to arrive (including how fast each connection was), the scores, votes for the idea games and any change of character. Each record carries the room's code, and the opening of the room is logged with the big screen's IP address, so a night's records can be traced to the network the big screen used, but not to a player's name.
On your device
- Your phone remembers the last name and character you used, in its own browser storage, so you don't have to type them again. They stay on your device. The first time any page of this site is opened more than 30 days after you last joined a game or picked a character, the phone deletes them. A phone that never opens the site again keeps them in its browser until you clear this site's data. On a shared phone or tablet, tap "Start fresh" on the join screen, or clear this site's data in your browser settings.
- While you're in a game, your browser tab keeps a short code that lets you rejoin your seat if your connection drops, and remembers which idea games you voted for in that room. The rejoin code goes when you leave the game or close the tab; the votes stay until you close the tab. The big screen's tab keeps its own rejoin code the same way.
- The browser on the computer running the big screen remembers whether you turned the sound off.
- This website remembers whether you chose the light or the dark look, in your browser's storage, so the front page and this page open the way you chose.
IP addresses
Every device that connects to a website sends its IP address. Our server writes it to its logs in these cases:
- when the computer running the big screen opens a new room. Hosting needs no account yet, so we log this to prevent abuse;
- when a page of this website or the big screen talks to our server (api.gatherupstairs.com): asking whether you're signed in, the prices, your account (see "What we don't do" below). Each line records the IP address, your browser's name, the time and the address asked for, never the cookie or anything after a "?";
- when a request is blocked or looks like abuse, for example too many attempts to guess a room code, a broken request, or a request from another website;
- when our server can't pass your connection on, for example during an update. Its error log can then record your IP address, your browser's name and the web address you asked for.
To limit how fast one address can join or open rooms, the server also holds addresses in memory for a minute or two after their last request. We use IP addresses only for security and to stop abuse.
Hosts
Until Gather Upstairs opens to the public, only our own test devices can host a game. Hosting needs no account yet, and we don't ask hosts for a name or an email address. The big screen only sends a random code to open a room, and we log its IP address as described above. If the host also plays on a phone, that phone joins like any other player.
If you email us
We keep your message and our reply only as long as we need to deal with it.
What we don't do
We don't use adverts or tracking of any kind, and we don't build profiles of anyone. We count visits to this website and to the TV screen's page with Cloudflare Web Analytics. It sets no cookies, doesn't follow anyone from site to site, and gives us totals only: pages, countries, browsers and devices. When the TV screen, a phone or our server hits an error, it sends a report to Sentry so we can fix it: what went wrong and where in our code, the address of the page without anything after a "?", and the browser or system version. A report carries no display names, email addresses, IP addresses, cookies or answers. The fonts and pictures all come from our own site, so no company other than Cloudflare, which runs our site, and Sentry, when an error report is sent, learns that you visited.
Every page of this website asks our server whether this browser is signed in to an organiser account, so the top of the page can say "Sign in" or "Your account", and the pricing page asks a signed-in organiser's plan. Each page asks as it opens, and the account page asks again when you come back to it, so it shows your plan as it is now. The question sends our sign-in cookie only if you have signed in to an account on this browser; without one it sends none, and the answer sets none. Visitors and players never get a cookie from us. The only other cookie we set is on our own test devices, to let them open the game before launch.
Do you have to give it?
You need a display name to join a game; without one you can't play. Your device sends its IP address by itself whenever it connects to any website. No law requires us to collect this information.
Who sees it and who handles it
- The people in your game see your display name, character and score, and whether you got each answer right, on the big screen, on any other screen showing the game and on their phones.
- Cloudflare, Inc. runs our websites and passes the game traffic between your device and our server, protecting it from attacks. It sees IP addresses and everything sent in the game, including display names and answers, as it passes through.
- domains.co.za provides the server our games run on, in a data centre in Johannesburg, so our server logs are stored there.
- GitHub, which we use to publish updates, can receive a few lines of the server's log if an update fails to start.
- Functional Software, Inc. (Sentry) receives the error reports described above, to show us what broke. It sees the IP address of the device that sends one as the report arrives, and is set not to store it.
- Cloudflare Web Analytics, Cloudflare's own, counts the visits described above, without cookies.
- Cloudflare Turnstile, Cloudflare's own, checks that a person, not a script, is creating an account or asking for a sign-in link. It looks at the browser asking, for that check only.
They handle the information only to run this service for us. We don't sell or give personal information to anyone else, unless the law requires it.
Outside South Africa
Our game server is in South Africa. Cloudflare is a United States company with data centres around the world. Visitors in South Africa are usually served from Johannesburg, Cape Town or Durban, but Cloudflare may process information such as IP addresses in other countries, mainly the United States and Europe, under its own data protection commitments. GitHub, also a United States company, stores the few log lines it receives outside South Africa. Sentry, also a United States company, stores the error reports outside South Africa.
How long we keep it
| What | How long |
|---|---|
| Your display name and character, on our server | Until you leave the game or its room closes |
| Your last name and character, on your phone | Until you open the site more than 30 days after you last used them, start fresh, or clear the site's data |
| Game records under a random number (joins and leaves, answers, timings, scores, votes, character changes) | At most 30 days, in our server logs |
| IP addresses in our server logs | At most 30 days |
| Error reports at Sentry | At most 90 days |
| The rejoin code in your browser tab | Until you leave the game or close the tab |
| Your votes for idea games, in your browser tab | Until you close the tab |
| Your light or dark choice, in your browser | Until you change it or clear the site's data |
| For organisers: a one-way code made from the card that started a free trial (not the card number, and nothing else about you), so the free trial is given once per card | Until the card expires, even if the account is deleted first |
| Your emails to us | As long as we need to deal with them |
Children
Our games are made for families, churches and schools, so children play them. Under POPIA anyone under 18 is a child. Please have children use a first name or a nickname. We don't ask players for anything else about themselves: no age, email address, phone number or photo. A child should play with a parent's or guardian's permission, and the adult running the game night should make sure of it. A parent or guardian who wants something removed, or who takes back their permission, can email us at any time.
Keeping it safe
Our sites only answer over encrypted connections. Our game server only accepts web traffic that comes through Cloudflare, and only we can sign in to it. If personal information were ever reached by someone who shouldn't have it, we would tell the Information Regulator and the people affected as soon as we reasonably could, for example on this website.
Your rights
You can ask us, free of charge:
- whether we hold any personal information about you, and for a copy of it;
- to correct it or delete it;
- to stop using it, if you object to how we use it.
Email hello@gatherupstairs.com. We keep very little: game records under random numbers, and IP addresses in logs from the last 30 days. Tell us roughly when you played, the room code if you remember it, and your IP address if you can find it (search "what is my IP" on the device you used). Many people can share one IP address, for example on a church's Wi-Fi, so we may ask a question or two to make sure the information is yours before we send it. We'll reply as soon as we reasonably can.
Complaints
If you're unhappy with how we handle your information, please tell us first, so we can put it right. You can also complain to the Information Regulator (South Africa):
- Website: inforegulator.org.za/complaints
- Email: POPIAComplaints@inforegulator.org.za
- Phone: 010 023 5200 (toll free 0800 017 160)
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Changes to this page
This page describes Gather Upstairs before its public launch. If we ever collect more, such as an email address to sign in, we'll update this page and change the date at the top first.