Privacy Policy

Last updated: 2026-10-27

1. Data controller and scope

Data controller: Giacomo Cacciatore — e-mail info@turnix.ch. For postal requests, write to this e-mail address to receive the postal address. We respond to privacy requests within 30 days.

Turnix is reserved for people who are at least 18 years old. The app does not verify age.

Turnix can be used in the European Union (27 Member States), in the European Economic Area (Norway, Iceland, Liechtenstein), in Switzerland and in the United Kingdom. This policy follows the General Data Protection Regulation (GDPR, EU 2016/679), the UK GDPR with the Data Protection Act 2018 and the Swiss Federal Act on Data Protection (nFADP) with its ordinance.

2. Data we process

Account (on the Supabase server). E-mail address; the password, if you register with e-mail and password (Supabase's authentication service does not store it in plain text, only as a cryptographic fingerprint from which the password cannot be derived); the name you enter when registering; the name you choose from the list in the PDF to recognise your row; the calendar mode (PDF or manual); the status of the intro guide and of the Legend; the start date of the trial period and whether you have already used it; if you have received Premium days through invitations, the date until which they are valid. If you sign in with Google, Google provides Supabase with your e-mail, your name, the identifier of your Google account and the address of your profile picture (the app does not show the picture); on iPhone, if you sign in with Apple, Apple provides Supabase with your e-mail (or Apple's anonymous address, if you choose it) and an identifier of your Apple account. On the phone, the sign-in session is kept in the system's secure storage.

Shifts (on the Supabase server). For each day: date, shift code (read on the phone from the PDF cell, which the app saves as a hidden label while showing you the image of the cell, or the type you choose if you enter shifts manually), times, notes, status, a fingerprint of the cell image (pHash, to recognise identical or changed shifts) and the path of the image file on the phone; if the cell changes, also the previous code, fingerprint and path. The cell images stay on the phone and do not go to the server. The PDF you load, which also contains the names and shifts of colleagues, stays in the PDF archive on the phone until you delete it or load another PDF for the same month, and is not uploaded to the server. To find your row, the app reads on the phone the names of all the people in the PDF (from the text of the PDF or, if needed, with Google ML Kit): your colleagues' names do not leave the phone; yours, the one you choose, goes to the server (see "Account"). For the technical data that ML Kit sends to Google, see section 5.

Shift names and times. Shift types created manually (name, times, break, colour, icon and description) are saved on the Supabase server. The names and times you give to shift types in the Legend stay on the phone, but for each day with a name the app saves on the server a "derived shift" (name and times of that day's shift), which is used for sharing with colleagues and, if you connect it, for Google Calendar: the app updates it at every launch, even if you do not share your shifts with anyone.

Agenda, alarms and to-dos (on the Supabase server). Personal events (title, notes, colour, times, reminders), to-do lists (text, done, order; the text is not encrypted by the app), alarms, alarm rules and skipped days.

Sharing with colleagues. If you invite a colleague and they accept, they see your derived shifts (name and times) and your name, until you revoke the invitation; their phone also receives the identifier of your account and, if you use Google Calendar, the Google identifiers of those shifts, which the app does not display. Likewise, if you accept an invitation, the person who invited you receives the identifier of your account.

Push notifications. The app asks for permission for notifications and saves on the server the phone's code for push notifications (Firebase Cloud Messaging, which on iPhone goes through Apple's notification service), for every user who signs in; today only team notifications use it. The code is deleted with "Delete account" (not with "Sign out"). For notifications, the Firebase library also creates a random identifier of the app installation (Firebase Installation ID), which it registers with Firebase when the app starts and which, according to Google, identifies neither you nor the phone.

Server logs. When the app connects to Turnix's servers (Supabase and the invitation server on Google Cloud), the providers record, for security and operation, the technical data of the connection, including the IP address and the time (see section 4 for how long).

Invitations. The iPhone app does not have the "Invite friends" section: on iPhone no invitation code is created, shared or used. If, with the same account, you received Premium days through invitations, the iPhone app reads from the server how many days you received and until when they are valid, to know whether Premium is active.

Subscription (App Store and RevenueCat). The subscription is bought through Apple's App Store, which handles the payment: Turnix does not receive the details of your payment method. To show you the price and to know whether you have Premium access, the app uses RevenueCat: when the app starts and at every sign-in it sends RevenueCat the identifier of your Turnix account (not your e-mail or your name), even if you do not buy anything. RevenueCat also receives the history of your Turnix purchases on the App Store, technical data of the phone (for example the model and the iOS version), the identifier that iOS assigns on the phone to the apps of the same developer (identifierForVendor), the preferred languages, the currency and the country of your App Store.

Google Calendar (only if you connect it; Premium feature). With "Connect Google Calendar" in Settings, Google asks you to allow Turnix to see and edit the events on all your calendars and to see the list of calendars you are subscribed to (scopes "calendar.events" and "calendar.calendarlist.readonly"). From then on, the app writes your Turnix events (title, notes, date, times) and your derived shifts (name and times) to your Google Calendar, with a technical code used to recognise them. In the months it synchronises, it reads the events (title, description, date, times, reminders) of the primary calendar, of the Birthdays calendar (your contacts' birthdays, even if you have hidden it) and of the other calendars in your list, for example Holidays and the calendars that other people share with you: none of them can be excluded. It copies them into Turnix as events, with the name of the calendar they come from in the note: like the other events, they are saved on the Turnix server (Supabase). To the events of the primary calendar that it copies, the app adds on Google a technical code, not visible in the calendar, to recognise them. Deletions of events of the primary calendar and of those written by Turnix are carried over from one side to the other. Synchronisation starts after the app is opened and when it returns to the foreground, after you create, change or delete an event, and when you request it; you can pause it in Settings. No health data goes to Google. The access keys to Google are kept on the phone, in the part of the iOS Keychain reserved for Turnix, by Google's sign-in library included in the app, which deletes them when "Disconnect" revokes access; on the phone the app keeps the address of the connected Google account, the time of the last synchronisation, the identifiers of the synchronised events and, for the derived shifts already written, their name and times; on the server it keeps the Google identifiers of the derived shifts. "Disconnect" revokes access and deletes this data from the phone; events already copied stay in Turnix until you delete them, and those already written stay in your Google Calendar. Turnix's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Health (only on the phone). Sleep, Wellbeing and Reminders are turned on together with the "Health" switch in Settings (or from the Companion, with the same dialog). Reminders (title, note, times and, if you mark it, "Done" or "Skipped") are a generic feature and are turned on without consent; Sleep and Wellbeing only if, in the activation dialog, you tick the box for explicit consent to sleep and wellbeing data. Cycle is turned on separately, with the "Cycle tracking" switch (or from the Companion) and its own consent. They are all off until you turn them on. See section 2.1.

Insights (only on the phone). If you opt in with a separate consent (the second box in the "Health" dialog or the "Insights" row in Settings), the app compares on the phone your shifts of the last 90 days with the sleep, wellbeing and cycle data and shows you averages (for example, how much you slept on average on days with a night shift compared with days off). This is a form of profiling (Art. 4(4) GDPR) that does not produce decisions with legal effects concerning you (Art. 22 GDPR does not apply): the results stay in memory, are not saved and do not leave the phone. You can withdraw consent at any time from the "Insights" row, without turning off the other modules.

Error diagnostics (Sentry). When the app crashes or runs into an error, Sentry receives a technical report containing only the following data: date and time of the error; type and text of the error and stack trace of the code in which it occurred, with the memory addresses of the code; version of the app and of the tools it is built with, whether it is a test or published version and whether it was in the foreground; operating system, its version and whether it has been modified (rooted); model, brand and technical characteristics of the phone (screen dimensions in pixels and orientation, processor, total memory, whether the memory is almost full, whether a network is available and of what type, whether it is an emulator); language, time zone and time format; the status, granted or not, of the permissions that the app requests; the names of the screens opened before the error, with date and time; for synchronisation errors, the table and the operation involved (without data); random codes that distinguish the report and the opening of the app in which it originated. Any other data that the libraries would add is removed before sending: the reports do not contain any identifiers of yours or of the phone, nor the accessibility settings. From the text of the errors, the app removes the identifiers of the account and of the data rows (the long codes in UUID format), the e-mail addresses, the values of the database operations and the calendar dates; the texts written by you cannot in general be recognised: if an error message contained, for example, the name of a shift, it would remain. As the user, the app specifies a fixed identifier, the same for everyone, and a fictitious IP address, and Sentry is set up not to store IP addresses. The app discards the reports in which the error message, the error details or the steps recorded before the error contain one of the words of a fixed health-related list, in Italian and English (for example the words for cycle, sleep, wellbeing and reminder), and removes the paths of the shift images from the others. With the symbols of the app version, the names of the parts of the code can be reconstructed from the stack trace: a report may therefore show in which part of the app the error occurred (for example the cycle part), without the data. Reports of the crashes of the app's native code do not go through these filters: they also contain other technical data that the Sentry library collects and they may contain a random identifier of the app installation and, if the crash happens in the first moments after the app starts, the approximate city derived from the IP address of the connection. The app also sends, at most once a day for each account, a data integrity check report: counts (numbers only, no dates, no names) with the same technical data as the error reports.

Exports. The images (of the month or of a shift), CSV files and PDF reports you create go only to the apps you choose.

Phone log. In the published version, Turnix's code does not write any lines to the phone's system log; technical lines from the system, from the app engine (Flutter) and from some libraries may appear, for example at start-up and while reading PDFs.

2.1 Data concerning health (only on this phone)

Sleep, wellbeing and cycle data are data concerning health (special categories of data, Art. 9 GDPR; sensitive personal data under the nFADP). Reminders are generic, but they may contain such data if you write it yourself in the title or in the note: for this reason they have the same protections.

This data stays only on the phone: it does not go to the Turnix server or to third parties, and there are no copies of it in the Turnix cloud. On the phone, the contents are encrypted with AES-256-GCM, with a key kept in the system's secure storage: cycle flow and notes, sleep times and quality, wellbeing mood, symptoms, energy and notes, reminder title and note. The following remain unencrypted in the app's private storage: the dates of the entries (for the cycle, therefore, the days marked), the reminder times and the "Done" or "Skipped" mark, where each night of sleep comes from (entered by hand, estimated or confirmed) and the settings. So that notifications arrive even after a restart, the phone keeps in plain text, in the app's private storage, the text of the notifications already scheduled (for example the title of a reminder or a cycle notice), until they arrive or are cancelled; notifications are also visible on the lock screen, if the phone's settings allow it.

Turning off the "Health" switch deletes the sleep, wellbeing and reminder data from the phone and withdraws consent to Insights; turning off "Cycle tracking" deletes the cycle data.

3. Purposes and legal bases

For Switzerland: performance of the contract, legitimate interest and consent (Art. 31 nFADP).

4. How long we keep the data

5. Providers (processors)

The purchase and payment of the subscription are handled by Apple through the App Store, under Apple's terms and privacy policy.

No data is sold or used for advertising.

5.1 Cookies and local storage

The app does not use cookies. On the phone it stores: the database with your data, the cell images, the day images for the widget and the PDFs, the secure storage with the session and the encryption key, the queue of changes to be sent to the server, the preferences, the text of the notifications already scheduled, some diagnostic counters, the data that the Firebase, Sentry and RevenueCat libraries keep in order to work and, if you connect Google Calendar, the synchronisation data described in section 2. They are necessary for the app to function.

The turnix.ch website does not use analytics tools or profiling cookies.

5.2 Data protection officer and impact assessment

Turnix is not required to appoint a data protection officer (Art. 37 GDPR). For the health modules and for Insights, a data protection impact assessment (DPIA, Art. 35 GDPR) has been carried out. For any request about data protection, write to info@turnix.ch: we respond within 30 days.

6. Transfers outside the EU, EEA, Switzerland and the United Kingdom

7. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and you can withdraw your consents at any time (Art. 15-22 GDPR and UK GDPR; Art. 25-32 nFADP). Turnix does not make automated decisions with legal effects concerning you (Art. 22 GDPR).

In the app:

For anything else, write to info@turnix.ch.

8. Supervisory authorities

You have the right to lodge a complaint with the supervisory authority of your country of residence or habitual residence. Below is the list of the 32 competent authorities in the jurisdictions where Turnix is available.

European Data Protection Board (EDPB) — official up-to-date list of all EU+EEA authorities: edpb.europa.eu/about-edpb/about-edpb/members_en

── European Union (27 states) ──

── European Economic Area (EEA, 3 non-EU states) ──

── Switzerland ──

── United Kingdom (UK post-Brexit) ──

9. Security

Communications are encrypted (HTTPS/TLS). On the server, each user accesses only their own data (Supabase Row Level Security), except colleagues who have accepted an invitation from you, who see your derived shifts (name and times) and your name. The person who invites and the person who is invited, to shift sharing or with an invitation code, may also receive the identifier of the other's account, which the app does not display.

Personal data breach notification: in the event of a personal data security breach posing a risk to the rights and freedoms of the user, Turnix will notify the competent supervisory authority of the user's country of residence within 72 hours of discovering the breach, under Art. 33 GDPR / UK GDPR and Art. 24 nFADP. Where the breach is likely to result in a high risk to the rights and freedoms of the affected users (Art. 34 GDPR), Turnix will communicate the breach directly to users without undue delay, in clear and plain language, indicating: the nature of the breach, the data and categories affected, the likely consequences, the measures taken or proposed to mitigate the effects, and the contact point info@turnix.ch.

10. Changes

When this policy changes, we update the date at the top and, the first time you open the app after the change, the app tells you with a notice that leads to this page.