Privacy policy

The short version

• We collect what it takes to run events: your account details, the events you create or join, and how you use Assembly.
• We do not sell your personal information, and we don't use it for third-party advertising.
• Card numbers go straight to Stripe. Assembly never sees or stores them.
• You can access, correct, or delete your information by emailing us.
• Assembly is for adults. We don't knowingly collect information from children under 13.

The rest of this page is the detail behind those five points.

Who we are

Assembly is a product of Goods Media LLC ("Assembly," "we," "us"). This policy covers theassemblyapp.com, the Assembly web app at app.theassemblyapp.com, and any Assembly mobile apps we publish.

What we collect

What you give us

• Account details — name, email address, and phone number if you add one. Sign-in credentials are handled by our authentication provider, PropelAuth; we don't store your password.
• Profile — your bio and the location you set, along with the coordinates for that place.
• Events you create — title, description, date and time, venue and address, capacity, spot types and prices, and any images or attachments you upload.
• Registrations and RSVPs — which events you're going to, and anything you enter when you register.
• Messages — what you write in event chats and announcements.
• Host payout details — if you charge for events, you connect a Stripe account. Stripe collects your identity and bank details directly. We store the Stripe account identifier and its status, not your bank details.
• Support requests — whatever you send us when you write in.

What you give us about other people

When you invite people, you give us their email addresses and names — including for people who don't have Assembly accounts. Saved groups keep those contacts so you can reuse them for the next event. Please only add people who'd expect to hear from you.

What we collect automatically

• Usage and device information — pages viewed, actions taken, browser and device type, and IP address, through PostHog.
• Session replay — PostHog reconstructs a playback of how a page was used: clicks, scrolling, and navigation. This is how we find bugs and screens that confuse people. Every form field is masked before anything leaves your browser, so what you type — names, messages, card details — is never recorded.
• Location — when you tap "Use current location" in Discover, your browser asks your permission and sends your precise coordinates so we can find events near you. Decline and you can search by place name instead; nothing about Assembly stops working.
• Cookies and similar technologies — to keep you signed in and to measure how the product is used.

How we use it

To create and run events, deliver invitations and reminders, process payments and host payouts, show you events nearby, answer support requests, keep Assembly safe from fraud and abuse, meet our legal obligations, and make the product better.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for third-party advertising.

How we share it

With other people on Assembly

Assembly is social by design, so some sharing is the point. Your name and profile are visible to the hosts and guests of events you join. Hosts can see who registered for their events. Anything you write in an event chat goes to that event's participants. Think of an event page as a room with the door open to the people invited.

With service providers

These companies process data on our behalf, and are permitted to use it only to provide services to us:

• PropelAuth — accounts and authentication
• Amazon Web Services — application hosting and data storage
• Amazon SES — transactional and notification email
• Stripe — payment processing, and Stripe Connect for host payouts
• PostHog — product analytics
• Netlify — hosting for theassemblyapp.com

For legal and safety reasons

We may disclose information to comply with the law, respond to lawful requests, enforce our terms, or protect the rights and safety of our users, our company, or the public.

If the business changes hands

If Goods Media LLC is involved in a merger, acquisition, or sale of assets, information may transfer as part of that deal. We'll note it here if it happens.

Messages from us, and how to stop them

Assembly reaches you two ways: email and push notification. You control both in your notification preferences, and every optional email carries an unsubscribe link. A few messages have no opt-out — security alerts, payment receipts, and account notices — because they're part of running your account. Push notifications can also be turned off in your browser or device settings.

If someone invites you to an event, you'll get that invitation because a host added your address, not because you signed up with us. Every invitation says who sent it and how to stop receiving them, and we never add an invited address to Assembly's own mailing list.

How long we keep it

Account information stays while your account is open. Event records stick around so hosts and guests keep their history. Payment records are retained as long as tax and accounting rules require, typically seven years. When you ask us to delete your account, we delete or de-identify your information within 30 days, except what we're required to keep for legal, tax, or fraud-prevention reasons.

Security

Data is encrypted in transit, access to production systems is limited to people who need it, and card details never touch our servers. No system is perfectly secure, and we won't pretend otherwise — but we take this seriously.

Your choices and rights

Wherever you live, you can ask us to:

• tell you what personal information we hold about you
• correct anything that's wrong
• delete your account and personal information
• send you a copy of your information in a portable format

Email support@theassemblyapp.com and we'll respond within 45 days. We may need to verify your identity first. You can use an authorized agent, and we won't treat you differently for exercising any of these rights. If we decline a request, you can appeal by replying to our response and a person will take a second look.

State privacy rights

Residents of California, Colorado, Connecticut, Texas, Virginia, and other states with comprehensive privacy laws have the rights described above, plus the right to opt out of the sale or sharing of personal information and of targeted advertising. Assembly does none of those things, so there's nothing to opt out of — but the request is honored either way. We treat precise location as sensitive information and use it only to show you nearby events, never to profile you. Because we don't sell or share personal information, a Global Privacy Control signal from your browser has nothing to opt out of.

In the last 12 months we collected the categories described under "What we collect," used them for the purposes under "How we use it," and disclosed them for business purposes to the service providers listed above.

Children

Assembly is a general-audience service meant for adults, and you must be 18 or older to create an account. We do not knowingly collect personal information from children under 13.

Children come to Assembly events all the time — that's much of the point. But Assembly doesn't create accounts or profiles for them. A headcount or a note about who's coming is event information supplied by an adult, and we ask hosts not to put a child's personal details into an event. If you believe a child under 13 has given us personal information, email us and we'll delete it.

Where your information is handled

Assembly is operated from the United States and your information is stored and processed there. If you use Assembly from outside the US, you're sending your information to the US.

Changes to this policy

We'll post updates here and change the effective date at the top. Material changes get an in-app notice too — we won't quietly rewrite this.

Contact

Goods Media LLC · 16930 East Palisades Blvd, Fountain Hills, AZ 85268 · support@theassemblyapp.com