Privacy Policy

Last updated: 24 June 2026

The short version

When Can We Go? is a zero-login group event planner. There are no accounts, no advertising, and no tracking or analytics. We only store what you actively type into an event (your name and the days you mark) so the people who share your event link can see it. There are no tracking cookies, so no cookie banner is needed.

Who is responsible

The controller responsible for data processing on this website is:

Email:

What data we process

When you create or take part in an event, the following information is stored so the planner can work:

Event details: the event name and the date range you are considering.
The names you enter: your own name and the names of anyone you invite. You decide what to type here; a first name or nickname is enough.
Availability markings: the days each person marks as “can't make it” or “maybe not”.
A random device key: stored in your browser so the app remembers which participant is “you” on this device. It is not linked to your identity.

We do not ask for an email address, password, or account. We do not collect your IP address for our own purposes, and we run no analytics, profiling, or advertising.

How an event is shared

Each event has a long, randomly generated ID that lives in the link's address (the ?e= part). Anyone who has that link can view and edit the event. Treat the link like a shared document: only send it to the people you want to take part. The link is not listed anywhere and is practically impossible to guess, but it is not password-protected.

Where data is stored (Firebase)

Event data is stored and synchronised in real time using Firebase Realtime Database, a service provided by Google. The database is hosted in Google's europe-west1 (Belgium, EU) region. Google acts as our data processor under a data processing agreement (the Firebase Data Processing and Security Terms).

To make this work, your browser loads the Firebase software library from Google's servers (gstatic.com) and connects to the database. As a technically unavoidable part of any such connection, your IP address is transmitted to Google. Google may process this on servers operated by Google LLC (USA); transfers are covered by the EU Standard Contractual Clauses and the EU–US Data Privacy Framework. More information: firebase.google.com/support/privacy.

Hosting

This website is hosted on GitHub Pages, a service of GitHub, Inc. (USA). When you open the page, your browser transmits technical data (such as your IP address and the requested file) to GitHub, which GitHub may log to deliver the site and protect against abuse. See GitHub's privacy statement: GitHub Privacy Statement.

Cookies and local storage

We do not set any tracking or advertising cookies. The app uses your browser's local storage only for strictly functional purposes: to cache your event so it loads quickly and works offline, and to remember which participant is “you” on this device. This data stays in your browser, is not used to track you, and can be cleared at any time through your browser settings. Because this storage is strictly necessary to provide the service you requested, no consent banner is required (§ 25 (2) TDDDG).

Legal basis

Processing of the event information you enter is based on Art. 6 (1)(b) GDPR (performance of the service you requested) and on our legitimate interest in providing a functional, account-free planner, Art. 6 (1)(f) GDPR. Hosting and the technically required connection to Firebase are likewise based on Art. 6 (1)(f) GDPR.

How long data is kept

Event data remains stored as long as the event exists, so that participants can keep using the link. We do not delete events automatically. If you would like an event and its contents removed, contact us with the event link and we will delete it. Functional data in your browser's local storage is removed when you clear your browser data.

Your rights

Under the GDPR you have the right to:

access the personal data we hold about you (Art. 15);
have inaccurate data corrected (Art. 16);
have your data erased (Art. 17);
restrict or object to processing (Art. 18, 21);
receive your data in a portable format (Art. 20);
lodge a complaint with a supervisory authority (Art. 77).

To exercise any of these, contact us at the email address above. You can also remove a person and their markings directly in the app, which deletes that information from the event.

Children

This service is not directed at children. Please only enter the names of people who are aware that their name and availability will be shared with everyone who has the event link.

Changes to this policy

We may update this Privacy Policy as the app evolves. Changes are published on this page with an updated date above. If we ever add analytics or other non-essential technologies, we will ask for your consent first.