Privacy and data rights
Last updated 5 September 2026
The public calendar works without an account. Telegram sign-in is only needed for attendance, event follows, suggestions, private calendars and Lucien's Den.
Who runs this
LuciFurs is the UK data controller. Email contact@lucifu.rs with questions, complaints or data requests.
What is used and why
Most processing is based on legitimate interests: running the features people ask for, keeping private data private and preventing abuse. Consent applies to optional Google Analytics, making your LuciFurs profile public to signed-in people and optional Telegram messages. You can switch reminders off from Profile at any time, and blocking LuciFursBot stops every Telegram message.
Identity comes from Telegram when you sign in. LuciFurs can then store a keyed account ID, display name, optional username and photo, account settings, attendance choices, privately followed events, reminder preferences and due times, suggestions, private invitations, an optional saved place and update times. Den data is explained in the separate Den notice. Phone numbers, contacts and chat history are not collected.
Who can see it
Interested and Going totals are public. Event follows are private and have no public total or follower list. Profiles are private by default. If you turn on Public on LuciFurs, signed-in users can see your current Telegram name, optional username and photo for events you responded to, and can find your exact @username when tagging people in private events. Turning it off hides you from attendee lists and site-wide tagging. Telegram reminders do not require a public profile.
If you explicitly open LuciFursBot from a reminder or update link, LuciFurs stores an encrypted private chat identifier. When reminders are on, future public events you mark Going receive a due-time record and are rechecked before LuciFursBot messages you around 24 hours before they start. All-day reminders are sent at 09:00 in the event's timezone on the previous day. The same private chat can receive invitation alerts, event suggestion review updates and important approved changes to events you follow. Change jobs store only keyed account and event references plus bounded change categories; the latest public event is checked again before delivery. Reminder and change-alert records and message content are not sent to analytics.
Authorised administrators can review suggestions and basic account or usage information. They do not get a person-by-person activity history through the admin area. Private data is not put in public pages, search results or public calendar feeds.
Site-wide private event discovery is off while your profile is private. People in a Den you share can still find you through a live, three-character Telegram member search; this may include current group members who have never registered with LuciFurs. LuciFurs does not import or retain complete group rosters. When your profile is public, any signed-in user can also find your exact Telegram username. An invitation stays private to its creator and recipient; accepting adds it to your private calendar. The creator sees current profile details when available, otherwise the name and optional username saved with the invitation. You can decline and block future invitations from that person.
Retention and private links
Attendance choices, event follows, reminder records and change-alert jobs expire 90 days after the event or final known occurrence. Privacy-safe usage totals expire after 90 days and inactive account directory entries after 180 days. Your profile stays until you delete the account so its privacy choice remains consistent. Photos are removed when you hide your identity or delete the account. Account deletion also removes event follows, the Telegram notification link, pending reminders and pending change alerts.
A private attendance-calendar link contains your Going events, if selected your Interested events, and invite-only events you create. Anyone with the link can read those event details. It does not include invitee identities, events created by other people or Den plans. Resetting or disabling it revokes the old address. Deleting your account removes your invite-only events and invitations. Approved public events remain, but their former owner is no longer identified.
Organiser access
If you request organiser access, LuciFurs stores your keyed account identity, claim notes, public evidence references, review decision and granted role. Authorised reviewers see that evidence. Your organisation workspace shows linked public listings and limited pending-change status; it does not show other people's evidence or identities. Proposed corrections remain private until a person approves the public event facts.
Unapproved claims expire after 30 days. Audit records and revoked memberships expire after 180 days; approved decisions retain their provenance. Account deletion revokes access and removes claim evidence, identifying notes and private organiser proposal content. Pseudonymous keys may remain for the retention period, and a deletion fence prevents old sessions from regaining access. Published event history remains available.
Near me
Current browser coordinates stay in this tab and are not saved to your account or analytics. A place deliberately saved in Profile is private and used only for distance filters and your private What's next pick. Near me URLs contain the distance, not your location.
Who data goes to
AWS hosts the site and primary data in Ireland. Telegram handles sign-in, group checks, bot messages and polls. Google provides Maps, optional place suggestions and, only with your consent, Analytics. Private routes are reported using generic names without IDs or private content. These services can process data internationally under their own safeguards. See the AWS, Telegram and Google privacy notices and the Google Maps terms.
Cookies and logs
There are no advertising cookies. One secure cookie keeps you signed in for up to seven days and another remembers the first day of your week for up to one year. Optional Google Analytics stays off until you allow it and receives only generic route names for private areas. The cookie details list the choices and durations.
Normal security logs can include IP address, time, page, browser and response status. Apache logs rotate daily and are kept for about 14 days. Application logs are size-limited. Private attendance-calendar tokens are not written to access logs.
Your rights
You can ask to access, correct, delete, restrict or move your data, or object to how it is used. Rights depend on the lawful basis. Email contact@lucifu.rs; LuciFurs may need to confirm your Telegram account and will normally reply within one month. You can also delete your account from Profile.
Checks and complaints
Telegram sign-in and group membership are checked automatically, but LuciFurs makes no automated legal or similarly significant decisions. Event approvals are handled by a person.
If something is wrong, contact LuciFurs first. You can also complain to the UK Information Commissioner through the ICO complaints service or call 0303 123 1113.