Privacy Policy

1. Introduction

Welcome to Turnsies ("we," "our," or "us"). We are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our turn tracking application (the "Service").

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address and password when you create an account
• Profile Information: Name and profile picture (if using Google Sign-In)
• Activity Data: TurnSet names, participant names, turn history, and activity settings
• Group Data: Group names, member information, and group settings

2.2 Automatically Collected Information

• Usage Data: Activity logs, feature usage, and interaction data
• Device Information: Browser type, operating system, and device identifiers
• Analytics Data: Page views and key actions such as creating an activity, logging a turn or inviting someone, linked to your account ID when you are signed in (via PostHog, only if you accept analytics cookies), plus anonymous performance metrics (via Vercel Analytics)
• Session Recordings: Where enabled, clicks, scrolls and page interactions with form inputs masked (via PostHog, only if you accept analytics cookies)
• Error Logs: Application errors and performance metrics (via Sentry)

3. How We Use Your Information

We use the collected information for the following purposes:

• Provide, maintain, and improve our Service
• Process and manage your account
• Enable turn tracking and activity management features
• Facilitate collaboration with other users through groups and invitations
• Send you important updates, security alerts, and administrative messages
• Analyze usage patterns to improve user experience
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations and enforce our Terms of Service

4. Data Sharing and Disclosure

4.1 Third-Party Services

We share information with the following third-party service providers:

• Firebase/Google Cloud: Authentication, database storage, and hosting infrastructure
• PostHog (EU cloud): Product analytics and session recordings
• Vercel Analytics: Performance monitoring and web vitals
• Sentry: Error tracking and performance monitoring

4.2 Shared Activities

When you share activities or join groups, your information (name, email, and activity data) will be visible to other participants in those activities or group members.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

5. Data Storage and Security

Your data is stored securely using Firebase/Google Cloud infrastructure with industry-standard security measures:

• Data encryption in transit (HTTPS/TLS)
• Data encryption at rest
• Secure authentication using Firebase Authentication
• Regular security updates and monitoring
• Access controls and user authentication

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide you with our Service. You can delete your account at any time from the Settings page. When you do, we immediately delete:

• Your account, profile, profile photo, settings and participant groups
• Invitations you sent or received, and your notifications
• Activities you own that nobody else has joined, including their rewards and task lists
• Your place in other people's activities, and your rewards in them

Activities you own that other people have joined are handed to one of them (an activity admin if there is one, otherwise the longest-standing member) so they keep their history. Where your name or email appears in an activity's history, it is replaced with "Former member". We keep security and audit logs, which record your account ID, to protect the Service. If another user has blocked your email address, it stays on their block list.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of your personal data
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and data
• Export: Download your data in a portable format
• Objection: Object to processing of your data
• Restriction: Request restriction of data processing
• Withdrawal: Withdraw consent at any time

To exercise these rights, please contact us using the information provided in the Contact section below.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track activity on our Service and hold certain information. For more detailed information about the cookies we use, please see our Cookie Policy.

9. Children's Privacy

Our Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete such information.

10. International Data Transfers

Your information may be transferred to and maintained on servers located outside of your country or jurisdiction where data protection laws may differ. By using our Service, you consent to such transfers. We take steps to ensure that your data is treated securely and in accordance with this Privacy Policy.

11. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes. Changes are effective when posted on this page.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

Email: privacy@turnsies.app

13. GDPR Compliance (EU Users)

If you are located in the European Economic Area (EEA), you have certain data protection rights under the General Data Protection Regulation (GDPR). We process your data based on the following legal grounds:

• Consent: You have given clear consent for us to process your personal data
• Contract: Processing is necessary for the performance of our contract with you
• Legal obligation: Processing is necessary to comply with the law
• Legitimate interests: Processing is necessary for our legitimate interests