Privacy policy
Last updated:
This policy explains what TurnDisk stores, why, who can see it and how long it’s kept. TurnDisk is run by . If anything here is unclear, contact us.
The short version
- Your files are stored with Cloudflare, which encrypts them at rest. TurnDisk staff never see what’s inside your files.
- You sign in with Google, Apple, or your email address and a password. With Google or Apple, TurnDisk never sees your password. With email, Google Firebase keeps your password scrambled so that nobody, including us, can read it, and our servers never receive it.
- We don’t sell your data, and we don’t show ads.
- You can export a copy of your files or delete your account at any time.
What we store, and why
| What | Why |
|---|---|
| Your files’ contents | To store them and give them back to you on your computers. Kept with Cloudflare. |
| File and folder names, sizes, dates and earlier versions | To show your drive, keep your computers in step and let you restore files. |
| Your Google or Apple account ID, the email address it gives us, and whether that address is an Apple private relay address | To sign you in and to link your Google and Apple sign-ins to one account if you choose. |
| If you sign in with email: your email address, whether you’ve confirmed it, and a sign-in ID | To sign you in, and to send you the emails that confirm your address or reset your password. |
| Your computers: their name, type, and when each was last seen | To show you which computers are signed in and let you sign one out. |
| Your plan and subscription: plan, period, status, dates, and Razorpay’s reference numbers | To give you the space you’ve paid for and to manage renewals and cancellations. |
| A security log of sign-ins, account links, sign-outs and staff actions | To keep your account safe and to investigate problems. |
Our servers never receive your password, and we don’t receive your full card or bank details: payments are handled by Razorpay.
On your own computer
The TurnDisk app keeps some things on your Mac so that it’s fast and works offline: parts of files you’ve opened (in a cache with a size limit you control), files you’ve chosen to keep offline, the list of your files, and changes waiting to upload.
This website keeps a random device ID in your browser’s local storage, and your sign-in for the current tab in session storage, which is cleared when you close the tab. It doesn’t use advertising or analytics cookies.
Who can see what
- You can see all your own files. Nobody else’s.
- TurnDisk staff can see your account details, how much space you use, your computers, and the names and sizes of your files and folders, so that we can help when something goes wrong. They can’t see what’s inside your files. Every time staff look at file names, or delete files at your request, it is recorded in the security log.
- The companies TurnDisk is built on process data for us, under their own security and privacy terms:
- Cloudflare stores your files’ contents, encrypted at rest;
- Microsoft Azure runs our servers and stores your account and file information;
- Google Firebase handles sign-in, with Google, Apple or your email address and password. For email sign-in it keeps your password scrambled, and sends the emails that confirm your address or reset your password;
- Razorpay processes payments.
TurnDisk does not offer end-to-end encryption. Your files are encrypted when stored and when sent over the internet, but they are not encrypted with a key that only you hold.
We share information with authorities only when the law requires it.
How long we keep things
| What | How long |
|---|---|
| Deleted files (Trash) | 30 days, then permanently deleted |
| Earlier versions of files | 30 days, then permanently deleted |
| Uploads that never finished | 24 hours, then deleted |
| A deleted account | Your sign-ins are removed from TurnDisk straight away. Your files and their information are permanently deleted within about an hour. If you signed in with email, ask us and we’ll also delete your email sign-in from Google Firebase. |
| Security log | |
| Payment records | As long as tax and accounting law requires |
Your choices and rights
- Get a copy: in the TurnDisk app, Settings, Account, “Export a copy of all files”.
- Delete your account: in the TurnDisk app, Settings, Account, “Delete my TurnDisk account”. The app signs in with Google or Apple only, so if you use email sign-in, contact us to get a copy or to delete your account.
- Sign out a computer: see the computers signed in to your account and sign one out.
- Correct your details: file names are yours to change; your email address comes from Google or Apple, or is the one you signed up with.
- Anything else, such as asking what we hold about you: contact us. You may also have rights under data protection laws where you live, such as India’s Digital Personal Data Protection Act or the GDPR.
If something goes wrong
If there’s a security incident that affects your data, we’ll act to contain it, and we’ll tell affected users and, where the law requires, the regulator.
Children
TurnDisk isn’t meant for anyone under 18 without the permission of a parent or guardian.
Changes to this policy
If we change this policy in a way that matters, we’ll tell you before the change takes effect.
Contact
, . Our postal address is on the contact page.