Last updated: 28 October 2026
The English version of this document is the governing version; translations are provided for convenience only, and if a translation differs from the English version, the English version prevails.
Turnabee collects only what it needs to put a task on someone else's calendar. We do not sell data, we do not show ads on the site, and we do not analyse the contents of your calendar. Nothing is tracked once you are signed in, or on any recipient page; only the public pages you see before signing in carry Google's ad measurement tag (see "Cookies" below).
This shapes everything below, so it comes first:
When you sign in with Google we ask Google for three things and nothing else
(the scope is openid email profile):
| Your Google account ID | A stable number Google gives each account. We use it to recognise you when you come back. |
|---|---|
| Your email | To identify your account. |
| Your name | Shown in the app, and in the emails recipients get (“scheduled by …”). |
We never see your Google password. Sign-in happens entirely on Google's own pages.
When you enter your email and tap “Email me a sign-in link”, we send you an email with a sign-in link and a 6-digit code. They work for 15 minutes, once. For this we keep:
| Your email | To identify your account, and as the address we send sign-in emails to. If you already sign in with a Google account that has the same email, both ways lead to the same account. |
|---|---|
| Your name | The one you type the first time you set up. Shown in the app and on the pages recipients see. |
| A record of the sign-in email | The link and the code are stored only as one-way hashes (we cannot read them back), plus a hash of where the request came from (not your IP address itself), so the same place cannot keep asking for emails. Deleted after one day. |
When you tap “Continue with Apple” we ask Apple for two things and nothing else (the scope is name email).
Sign-in happens entirely on Apple's own pages, and we never see your Apple ID password. We keep:
| Your Apple account ID | A stable number Apple gives each account (different for every website). We use it to recognise you when you come back. |
|---|---|
| Your email | To identify your account. If you choose “Hide My Email” on Apple's page, we get a forwarding address from Apple instead of your real one, and Apple forwards our emails to you. If Apple gives us your real email and you already sign in with that same email, both ways lead to the same account. |
| Your name | Apple only provides it the first time you sign in, and you can edit or withhold it on Apple's page. You confirm it again when you first set up. |
When you tap “Log in with LINE” we ask LINE for the following (the scope is openid profile email).
Sign-in happens entirely on LINE's own pages. We never see your LINE password, and we cannot see your chats, friends or anything else;
we never post or send messages as you. We keep:
| Your LINE account ID | A stable number LINE gives each account. We use it to recognise you when you come back. |
|---|---|
| Your LINE display name | Used as your starting name on Turnabee. You confirm it when you first set up, and can change it later. |
| Your email (if you agree to share it) | The email registered to your LINE account. We use it for two things only: to identify your account (if you already sign in with that same email, both ways lead to the same account) and to send you emails about Turnabee (such as sign-in emails or a digest you turned on yourself). You can sign in without sharing it; we just cannot email you. We never use it for advertising or give it to anyone else. |
LINE also offers a link to your profile picture. We do not use or store it.
Once you are using it, we also keep these, each for a feature you can see on screen:
| Your time zone | For example Asia/Taipei, reported by your browser. We use it to decide
whether something is overdue — without it we would use the wrong date and tell you something was overdue
before your day was actually over. |
|---|---|
| Your language choice | So a second device shows the same language. |
| Where you found Turnabee | One of ten fixed labels, such as reddit, google or
direct, recorded once, when you create your account, and never updated after that.
It tells us which introductions actually help people. We do not store the web address or the pages you visited, and it is
not used for cross-site tracking or advertising. |
| Where you are signed in | For each sign-in, the browser's User-Agent and when it was last used. It is listed on your account page so you can see it and sign out any device you do not recognise. |
| Notifications | If you turn notifications on for a device, we keep the push address and encryption keys that browser gives us (nothing can be delivered without them), plus which kinds you switched off. Remove the device on your account page and these go with it. |
| Home screen | Which kinds of device (iPhone/iPad, Android, other) you have opened Turnabee from a home-screen icon on, so we stop suggesting it on that kind of device. On iPhone the home-screen icon and Safari do not share cookies, so keeping this on your account is the only way Safari can know. |
| Paid subscription (if you have one) | The customer and subscription numbers our payment partner gives us, which plan you are on, monthly or yearly, the subscription status (for example "cancelled" or "payment failed") and when the current period ends. We use it to decide which features you get and to send you straight to the page where you manage your subscription. We never see or store your card number — payment details stay with our payment partner. |
| In-app subscription (Google Play) | If you subscribe inside the Android app with Google Play: the purchase token Google Play gives us, which plan you chose, monthly or yearly, the subscription status and when the current period ends. When you pay, the app passes your Turnabee user ID to Google Play so we can confirm which account the subscription belongs to. To keep the books straight we log each notification Google sends us and what we did with it (the purchase token is stored only as a hash, never the token itself) and keep that log for 180 days. We never see your payment method — it stays with Google. |
| In-app subscription (App Store) | If you subscribe inside the iPhone app with the App Store: the transaction ID the App Store gives us, which plan you chose, monthly or yearly, the subscription status and when the current period ends. When you pay, the app passes Apple a code derived from your Turnabee user ID so we can confirm which account the subscription belongs to. To keep the books straight we log each notification Apple sends us and what we did with it (the transaction ID is stored only as a hash) and keep that log for 180 days. We never see your payment method — it stays with Apple. |
| Phone app notifications and home-screen widget | If you use the Turnabee app: when it first opens, the app makes a random "device key" on your phone, and we store only a hash of it; if you allow notifications, also the push token Google (Firebase) gives that phone; plus the kind of phone (Android/iPhone) and when you last opened the app. We use these to send notifications to that phone and to let the home-screen widget show "today" even when the app is closed. Signing out, removing the phone on your account page, or not opening the app for six months turns these off or deletes them. |
iOS/26.0 dataaccessd).The calendar-fetch item exists to answer one question: did it actually connect? Without it the creator is guessing, and “thinking someone will be reminded when they won't” is the worst way this product can fail. We cannot see anything in their calendar, and we cannot see whether they turned notifications on.
What you type in: title, notes, category, dates and times, who it is for, who can see it, whether it appears on the shared calendar, and who ticked it off on what day.
This content is delivered as written to the recipients you choose — that is the whole point of the product. So please remember: what you type, they will read.
All of the cookies below are needed for the site to work. None of them is for tracking, and none of them comes from a third party. (The cookies Google sets on the public pages are covered at the end of this section.)
The ones that stay:
sid | Remembers that you are signed in. |
|---|---|
gid | Remembers which group you are looking at. |
lang | Remembers the language you chose. |
tz | Remembers that your time zone has already been sent, so your browser does not send it on every page. |
aiok | (In the Turnabee app only) Remembers that you agreed to send content to AI to be read, so we do not ask again. |
pwa | Remembers that Turnabee is already on this device's home screen, so we stop suggesting it. |
The ones that last minutes and then disappear (signing in, and connecting Google Calendar):
next | Takes you back to the page you were heading to after you sign in. 10 minutes. |
|---|---|
oauth_state | Confirms that the return from Google sign-in is the same trip, so nobody else can hijack it; on a first sign-up it also carries the "where you found Turnabee" label above. 10 minutes. |
apple_state, apple_ret | The Sign in with Apple trip: confirms the return from Apple is the same trip (as above), and carries the one-time code Apple sends back to the next page. Used only for the few seconds of signing in; 10 minutes at most. |
line_state | The LINE sign-in trip: confirms the return from LINE is the same trip (as above). 10 minutes at most. |
app_ch | A sign-in started from the Turnabee mobile app: remembers that the app started it, so you are sent back to the app afterwards. Used only during those few minutes, 10 minutes at most. |
gcal_state, gcal_m, gcal_tz | The Google Calendar connection trip: confirms it is the same trip, which recipient it is for, and their time zone. 15 minutes. |
ms_state, ms_m, ms_tz | The Outlook Calendar connection trip: confirms it is the same trip, which recipient it is for, and their time zone. 15 minutes. |
We advertise on Google. To learn whether those ads lead to sign-ups, only the public pages you see before signing in (home, pricing, help, guides, demo, contact, what's new, this policy and the terms) carry the Google tag from Google Ads. It sets cookies in your browser and sends Google which page you are on, whether you arrived from an ad, and basic browser details. How Google uses that information is explained on Google's own page.
The Turnabee mobile app never loads it, signed in or not. No page after you sign in, no recipient page and no calendar subscription carries it either — those pages hold your family's names and private links, and none of that goes to any ad service. There is no Google Analytics.
The one exception: the set-up page you see right after signing up with Google (there is no group yet, so no family
names on it) loads the tag once to tell Google that someone signed up, so we know which ad brought them. Your name and
email are not sent. So that this happens only once, we set an ads_su cookie at the moment you sign up; that page
deletes it, and it lasts one day at most. People invited as helpers skip this step.
If you are in the European Economic Area, the UK or Switzerland (or we cannot tell which country you are in), the tag is not loaded at all and nothing is sent to Google. Elsewhere you can turn off personalised ads in Google's ad settings, or have your browser block tracking cookies — Turnabee works just the same.
Each time a browser opens the home page, we add one to a single number for that day. That is all — no cookie, no IP address, no browser details. The number cannot be traced back to anyone. Search engine crawlers and chat-app link previews are not counted.
Other figures, such as how many people have connected a calendar, are worked out directly from the data described above. We do not keep a second copy for analytics.
"Where you found Turnabee" is worked out like this: when you first open the site, your browser checks the address for a
tag such as ?src=, or otherwise which site linked you here (the domain only). The result is kept in your
browser's sessionStorage — not a cookie, never sent to us on its own, gone when you close that tab.
Only when you press "Sign in with Google" for the first time is that label sent, and stored as one field on your account.
The iPhone app (from 24 October 2026), the first time it opens, gives us an "attribution token" made by the iPhone; we ask Apple
whether this install came from tapping an Apple Ads ad and get back only yes or no. If yes, the label above is set to "apple_ads".
We don't keep the token or Apple's answer. This is not tracking: it doesn't use, and can't get, your phone's advertising identifier.
This is a feature the creator chooses to use. When you paste in a notice (a school letter, a group chat message) or dictate one, and press "Read it":
| What goes to OpenAI | Only the text you entered, plus today's date and time zone (so that "next Thursday" can be worked out). Email addresses in the text are masked first. Your account, email address, group names, member list and other tasks are not sent, and nothing obtained from Google is ever sent. |
|---|---|
| What we keep | We do not store the full text you entered; it is discarded once it has been read. The list of suggestions the AI reads out (each one's title, date, place, what to bring, and the one sentence from your text it came from) is kept so you can check it. When you press "Create", that sentence is deleted. The whole suggestion list is deleted after at most 7 days (tasks you created stay in your group as usual). We also keep a usage record (when, how much, how long, whether it worked) to count your plan's allowance; it contains nothing you entered. |
| When you use a photo or screenshot | The photo is first made smaller and saved again on your phone; this removes its location, time taken, camera model and similar details before anything is sent. We send the photo to OpenAI to copy the words on it — twice (at two resolutions) — and compare the dates and numbers from both copies, so that you are asked to check any line where they differ. We do not store the photo; it is discarded once copied. So that you can tap "See the original photo" on the review page, a smaller copy is kept in your own device's browser (the last 3 at most, cleared automatically after 7 days); it is never sent back to us. The copied words are only put back into the box on your phone, and after you press "Read it" they are handled like the text above. If the photo shows other people's names or faces, those are sent too, so please photograph only the part you need. |
| When you tap 🎤 and speak | (AI assistant, from 14 October 2026) The recording is sent to OpenAI to turn it into text. We do not store the recording or the text; the text comes back to your phone and is handled like the text above. We keep only a record (who, when, how large, whether it worked) to prevent heavy use, and delete it after 30 days. If other people's voices are in the recording, those are sent too. |
| When you import a file | Word, Excel, PDF and text files are read on your device; the file itself is not sent to us or to OpenAI. After you check the text and press "Read", it is handled like the text above. For a scanned PDF, the first 3 pages are turned into pictures on your device and handled like the photos above. The program that reads PDFs (pdf.js) is downloaded to your browser from cdnjs.cloudflare.com; Cloudflare sees your IP address and when it was downloaded, not your file. |
| When you forward an email | (From 24 October 2026) Emails sent to your group's own address (add-…@turnabee.com) are only handled if they come from the creator, a helper or a family member (we match the sender's email); anything else is dropped unread. The email text and the first photo are sent to OpenAI as described above, and what it finds is added to the calendar. We don't keep the email, photos or attachments; we only record who forwarded it, the subject and how many were added, for 90 days (to count the daily limit and so you can find it again). Cloudflare Email Routing receives the email. |
| When you ask a question | For example "What's on today?" or "What does Jamie have tomorrow?": nothing is sent to OpenAI. Our site looks up the answer in your group's data, and reads it out only in your device's own voice. |
(From 28 October 2026) You can connect your own AI assistant, such as ChatGPT or Claude, to Turnabee, and check, add, change and tick off plans by talking to it. It's your choice whether to turn this on:
Whether or not you have an account, you can leave a message on the Contact page or email us directly. When you do, we receive:
| The email address you give | So we can reply. It is used for that and nothing else. |
|---|---|
| What you write | Whatever you want to tell us. |
| Kind of device | When you use the contact form, the kind of device you sent it from (for example "iPhone" or "Windows") is attached, which helps us find the problem. If you were signed in at the time, your account email and plan are attached too, so we know which account to look at. |
None of this is stored in Turnabee's database. It becomes one email in our inbox, where it stays so we can carry on the conversation; you can ask us to delete it at any time.
Turnabee runs on Cloudflare and stores its data in Cloudflare D1. Beyond the companies below, nobody else receives it:
| Cloudflare | Hosting and database. All data lives here. Every connection passes through Cloudflare, which processes your IP address to deliver pages and block attacks. |
|---|---|
| Sign-in, for creators who choose Google. Also used if you choose to connect Google Calendar (see the next section). Google also provides the ad tag on the public pages (see "Cookies" above). | |
| Apple | Sign-in, for creators who choose Apple. If you choose “Hide My Email”, the emails we send you go through Apple's forwarding service. |
| LINE (LY Corporation) | Sign-in, for creators who choose LINE. |
| Microsoft | Only if you choose to connect Outlook Calendar (see “Outlook Calendar (Microsoft)” below). |
| Resend | Sends the digest email and the sign-in emails. For the digest, only the email addresses of recipients who provided one, and the contents of that email, pass through it; if you sign in with your email, your address and that sign-in email pass through it. If a recipient connected Google Calendar without giving an address and the creator turns the digest on for them, the address used is the one on that Google account. What you send through the contact form (your email address and message) also travels through it to our inbox. |
| Sold through Link, LLC (formerly Lemon Squeezy LLC) | Only if you buy a paid plan. Checkout happens on its site, so your name, email and payment details go straight to it; all it sends back to us is what the "Paid subscription" row above lists. It is the legal seller (Merchant of Record) for the purchase; see the Terms. |
| Google Play | Only if you subscribe inside the Android app. Payment happens in Google Play and your payment details stay with Google; all it gives us is what the "In-app subscription" row above lists. |
| Apple (App Store) | Only if you subscribe inside the iPhone app. Payment happens in the App Store and your payment details stay with Apple; all it gives us is what the "In-app subscription (App Store)" row above lists. On an iPhone, notifications also reach your phone through Apple's push notification service. |
| Google (Firebase Cloud Messaging) | Only if you allow notifications in the phone app. We hand it the notification (a title, one line of text and which page to open) and it delivers it to your phone. |
| OpenAI | Only when a creator uses "Read a notice with AI" or the AI assistant, to read the dates and tasks out of that text (or the words in a photo) and to turn 🎤 recordings into text (what is sent is described under "When you use "Read a notice with AI"" above). Under OpenAI's API policy this data is not used to train its models; we have not turned on sharing data with OpenAI, and we ask it not to store the results. OpenAI keeps it for up to 30 days to prevent abuse (longer only where the law requires), then deletes it. |
Turnabee uses Google in two places:
If you choose to connect Google Calendar:
openid, email and
calendar.app.created. The last one means we can
only manage the one calendar Turnabee creates.
Your existing events and other calendars are neither readable nor writable by us.myaccount.google.com/permissions, or delete the calendar itself in Google Calendar.Limited Use: Turnabee's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Anyone in a group can choose to connect Turnabee to their own Outlook Calendar (Outlook.com, Hotmail, or a work or school Microsoft account). It is optional; Turnabee works without it.
openid, email, profile, offline_access and
Calendars.ReadWrite. Microsoft has no permission like Google's “only the calendars this app created”;
the smallest one is “read and write your calendars”, so that is what the consent screen says.
In practice we create one Turnabee calendar and only add, change or delete events in that calendar.
We do not read or change your own events or other calendars.Everything is served over HTTPS. Calendar subscription URLs are long random strings that cannot be guessed; the creator can give anyone a new one from the People page (the old one stops working immediately), and a group's invite code can be changed at any time. Note though: anyone holding that URL can see what is on it, so treat it like a password.
To stop anyone from guessing invite codes or short links by the thousand, failed attempts are counted using a hash that cannot be turned back into an IP address, kept for about two hours at most and then deleted automatically. We do not store IP addresses ourselves (for Cloudflare's handling while delivering pages, see “Where the data lives, and who can reach it” above).
Turnabee is not a service for children and we do not knowingly collect children's data. A parent can of course add a child's name as a recipient in order to schedule things — that is just a name.
Changes update the date at the top. If a change materially affects how your data is used, we will say so on the site.
For any privacy question, or to request a copy of your data or its deletion, write to hello@turnabee.com.
Questions or ideas? Contact us →