Privacy Policy

Last updated: 16 September 2026

Turnabee collects only what it needs to put a task on someone else's calendar. We do not sell data, we do not run ads, we do not track you, and we do not analyse the contents of your calendar.

There are two kinds of people on Turnabee

This shapes everything below, so it comes first:

• Creators sign in with Google, make groups and schedule things.
• Recipients are the people things are scheduled for — family, a nanny, a colleague. Recipients need no Turnabee account and install nothing. They connect Turnabee to the calendar they already use, once, and never come back.

What we collect

Creators (people who sign in with Google)

When you sign in with Google we ask Google for three things and nothing else (the scope is openid email profile):

Your Google account ID	A stable number Google gives each account. We use it to recognise you when you come back.
Your email	To identify your account.
Your name	Shown in the app, and in the emails recipients get (“scheduled by …”).

We never see your Google password. Sign-in happens entirely on Google's own pages.

Recipients

• Name — typed by the creator, or by the recipient when they join.
• Email — optional. Only needed to receive the digest email.
• Language — what their browser asked for the first time they arrived, so the page is in a language they read.
• Whether their calendar has fetched anything — the first and most recent time their calendar software asked us for data, how many times, and the User-Agent of that request (a short string naming the software, e.g. iOS/26.0 dataaccessd).

That last one exists to answer one question: did it actually connect? Without it the creator is guessing, and “thinking someone will be reminded when they won't” is the worst way this product can fail. We cannot see anything in their calendar, and we cannot see whether they turned notifications on.

The tasks themselves

What you type in: title, notes, category, dates and times, who it is for, who can see it, whether it appears on the shared calendar, and who ticked it off on what day.

This content is delivered as written to the recipients you choose — that is the whole point of the product. So please remember: what you type, they will read.

Cookies

Three, all of them needed for the site to work, none of them for tracking:

sid	Remembers that you are signed in.
gid	Remembers which group you are looking at.
lang	Remembers the language you chose.

There is no Google Analytics, no advertising pixel, and no third-party cookie.

What we do not do

• We do not sell, rent or trade anyone's data.
• We do not run ads or hand data to advertisers.
• We do not train AI models on your data.
• We do not build cross-site behavioural profiles.

Where the data lives, and who can reach it

Turnabee runs on Cloudflare and stores its data in Cloudflare D1. Beyond the three companies below, nobody else receives it:

Cloudflare	Hosting and database. All data lives here.
Google	Sign-in. Also used if you choose to connect Google Calendar (see below).
Resend	Sends the digest email. Only the email addresses of recipients who provided one, and the contents of that email, pass through it.

Google user data

Today Turnabee uses Google only for sign-in.

We are adding an option for recipients to connect Turnabee to their own Google Calendar, so tasks appear directly on their calendar instead of depending on how often an external subscription URL is refreshed. If you choose to do that:

• The scope we request is calendar.app.created, which means we can only manage the one calendar Turnabee creates. Your existing events and other calendars are neither readable nor writable by us.
• Turnabee creates a separate calendar in your Google account (for example “The Chen family”) and writes only Turnabee tasks into it.
• The credentials for that authorisation are stored encrypted on our server. They are never exposed to the browser and never shared with any third party.
• You can revoke access at any time at myaccount.google.com/permissions. After that we can no longer write anything, and you can delete the calendar itself in Google Calendar.

Limited Use: Turnabee's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep it, and how to delete it

• Delete a group and its tasks, people and completion history go with it, immediately. The next time a recipient's calendar fetches, there is nothing there.
• Delete your account and every group you own, and everything in it, is erased. This cannot be undone. You can do it yourself from the Account page.
• Recipients can stop receiving email themselves from the link at the bottom of any email, without asking the creator.
• We keep no backup copies. Deleted is deleted.

Security

Everything is served over HTTPS. Calendar subscription URLs are long random strings that cannot be guessed, and can be regenerated at any time, which immediately invalidates the old one. Note though: anyone holding that URL can see what is on it, so treat it like a password.

Children

Turnabee is not a service for children and we do not knowingly collect children's data. A parent can of course add a child's name as a recipient in order to schedule things — that is just a name.

Changes to this policy

Changes update the date at the top. If a change materially affects how your data is used, we will say so on the site.

Contact

For any privacy question, or to request a copy of your data or its deletion, write to hello@turnabee.com.