LessgoPrivacy Policy — Lessgo
*This is an English translation of the French Privacy Policy. If the two versions differ, the French version prevails.*
Version: 9 October 2026 · Effective date: 9 October 2026
Lessgo is the new name of OGmaps. This policy replaces the OGmaps policy for existing members; your accounts and your places are kept.
Contents
1. Controller
The controller of your personal data is NEVER BROKE LLC, a limited liability company of the State of Wyoming (United States), registered under number 2026-001993678, with its registered office at c/o registered agent, 30 N Gould St, Ste R, Sheridan, WY 82801, United States ("we", "us"), publisher of Lessgo (https://lessgo.app, formerly OGmaps).
Contact for any question about your data: contact@nbasuite.si
2. The principles in brief
- We only collect what is needed to run Lessgo and to improve it.
- No resale of data, no advertising pixel, no third-party tracker, no third-party analytics tool. Usage statistics are calculated in-house, on our own server.
- If you arrive through an advertisement, we only record the name of the campaign written into the link ("utm" parameters), so that we know which campaigns bring in members. Nothing is sent back to the advertising network.
- Your location is only read when you ask for it (for example "I'm here" when adding a place).
- Your memories are personal; a private place is seen by no one but you.
- The Application's data is hosted in the European Union.
3. The data we process, why, on what legal basis, and for how long
| Data | Purpose | Legal basis (GDPR, Art. 6) | Retention period |
|---|---|---|---|
| Account: username, first name (display name), password (never stored in plain text: only a bcrypt hash), sign-up date, friend who invited you (invitation code or link), passport (number and edition) | Creating and managing your account, signing you in, linking you to the friend who invited you | Performance of the contract (Terms of Use) | For as long as the account exists, then deletion (see § 8) |
| Acceptance of the Terms: date and version of the terms accepted at sign-up | Being able to prove that you accepted the Terms | Legitimate interest (proof) | For as long as the account exists |
Acquisition source: if you arrive through the link of an advertisement or a campaign, that link's "utm" parameters (source, medium, campaign, content, keyword) and its "ref" code, recorded at sign-up together with their date; if you came through a short link lessgo.app/r/… (the link of one of our videos), the code of that link; and, if you answer it, your optional answer to "How did you hear about Lessgo?" (TikTok, Instagram, a friend, other, and the video). Visits to these short links are only counted (one number per link and per day, without any data about you). Never any advertising identifier, third-party cookie or data sent to the advertising network | Measuring the effectiveness of our campaigns (how many sign-ups each one brings) | Legitimate interest (managing our advertising spend); you may object (§ 9) | 13 months after sign-up, then erasure |
| Email address, optional: it is not requested at sign-up and can be added later (verified by a 6-digit code) | Sign-in, account recovery ("forgotten password"), security, service emails | Performance of the contract; legitimate interest (account security) | For as long as the account exists. Verification code: 15 minutes (5 attempts). Reset link: 1 hour, single use. The address pending verification is replaced or erased as soon as it is verified. |
| Profile: profile photo, bio | Presenting you to other members | Performance of the contract | For as long as the account exists or until changed |
| Notebook: places (name, category, address, city, neighbourhood, country, coordinates, opening hours, phone number, links), Wish or Spot status, visibility (private, friends or public), photos and captions, memories, tips, dates, favourites, friend who introduced you to a place, friends you went there with, removed places | Providing the notebook, displaying it to you and, depending on the visibility chosen, to your friends or to other members | Performance of the contract | For as long as the place or the account exists |
| GPS location of your device, only when you ask to use it when adding a place (for example "I'm here") | Recording the place's location, filling in its address, indicating that a place was added on site | Performance of the contract, at your initiative (your device's location permission, which you can revoke at any time in your phone's settings) | Stored with the place, for as long as the place exists. The last location transmitted (a single one, replaced each time a new one is sent) is also kept in order to rule out inconsistent locations, for as long as the account exists |
| Place and address search: the text you type into the search | Suggesting places and addresses to you | Performance of the contract | Sent from our server to the services in § 5, without your username. Responses kept in memory for 24 hours at most, with no link to your account |
| Social: friends and friend requests, hearts, comments, feed posts, in-Application notifications, suggestions you have hidden | Running the social features | Performance of the contract | For as long as the account exists. The feed keeps the last 500 posts across all members, the notifications inbox the last 50 per member |
| Private messages and "Lessgo?" proposals between friends | Allowing conversation between friends and suggesting a place to a friend | Performance of the contract | The last 400 messages of each conversation; older ones are erased automatically. Deleted along with the account of either of the two participants |
| Friend suggestions: calculated from friends in common, cities in common (non-private places), hearts and sign-up date | Suggesting people for you to add | Legitimate interest (growing your circle of friends); you may object (§ 9) | Calculated on request, not stored |
| Push notifications: subscription address provided by your browser and encryption keys, notification preferences by category | Sending you the notifications you have accepted | Consent (your device's permission), which can be withdrawn at any time | For as long as the subscription is active or until the permission is withdrawn / the account is deleted |
| Data inherited from OGmaps (former members): items from the former collection game, iPhone widget token (stored as a hash) | Lessgo neither displays nor uses them; the OGmaps widget can still read your notebook | Performance of the contract (OGmaps terms) | Until the account is deleted; the token, until it is revoked |
| Internal usage data: screens viewed, opening of the Application (installed or not, operating system, language, screen width, notification status), time spent using it, technical errors, actions in the Application, display measurements. Never the text you type (only the length of a search), never your location, never your email | Fixing bugs, understanding usage, improving the Application | Legitimate interest (proper functioning and improvement of the Service); you may object (§ 9) | 180 days, then automatic erasure |
| Daily activity: list of accounts that opened the Application on a given day | Measuring attendance (active members per day, week, month) | Legitimate interest | 13 months |
| Technical security: IP address | Limiting sign-in, sign-up and reset attempts (anti-brute-force) | Legitimate interest (security) | Kept in memory for 5 minutes, not recorded in the database. Web server access logs (IP address, page requested, date): 90 days at most. |
| Communications with us (emails to contact@nbasuite.si, reports made from the Application or by email, requests to exercise rights) | Replying to you, handling reports | Legitimate interest; legal obligation for requests to exercise rights | 3 years after the last communication |
| Backup copies of all data | Restoring the Service in the event of an incident | Legitimate interest (continuity of the Service) | Daily backup on the server: 14 days. Off-server copies: the last 10, on an encrypted computer belonging to the team. An encrypted backup copy is also kept for 30 days on a separate storage space at our host Hetzner, in the European Union; the decryption key is not stored with the host. |
← The table scrolls sideways →
The mandatory fields are the first name, the username and the password: without them, we cannot create your account. Everything else is optional. Without an email address, a forgotten password cannot be recovered.
Sensitive data. We do not request any sensitive data (health, opinions, religion…). Avoid including any in your memories, tips, bios, comments and messages.
Photos. Before upload, the Application reduces each photo (1,600 pixels at most, 800 for the profile photo) and re-encodes it, which removes the original file's metadata (including the GPS location where the photo was taken and the device model).
4. Who sees your data
Other members, according to the Application's visibility rules:
- all members: your profile (display name, photo, bio, join date, passport, number of places, cities, countries and friends, friends in common); you may appear in their suggestions, with a reason (for example "Also in [city]", calculated from your non-private places);
- your friends: your "Friends" and "Public" places, their photos and your tips, your friends list, your posts, hearts and comments in the feed;
- all members, once the "Discover" section opens: your "Public" places, with their photos, your tip and your display name (we will notify you in the Application before it opens);
- the friend concerned: your private messages and your "Lessgo?" proposals;
- no one but you: your "Private" places, your removed places and your memories;
- your email address and your acquisition source are never shown to other members.
Our team: the founders and the people in charge of technical matters (the two founding partners of NEVER BROKE LLC) access data strictly to the extent necessary for maintenance, security, handling reports, measuring our campaigns and complying with the law. A restricted administration panel shows them statistics and the list of members. Private messages are not end-to-end encrypted: they are protected in transit (HTTPS) and on the server, but remain technically readable by the technical team, which refrains from viewing them outside the cases listed above.
Our processors and third-party services (§ 5), only for what is necessary for their task.
The authorities, when the law requires us to.
We do not sell or rent your data. We do not pass it on to any advertising network.
5. Processors and third-party services
| Provider | Role | Data concerned | Location |
|---|---|---|---|
| Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) | Hosting of the server, the database and the photos | All the Application's data | European Union (data centre in Finland) |
| Hostinger (HOSTINGER, UAB, Švitrigailos str. 34, LT-03230 Vilnius, Lithuania) | Sending service emails from contact@nbasuite.si (codes, reset links), domain names | Your email address, your display name, the content of the email | European Union / United Kingdom and other countries depending on Hostinger |
| komoot GmbH (Photon service, OpenStreetMap data) | Suggesting places and addresses while you type a search | The text of the search, sent from our server, without any identifier | Germany (European Union) |
| OpenStreetMap Foundation (Nominatim service) | Searching for a place when the quick search does not respond, calculating a place's address from its coordinates, or finding a place's location from its name | Text of the search, coordinates or name of the place, sent from our server, without any identifier | United Kingdom (European Commission adequacy decision) |
| Base Adresse Nationale (French State, api-adresse.data.gouv.fr) | Precise address of places located in France | Text of the search or coordinates of the place, sent from our server, without any identifier | France |
| Google (Places API) | When you paste a Google Maps link: retrieving the place's name, address, opening hours, phone number and website | The text of the pasted link, the name of the place, possibly its coordinates. The request is sent from our server: Google receives neither your username, nor your email, nor your IP address | Possibly United States |
| Your browser's notification services (Apple, Google, Mozilla depending on your device) | Delivering push notifications | Subscription address and content of the notification, encrypted end to end between our server and your device (Web Push standard): the service cannot read it | Mainly United States |
← The table scrolls sideways →
When you tap "Go", you open Google Maps, Maps (Apple) or Waze: you then leave Lessgo, and that service processes your data under its own privacy policy. Likewise, the "Share" button goes through your phone's share menu.
The OGmaps iPhone widget, which some former members still use, runs in the third-party app Scriptable, which they installed themselves; it communicates only with our server.
The Application's illustrations (including the Traveller character) were created with an artificial intelligence tool (OpenAI) without any member data. No personal data is transmitted to OpenAI.
6. Transfers outside the European Union
The Application's data is hosted in the European Union. Some data may nevertheless be processed outside the European Union:
- by our team, which administers the Service from Thailand and France;
- by NEVER BROKE LLC, a company established in the United States (Wyoming);
- by the providers listed in § 5 that are located outside the European Union.
These transfers are governed by the European Commission's standard contractual clauses or, for US providers that participate in it, the EU-US Data Privacy Framework. You can obtain a copy of these safeguards by writing to contact@nbasuite.si.
7. Cookies and storage on your device
Two cookies, both first-party to Lessgo (no third-party cookies):
ml_session, strictly necessary: it keeps you signed in. It isHttpOnly(unreadable by scripts),Secure(sent only over HTTPS),SameSite=Lax, and lasts one year at most (or until you sign out). As it is essential to the Service, it does not require your consent.lg_src, set only if you open a short linklessgo.app/r/…: it keeps the code of that link (for example "ig03a") for 30 days at most, so that your sign-up is attributed to the right video even if you sign up later, in the installed Application. It contains nothing else, is read only by Lessgo and is never transmitted to a third party.
The Application's local storage (on your device, never transmitted to third parties): signed-in account, parameters of the link through which you arrived (until you sign up), invitation code pending sign-up, tutorial steps already seen, choices regarding installation and notifications, data cached for fast loading, and the service worker cache (Application files and images) for fast and offline operation. You can erase all of it from your browser settings or by removing the Application from your home screen.
No advertising cookies, no advertising pixels (no Meta, TikTok, Snapchat or Google Ads pixel), no third-party trackers, no third-party analytics tools (no Google Analytics). The Application's fonts, scripts and images are hosted on our server: opening it sends no request to any third-party service.
8. Account deletion
You can delete your account at any time from the Application (Settings, "Delete my account", with your username and password), or by writing to contact@nbasuite.si from the email address associated with your account. We then erase, within 30 days: your profile, notebook, photos and profile photo, tips, password, email address, acquisition source, private messages, friendships, posts, hearts, comments, notifications, push subscriptions, data inherited from OGmaps, widget tokens and sessions.
Before erasure, a technical archive of the account is kept for 30 days so that a deletion made by mistake can be cancelled, and is then destroyed. Backup copies containing your data are overwritten at the end of their retention cycle (§ 3). Internal usage data linked to your username is erased.
Please note: since private messages are shared between two people, deleting your account also erases the conversation for your friend. Places you shared with your friends, or that they saved from yours, remain in their notebook, without your memory or your photos.
9. Your rights
In accordance with the General Data Protection Regulation (GDPR) and, where applicable, the Thai Personal Data Protection Act (PDPA, B.E. 2562 / 2019), you have the following rights:
- access: to know what data we hold about you and obtain a copy of it;
- rectification: to correct inaccurate data (most of it can be changed directly in the Application);
- erasure: to have your data deleted (§ 8);
- portability: to receive the data you have provided to us in a structured, machine-readable format (JSON), directly from Settings ("Download all my data");
- objection: to object to processing based on our legitimate interest (acquisition source, internal usage data, friend suggestions);
- restriction: to request that a processing operation be temporarily frozen;
- withdrawal of consent at any time (for example for notifications, from your device's or the Application's settings), without affecting the lawfulness of past processing;
- post-mortem instructions (French law): to define what happens to your data after your death.
How to exercise them: write to contact@nbasuite.si, preferably from your account's email address, stating your username and your request. We may ask you to confirm your identity (for example, if your account has no email address, by a message sent from the Application). We respond within one month (which may be extended by two months for a complex request, in which case we will inform you). Exercising your rights is free of charge.
Complaint: if you believe that your rights are not being respected, you may lodge a complaint with the data protection supervisory authority of your country of residence, for example in France the CNIL (the French data protection authority) (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07), or in Thailand the Office of the Personal Data Protection Committee (PDPC). We encourage you to contact us first: we will do our utmost to resolve the situation.
10. Security
We implement appropriate measures to protect your data, in particular:
- encrypted connection (HTTPS) across the whole Service;
- passwords stored only as a bcrypt hash; session, widget and reset tokens stored as a hash;
- session cookie inaccessible to scripts; limits on sign-in attempts;
- photos served only to signed-in members, at random addresses that are impossible to guess;
- server-side enforcement of visibility (private places, memories, messages between friends); a private place can never be public;
- server access restricted to the technical team, by key;
- daily backups.
No system is perfectly secure. In the event of a data breach presenting a risk to your rights, we will notify the competent authority and, where required by law, the data subjects concerned.
11. Minors
Lessgo is not intended for children under 16. If the law of your country sets a higher age for consenting on your own to the processing of your data, the consent of a holder of parental responsibility is required. If you believe that a child who has not reached the required age has provided us with data, write to us: we will delete the account.
12. Changes
We may change this policy, in particular when we add a feature that processes new data (for example the opening of the "Discover" section or of the paid plan). In the event of a significant change, we will notify you in the Application or by email before it takes effect. The date of the update appears at the top of this document.