Cookie & Privacy Policy

This notice covers lesgooo.fun and its ChatGPT, Codex and Claude integrations. There are no lesgooo accounts. Unshared drafts stay on your device; shared plans are stored on our servers. Anyone with a saved plan link can read and edit that plan, including through a connected assistant. Only add information you are comfortable sharing.

Jan Henneberg, an individual, operates lesgooo.fun and is the controller responsible for the personal data described here. For privacy questions and requests, email lesgooofun@gmail.com.

You, other members of your group, and assistants acting on your requests provide the information in a plan. Depending on the features you use, this includes:

• Plan titles, participant names and identifiers, and available dates.
• Suggested places, addresses, links, place details and votes.
• RSVP responses, event descriptions, locations, dates, times, recurrence and uploaded photos.
• Checklist text, completion status and ordering.
• Expense descriptions, amounts, currencies, who paid, who shares an expense, recorded repayments and calculated balances. We do not process money transfers.
• Creation/update times and request identifiers needed to synchronize changes and prevent duplicate actions.

Our hosting and security services also process connection data such as IP addresses, browser/device information, request times, routes, response status and errors. Assistant requests use an IP-derived hash and request counters to limit abuse; hashing does not make this information anonymous. If you email us, we receive your email address and the contents of your message.

Optional website analytics tags collect visits, interactions, cookie/device identifiers and technical connection data. Our analytics events do not intentionally include plan titles, participant names, descriptions, locations or pasted plan links.

Where the GDPR applies, we rely on the following grounds:

• Providing the service you request (contract): creating and storing your plan, synchronizing edits, calculating dates and balances, and carrying out your assistant commands.
• Group coordination (legitimate interests): processing necessary information about other participants supplied by a group member. Our interest is making the shared plan work; participants can object and request removal of their data. Only supply another person’s information when you have a lawful basis and have told them about this notice.
• Security and reliability (legitimate interests): detecting abuse, limiting costs and requests, preventing duplicate writes and diagnosing failures.
• Optional analytics: your consent to measure and improve the service. Tracking remains off until you accept, in every region.
• Support: responding to your service request (contract) or other questions (legitimate interests). We process rights requests and legally required disclosures to meet legal obligations.

Plan content is not required to browse the site. Information needed for a feature, such as a name or an expense amount, is required only when you choose that feature. We do not make decisions with legal or similarly significant effects about you through solely automated processing. Date rankings and balances are ordinary planning calculations.

A share link is not a password or a private account. Anyone who obtains it can access the plan and make changes. Names identify participants but do not verify their identity. Other participants can copy the content or give the link to an assistant. Share it only with people you trust.

Uploaded photos have publicly accessible Cloudinary delivery URLs. Someone with an image URL may open it without the plan link. Removing a photo from a plan does not always delete the stored image; contact us for removal from the image service. Do not upload sensitive or intimate photos or another person’s image without a lawful basis.

When you use the integration, the assistant sends task-related tool arguments to our server, such as a plan link, the participant you select, dates or requested changes. We return the plan information and action results needed for that task. The embedded planner can also read the shared plan and submit edits you make directly in its UI. We do not request your complete chat history or proactively send your plans to an assistant.

Your assistant provider receives the information you send it and the tool results returned to your conversation. For OpenAI, this processing is governed by its Privacy Policy; for Anthropic (Claude), by its Privacy Policy; for Meta (Muse), by its Privacy Policy. Your account’s data controls apply in each. Other providers have their own terms. Removing the integration does not delete the saved plan or the conversation held by that provider. Manage conversation data with the provider and contact us to delete data held by lesgooo.

The embedded planner does not initialize our Google Analytics or Meta Pixel tags. Opening lesgooo.fun in a browser uses the website’s cookie controls below. Do not submit payment-card details, government ID numbers, account passwords or sensitive medical information through the integration. It is not intended for children under 13 or below the higher minimum age required in their country; do not use it to submit personal data about those children.

Essential browser storage keeps drafts, remembered participant selections, cached plans and pending edits working. Security checks, including Firebase App Check and Google reCAPTCHA Enterprise, help protect requests from abuse and may process device and connection information. These do not serve our advertising.

Optional website tracking stays off until you accept, in every region. We show the banner in estimated European regions, including the EEA, UK and Switzerland, and when the region is unknown. This estimate uses your browser’s time zone and may differ from your actual location. Elsewhere we do not show the banner automatically; you can accept or decline on this page. Global Privacy Control and Do Not Track keep optional tracking off.

Google Analytics 4 measures visits and feature usage. Meta Pixel is currently disabled and is not loaded, even after acceptance. Google Analytics receives cookie/device identifiers, sanitized page and interaction information and connection data. Previous Meta collections, if any, remain subject to Meta’s privacy controls. See Google’s Privacy Policy and Meta’s Privacy Policy.

Declining or withdrawing consent stops future analytics and advertising events, including Google Analytics automatic collection. It does not undo information already sent. You can also delete existing cookies through your browser and use the providers’ privacy controls for information they already hold.

• Google Firebase / Google Cloud: hosting, shared plan storage, synchronization, request handling and security. Google Maps processes place searches and supplies place information. Google also handles emails sent to our Gmail support address.
• Cloudinary: uploading, storing and delivering RSVP photos.
• Google Analytics: optional website measurement, under the controls above. Meta Pixel is currently disabled.
• Your chosen assistant provider: the conversation, relevant tool arguments, plan results and embedded app interactions.
• Websites linked in a plan: fetching a link or image preview sends a request for that URL to its source. Our server fetches proxied preview images; opening an external link connects your browser to that website under its own policy.
• People with the share or image link: as explained above. We may also disclose information where legally required or necessary to address abuse or protect legal rights.

The service uses infrastructure outside your country, including Firestore storage in the United States and providers’ global hosting and image-delivery networks. Where European transfer rules apply, provider agreements use applicable adequacy decisions, the EU–US Data Privacy Framework where the recipient and transfer are covered, or Standard Contractual Clauses. These safeguards do not mean data stays in Europe.

Google’s processing terms are described in the Google Cloud Data Processing Addendum. For uploaded content, Cloudinary’s Privacy Policy states that its Data Processing Agreement applies when it processes content for a controller under European data protection law. Contact us for information about the safeguards relevant to your data.

• Shared plans and photos: no automatic expiry. We retain them so groups can return to ongoing or recurring plans, until we handle a deletion request. Tell us which plan and photos you want removed. Image removal may need a separate manual step.
• Drafts, remembered names and offline caches: stay on your device until replaced or you clear the site’s browser storage. Clearing local data does not delete a shared plan on our servers.
• Pending edits and creation recovery: remain locally until completed or discarded; tab-scoped recovery also depends on your browser’s session lifetime and restore behavior.
• Embedded planner settings and recent plans: local settings and up to eight recent plan IDs/titles stay until cleared. Turn off “Remember recent plans” or use “Clear recent plans” in Settings to remove that history.
• Cookie choice: expires after 180 days. Typical provider defaults are up to two years for Google’s _ga cookies and three months for Meta’s _fbp; browser and provider settings can shorten or change these. Data already received by those providers follows their retention rules and controls.
• Service logs: the standard Google Cloud application/request log bucket retains logs for 30 days. Provider security or audit records can have separate retention under their policies.
• Abuse counters: technical request counters associated with an IP-derived hash expire seven days after their latest update. Firestore removes expired records asynchronously, typically within a further 24 hours. These records are pseudonymous, not anonymous.
• Duplicate-prevention records: creation receipts have no automatic expiry so an old retry cannot create the same plan again. When we erase a plan, its receipt loses the plan and participant details and retains only a minimal deletion marker at a hashed request ID.
• Support: kept while needed to answer your request, handle follow-up or meet a legal obligation or resolve a dispute. We may retain the limited information required to document a rights request or lawful refusal.

Where applicable, you can request access, correction, deletion, restriction of processing and a portable copy of data you provided. You can object to processing based on legitimate interests, including direct marketing. Withdraw consent at any time using the cookie controls above; withdrawal does not affect the lawfulness of earlier processing. These rights have legal conditions and exceptions.

Email lesgooofun@gmail.com with the right you want to exercise and enough detail to locate your data, such as the relevant plan link and participant name. We may need proportionate verification before deleting or disclosing data; knowing a public link alone does not establish a right to erase everyone else’s information. Do not send passwords or identity documents unless we first explain why a specific verification is necessary.

For GDPR requests, we normally respond within one month. If a lawful extension is needed for a complex request, we will tell you within that month. You can complain to your local data protection authority, including the Czech Office for Personal Data Protection. For data another participant entered about you, the same contact and rights apply.

We publish changes to this notice here with an updated date. Changes that require a new consent will require a new choice. See our Terms of Use for the service rules.