Turnoloo Privacy Policy
Last updated: October 23, 2026
This policy describes how data is handled in the “Turnoloo” mobile app for iOS and Android (identifier com.opharana.turnoloo) and on the pages of this website, including the one that shows someone’s shifts through their link (turnoloo.com/c/) (hereinafter, together, “Turnoloo”). The data controller is OPHARANA LLC, located at 99 Wall Street, Suite 1432, 10005, New York (United States), with contact email hello@opharana.com.
1. Summary
- No sign-up. When you open the app, an anonymous account is created (a random identifier). Saving your shifts with Apple, Google or your email is optional.
- Your shifts are seen by the people you choose: the people you share with and whoever has your link. You can stop sharing, turn off your link or change it whenever you want.
- The app shows Google AdMob ads with your consent where the law requires it. Your shifts are not sent to advertising.
- Payments for Turnoloo Plus are processed by Apple or Google; we never see your payment details.
- You can delete your data from the app (section 8).
2. Data we process
2.1. Your account
When you open the app for the first time, an anonymous account is created with our database provider, Supabase: a random identifier and the session data that lets us recognize you. To protect the service, Supabase records the IP address and technical data of connections.
Optional account (“Save your shifts”). If you decide to save your shifts so you don’t lose them when you switch phones, we also process the information you sign in with: with Apple, your Apple ID identifier and the email Apple gives us (it may be a forwarding address if you choose “Hide My Email”); with Google, your account identifier, your email and, because Google sends it, your name and the address of your profile picture (we do not use or show them); with email and password, your email and the encrypted password. If you sign in to an account that already existed, the app brings into it what was in your anonymous account.
2.2. Your name and your shifts
We store the name your people see you by and the color you choose. Of your shifts we store the types you create (name, letter, color and hours), your pattern (what repeats and from which day) and the changes you make to single days. These are work schedules: we do not ask for your employer, your job or your location.
2.3. Your people and your link
Each account has a link with a random code. Whoever opens it sees your name and your shifts, in the app or in the browser. When someone joins through your link in the app, we store that this person sees your shifts and, if they choose, that you see theirs, since when, and when they last looked at them (to notify about changes). If you block someone, we store the block so they cannot enter again with your link.
2.4. Notifications
If you accept notifications, we store your device’s notification token (from Expo, which in turn uses Apple’s or Google’s service), the platform and your language, to notify you when someone in your people changes their shifts. To group notifications, we keep for a few minutes which days you have changed. The notification says who changed shifts and which days. You can turn them off in the app or in your phone settings.
2.5. Reward for inviting
To apply the promotion of one month of Plus for inviting (details in the Terms), we store who invited you, whether the reward has already been given, how many people you have brought, how many months you have earned and until when your gifted Plus lasts.
2.6. Advertising (Google AdMob)
The app shows ads through Google AdMob: a banner at the bottom of the main screen and, at most, one full-screen ad when you close the “When can we meet?” result. Google may process, among other things, the device’s advertising identifier (IDFA on iOS, AAID on Android), device data, approximate location derived from the IP and interactions with ads, according to Google’s Privacy Policy and its information on how Google uses data when you use partner sites or apps. Neither your shifts, nor your name, nor your people are sent to advertising.
With the app in Spanish, ads of our own from TuIAgencia, the owner’s agency, are also shown; they do not use any personal data.
2.7. In-app purchases (Turnoloo Plus)
All purchases are processed by Apple (App Store) or Google (Google Play). We do not receive or store your card or billing data. To validate the purchase, restore it and apply its benefits on the server we use RevenueCat, which receives your Turnoloo account identifier and the store receipt, and tells us what you have bought and until when it lasts. We store only that.
2.8. Your phone’s calendar (Plus)
If you turn on “In your phone’s calendar”, we create a secret address that your phone’s calendar uses to download your shifts. Whoever has that address can see them; you can remove it in the app whenever you want.
2.9. The website
The pages of this site do not store anything in your browser. The page showing someone’s shifts (turnoloo.com/c/) only shows what that person shares with their link.
2.10. Messages
If you write to us at hello@opharana.com, we process your email and whatever you tell us in order to assist you.
3. Purposes and legal bases (GDPR)
| Purpose | Data | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Creating your account and keeping your session | Identifier, session data and, if you save it, those of Apple, Google or your email | Performance of a contract (6.1.b) |
| Storing your shifts and showing them to whoever you choose | Name, color, types, pattern, days and the people you share with | Performance of a contract (6.1.b) |
| Calculating the days you are off at the same time | The shifts of the people you choose (on your phone) | Performance of a contract (6.1.b) |
| Sending change notifications | Notification token, platform, language and changed days | Consent (6.1.a), through the system permission |
| Applying the promotion for inviting | Who invited you, counts and dates | Performance of a contract (6.1.b) |
| Applying purchases and their benefits | Identifier, receipt, product and end date | Performance of a contract (6.1.b) |
| Personalized advertising | Advertising identifier and the data in section 2.6 | Consent (6.1.a), through Google’s form (UMP) and, on iOS, the tracking permission (ATT) |
| Non-personalized advertising | Limited technical data | Legitimate interest (6.1.f) or limited consent, depending on your choice |
| Protecting the service against abuse | IP, technical data and usage counts | Legitimate interest (6.1.f) |
| Handling inquiries and rights requests | Email and content of the message | Legal obligation (6.1.c) and legitimate interest (6.1.f) |
4. Advertising and your consent
- EEA, United Kingdom and Switzerland: before any Google ad is loaded, the app shows Google’s consent form (UMP). If you decline personalized advertising, ads are not personalized.
- iOS: also, Apple’s tracking prompt (ATT). If you do not authorize it, the IDFA is not used.
- Changing your mind: in the app, You → “Ad privacy” or “Personalized ads”; or in the system settings.
- With Turnoloo Plus or with the Plus gifted for inviting, the app does not load advertising.
5. Recipients of the data
| Provider | Role | More information |
|---|---|---|
| Supabase | Accounts and database, in the European Union (Ireland) | supabase.com/privacy |
| Apple / Google Play | App distribution, optional sign-in, purchases and delivery of notifications | apple.com/legal/privacy · policies.google.com/privacy |
| Google (AdMob / UMP) | Advertising and consent management | policies.google.com/privacy |
| RevenueCat | Validation and restoration of purchases | revenuecat.com/privacy |
| Expo | App updates and delivery of notifications (it receives the token and the text of the notification) | expo.dev/privacy |
| Vercel | Hosting of this website and of the processes that send notifications | vercel.com/legal/privacy-policy |
In addition, your name and your shifts are seen by the people you share with and whoever has your link. We do not sell your data or share it with any third parties other than those listed.
6. International transfers
The database is on Supabase servers in the European Union (Ireland). The controller is in the United States, and some providers (Apple, Google, RevenueCat, Expo and Vercel) may process data outside the European Economic Area. These transfers are covered by the European Commission’s Standard Contractual Clauses and/or adequacy decisions (such as the EU-US Data Privacy Framework).
7. Retention
Your data is kept for as long as you use Turnoloo. Changes to past days are deleted after 400 days. Notifications already sent are deleted after 30 days. Data processed by Google, RevenueCat and Expo is kept according to their own retention periods.
8. How to delete your data
From the app: You → “Delete my data”, with confirmation. Once you confirm, immediately and permanently the following are deleted:
- your name, your shift types, your pattern and your days;
- your people (you stop seeing and showing shifts), your link and your blocks;
- your phones registered for notifications and the promotion data;
- your account (anonymous, Apple, Google or email), unless you also use it in another OPHARANA LLC app, in which case only the Turnoloo data is deleted.
What you bought in the store is not lost: you recover it with “Restore purchases”. Deleting your data does not cancel the subscription, which is managed through Apple or Google.
If you cannot use the app, write to us at hello@opharana.com from your account’s email, or with your Turnoloo link, and we will delete it ourselves.
9. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing, portability and withdrawal of consent by writing to hello@opharana.com. We will reply within one month. You can also lodge a complaint with the supervisory authority; in Spain, the Spanish Data Protection Agency (aepd.es).
10. Minors
Turnoloo is for people over 16 years of age (it is a tool for organizing work shifts); it is not aimed at children and we do not knowingly collect data from minors under that age.
11. Security
Communications are encrypted (TLS). The database cannot be read directly: the app only uses functions that check your session on every call, and each person only receives the shifts that someone has decided to show them. Links carry random codes and attempts to guess codes are throttled.
12. Changes to this policy
If we modify it, we will publish the new version at this same address (https://turnoloo.com/en/privacidad) with its date. Substantial changes will be announced in the app.
13. Language
This policy is published in several languages. In case of discrepancy, the Spanish version prevails.
14. Contact
OPHARANA LLC
99 Wall Street, Suite 1432, 10005, New York, United States
hello@opharana.com