Last updated: 15 October 2026
The English version of this document is the governing version; translations are provided for convenience only, and if a translation differs from the English version, the English version prevails.
Turnabee collects only what it needs to put a task on someone else's calendar. We do not sell data, we do not show ads on the site, and we do not analyse the contents of your calendar. Nothing is tracked once you are signed in, or on any recipient page; only the public pages you see before signing in carry Google's ad measurement tag (see "Cookies" below).
This shapes everything below, so it comes first:
When you sign in with Google we ask Google for three things and nothing else
(the scope is openid email profile):
| Your Google account ID | A stable number Google gives each account. We use it to recognise you when you come back. |
|---|---|
| Your email | To identify your account. |
| Your name | Shown in the app, and in the emails recipients get (“scheduled by …”). |
We never see your Google password. Sign-in happens entirely on Google's own pages.
When you enter your email and tap “Email me a sign-in link”, we send you an email with a sign-in link and a 6-digit code. They work for 15 minutes, once. For this we keep:
| Your email | To identify your account, and as the address we send sign-in emails to. If you already sign in with a Google account that has the same email, both ways lead to the same account. |
|---|---|
| Your name | The one you type the first time you set up. Shown in the app and on the pages recipients see. |
| A record of the sign-in email | The link and the code are stored only as one-way hashes (we cannot read them back), plus a hash of where the request came from (not your IP address itself), so the same place cannot keep asking for emails. Deleted after one day. |
Once you are using it, we also keep these, each for a feature you can see on screen:
| Your time zone | For example Asia/Taipei, reported by your browser. We use it to decide
whether something is overdue — without it we would use the wrong date and tell you something was overdue
before your day was actually over. |
|---|---|
| Your language choice | So a second device shows the same language. |
| Where you found Turnabee | One of ten fixed labels, such as reddit, google or
direct, recorded once, when you create your account, and never updated after that.
It tells us which introductions actually help people. We do not store the web address or the pages you visited, and it is
not used for cross-site tracking or advertising. |
| Where you are signed in | For each sign-in, the browser's User-Agent and when it was last used. It is listed on your account page so you can see it and sign out any device you do not recognise. |
| Notifications | If you turn notifications on for a device, we keep the push address and encryption keys that browser gives us (nothing can be delivered without them), plus which kinds you switched off. Remove the device on your account page and these go with it. |
| Home screen | Which kinds of device (iPhone/iPad, Android, other) you have opened Turnabee from a home-screen icon on, so we stop suggesting it on that kind of device. On iPhone the home-screen icon and Safari do not share cookies, so keeping this on your account is the only way Safari can know. |
| Paid subscription (if you have one) | The customer and subscription numbers our payment partner gives us, which plan you are on, monthly or yearly, the subscription status (for example "cancelled" or "payment failed") and when the current period ends. We use it to decide which features you get and to send you straight to the page where you manage your subscription. We never see or store your card number — payment details stay with our payment partner. |
iOS/26.0 dataaccessd).The calendar-fetch item exists to answer one question: did it actually connect? Without it the creator is guessing, and “thinking someone will be reminded when they won't” is the worst way this product can fail. We cannot see anything in their calendar, and we cannot see whether they turned notifications on.
What you type in: title, notes, category, dates and times, who it is for, who can see it, whether it appears on the shared calendar, and who ticked it off on what day.
This content is delivered as written to the recipients you choose — that is the whole point of the product. So please remember: what you type, they will read.
All of the cookies below are needed for the site to work. None of them is for tracking, and none of them comes from a third party. (The cookies Google sets on the public pages are covered at the end of this section.)
The ones that stay:
sid | Remembers that you are signed in. |
|---|---|
gid | Remembers which group you are looking at. |
lang | Remembers the language you chose. |
tz | Remembers that your time zone has already been sent, so your browser does not send it on every page. |
pwa | Remembers that Turnabee is already on this device's home screen, so we stop suggesting it. |
The ones that last minutes and then disappear (signing in, and connecting Google Calendar):
next | Takes you back to the page you were heading to after you sign in. 10 minutes. |
|---|---|
oauth_state | Confirms that the return from Google sign-in is the same trip, so nobody else can hijack it; on a first sign-up it also carries the "where you found Turnabee" label above. 10 minutes. |
gcal_state, gcal_m, gcal_tz | The Google Calendar connection trip: confirms it is the same trip, which recipient it is for, and their time zone. 15 minutes. |
We advertise on Google. To learn whether those ads lead to sign-ups, only the public pages you see before signing in (home, pricing, help, guides, demo, contact, what's new, this policy and the terms) carry the Google tag from Google Ads. It sets cookies in your browser and sends Google which page you are on, whether you arrived from an ad, and basic browser details. How Google uses that information is explained on Google's own page.
No page after you sign in, no recipient page and no calendar subscription carries it — those pages hold your family's names and private links, and none of that goes to any ad service. There is no Google Analytics.
The one exception: the set-up page you see right after signing up with Google (there is no group yet, so no family
names on it) loads the tag once to tell Google that someone signed up, so we know which ad brought them. Your name and
email are not sent. So that this happens only once, we set an ads_su cookie at the moment you sign up; that page
deletes it, and it lasts one day at most. People invited as helpers skip this step.
If you are in the European Economic Area, the UK or Switzerland (or we cannot tell which country you are in), the tag is not loaded at all and nothing is sent to Google. Elsewhere you can turn off personalised ads in Google's ad settings, or have your browser block tracking cookies — Turnabee works just the same.
Each time a browser opens the home page, we add one to a single number for that day. That is all — no cookie, no IP address, no browser details. The number cannot be traced back to anyone. Search engine crawlers and chat-app link previews are not counted.
Other figures, such as how many people have connected a calendar, are worked out directly from the data described above. We do not keep a second copy for analytics.
"Where you found Turnabee" is worked out like this: when you first open the site, your browser checks the address for a
tag such as ?src=, or otherwise which site linked you here (the domain only). The result is kept in your
browser's sessionStorage — not a cookie, never sent to us on its own, gone when you close that tab.
Only when you press "Sign in with Google" for the first time is that label sent, and stored as one field on your account.
This is a feature the creator chooses to use. When you paste in a notice (a school letter, a group chat message) or dictate one, and press "Read it":
| What goes to OpenAI | Only the text you entered, plus today's date and time zone (so that "next Thursday" can be worked out). Email addresses in the text are masked first. Your account, email address, group names, member list and other tasks are not sent, and nothing obtained from Google is ever sent. |
|---|---|
| What we keep | We do not store the full text you entered; it is discarded once it has been read. The list of suggestions the AI reads out (each one's title, date, place, what to bring, and the one sentence from your text it came from) is kept so you can check it. When you press "Create", that sentence is deleted. The whole suggestion list is deleted after at most 7 days (tasks you created stay in your group as usual). We also keep a usage record (when, how much, how long, whether it worked) to count your plan's allowance; it contains nothing you entered. |
| When you use a photo or screenshot | The photo is first made smaller and saved again on your phone; this removes its location, time taken, camera model and similar details before anything is sent. We send the photo to OpenAI to copy the words on it — twice (at two resolutions) — and compare the dates and numbers from both copies, so that you are asked to check any line where they differ. We do not store the photo; it is discarded once copied. The copied words are only put back into the box on your phone, and after you press "Read it" they are handled like the text above. If the photo shows other people's names or faces, those are sent too, so please photograph only the part you need. |
| When you tap 🎤 and speak | (AI assistant, from 14 October 2026) The recording is sent to OpenAI to turn it into text. We do not store the recording or the text; the text comes back to your phone and is handled like the text above. We keep only a record (who, when, how large, whether it worked) to prevent heavy use, and delete it after 30 days. If other people's voices are in the recording, those are sent too. |
| When you import a file | Word, Excel, PDF and text files are read on your device; the file itself is not sent to us or to OpenAI. After you check the text and press "Read", it is handled like the text above. For a scanned PDF, the first 3 pages are turned into pictures on your device and handled like the photos above. The program that reads PDFs (pdf.js) is downloaded to your browser from cdnjs.cloudflare.com; Cloudflare sees your IP address and when it was downloaded, not your file. |
| When you ask a question | For example "What's on today?" or "What does Jamie have tomorrow?": nothing is sent to OpenAI. Our site looks up the answer in your group's data, and reads it out only in your device's own voice. |
Whether or not you have an account, you can leave a message on the Contact page or email us directly. When you do, we receive:
| The email address you give | So we can reply. It is used for that and nothing else. |
|---|---|
| What you write | Whatever you want to tell us. |
| Kind of device | When you use the contact form, the kind of device you sent it from (for example "iPhone" or "Windows") is attached, which helps us find the problem. If you were signed in at the time, your account email and plan are attached too, so we know which account to look at. |
None of this is stored in Turnabee's database. It becomes one email in our inbox, where it stays so we can carry on the conversation; you can ask us to delete it at any time.
Turnabee runs on Cloudflare and stores its data in Cloudflare D1. Beyond the companies below, nobody else receives it:
| Cloudflare | Hosting and database. All data lives here. Every connection passes through Cloudflare, which processes your IP address to deliver pages and block attacks. |
|---|---|
| Sign-in, for creators who choose Google. Also used if you choose to connect Google Calendar (see the next section). Google also provides the ad tag on the public pages (see "Cookies" above). | |
| Resend | Sends the digest email and the sign-in emails. For the digest, only the email addresses of recipients who provided one, and the contents of that email, pass through it; if you sign in with your email, your address and that sign-in email pass through it. If a recipient connected Google Calendar without giving an address and the creator turns the digest on for them, the address used is the one on that Google account. What you send through the contact form (your email address and message) also travels through it to our inbox. |
| Sold through Link, LLC (formerly Lemon Squeezy LLC) | Only if you buy a paid plan. Checkout happens on its site, so your name, email and payment details go straight to it; all it sends back to us is what the "Paid subscription" row above lists. It is the legal seller (Merchant of Record) for the purchase; see the Terms. |
| OpenAI | Only when a creator uses "Read a notice with AI" or the AI assistant, to read the dates and tasks out of that text (or the words in a photo) and to turn 🎤 recordings into text (what is sent is described under "When you use "Read a notice with AI"" above). Under OpenAI's API policy this data is not used to train its models; we have not turned on sharing data with OpenAI, and we ask it not to store the results. OpenAI keeps it for up to 30 days to prevent abuse (longer only where the law requires), then deletes it. |
Turnabee uses Google in two places:
If you choose to connect Google Calendar:
openid, email and
calendar.app.created. The last one means we can
only manage the one calendar Turnabee creates.
Your existing events and other calendars are neither readable nor writable by us.myaccount.google.com/permissions, or delete the calendar itself in Google Calendar.Limited Use: Turnabee's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Everything is served over HTTPS. Calendar subscription URLs are long random strings that cannot be guessed; the creator can give anyone a new one from the People page (the old one stops working immediately), and a group's invite code can be changed at any time. Note though: anyone holding that URL can see what is on it, so treat it like a password.
To stop anyone from guessing invite codes or short links by the thousand, failed attempts are counted using a hash that cannot be turned back into an IP address, kept for about two hours at most and then deleted automatically. We do not store IP addresses ourselves (for Cloudflare's handling while delivering pages, see “Where the data lives, and who can reach it” above).
Turnabee is not a service for children and we do not knowingly collect children's data. A parent can of course add a child's name as a recipient in order to schedule things — that is just a name.
Changes update the date at the top. If a change materially affects how your data is used, we will say so on the site.
For any privacy question, or to request a copy of your data or its deletion, write to hello@turnabee.com.
Questions or ideas? Contact us →