Privacy policy

Last updated: October 17, 2026

This is a translation for your convenience. If it differs from the Spanish version, the Spanish version prevails.

1. Who is responsible

Rubén González López (trade name cyrks.), Spanish tax ID 52888925B, Calle Olite 21, 1.º interior derecha, 28039 Madrid (Spain). Contact for anything about your data: hola@turnativo.app.

2. In short

• The app’s personal mode sends us nothing: your shifts live on your device, in your iCloud and in your Calendar.
• Team mode stores on our server, in the European Union, only what’s needed for the manager to plan shifts and for each worker to receive them.
• No ads, no analytics, no tracking across apps or websites. We don’t sell data.
• You can delete your account and its data from the app at any time.

3. The app’s personal mode

No account and no connection to our server. Your shifts, rotations and notes are stored on your device and synced with your private iCloud database, which we can’t access. With your permission, the app writes your shifts to the device’s Calendar and, if you turn it on, reads the calendars you choose to warn you about overlaps; that happens on the device and never leaves it.

4. Team mode: what we process

• Your account (managers and workers who sign up): email, display name if you give one and, if you sign in with Apple or Google, the identifier they provide. We never receive your password. Email sign-in codes expire within minutes.
• What the manager enters about the team: team name and time zone; for each worker, their name and, if given, email, department and contract hours; shifts, breaks, vacations and holidays.
• Calendar links: each worker gets a link with a secret identifier that the manager can regenerate at any time.
• Subscription: plan, worker limit, dates and whether it’s paid on the web or in the App Store. We never see your card details.
• “How did you hear about Turnativo?”: your answer, if you give one. It’s optional.
• Technical logs: the IP address and request details stay in the server logs for security and troubleshooting, for up to 30 days.

We don’t ask for workers’ ID numbers, health data or location.

5. Who decides about team data

Workers’ data is decided by the manager’s company or organization, which is its controller. Turnativo acts as a processor (Article 28 GDPR): we process it only to provide the service and following their instructions, under the “Data processing” section of the terms. For your own account and billing data, we are the controller.

6. Why, and on what legal basis

• Providing the service: accounts, teams, schedules, calendars, invitations and service emails (performance of a contract).
• Charging the subscription and meeting tax and accounting duties (legal obligation).
• Protecting the service from abuse and solving problems (legitimate interest).

We don’t send marketing messages or make automated decisions about you.

7. Providers that help us

• Railway: server and database, hosted in Amsterdam (Netherlands).
• Cloudflare: the domain and protecting the website from attacks. Traffic goes through its network (IP address and the request), but it doesn't store or analyse your data for anything else: no analytics, no advertising. It also keeps, in the European Union, the database backups, encrypted with a key only we hold and deleted automatically after 30 days.
• Resend: sending the service emails, from Ireland.
• RevenueCat: subscription management (team identifier and purchase history).
• Stripe: web payments (email, payment and billing details).
• Apple: App Store purchases, Sign in with Apple and iCloud.
• Google: Sign in with Google, if you choose it.

All of them process data on our behalf. Some are based in the United States; the service’s data is stored in the European Union, and any access from outside it is covered by the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

8. How long

• Your account, while it exists. When you delete it, it’s removed from the database right away; backups roll over within 30 days.
• Team data, until the manager deletes it or deletes the team.
• Invoices and billing data, for as long as the law requires (up to 6 years).
• Emails you send us, up to 24 months to handle your request.

9. Deleting your account

In the app: Settings › Account › Delete Account. You can also ask at hola@turnativo.app. This deletes your account, your sessions and the teams where you’re the only admin, with their workers and schedules. If you pay for a subscription, cancel it first where you bought it: deleting the account doesn’t cancel it.

10. Your rights

You can request access, rectification, erasure, objection, restriction and portability of your data by writing to hola@turnativo.app. If you’re a worker on a team, also contact your employer, which is the controller; we’ll help them handle the request. If you think we haven’t done it right, you can complain to the Spanish Data Protection Agency (aepd.es).

11. Security

All connections are encrypted. Sessions expire and renew, the app keeps its credentials in the device Keychain, and calendar and invitation links are secret and revocable.

12. Cookies and browser storage

turnativo.app doesn’t use analytics or advertising cookies, so we don’t ask for consent. It only stores what the site needs to work:

• Session: a cookie that keeps you signed in to the dashboard. Only our server reads it, and it’s removed when you sign out.
• Language: a cookie with the language you pick, if you change it.
• Preferences: in your browser’s local storage, the light or dark theme, whether you’re signed in and, if you came from the app, that answer already suggested in “How did you hear about Turnativo?”. It never leaves your browser.

Our pages don’t load anything from Google or Apple. Only if you choose to sign in with one of them do we take you to their sign-in page, which follows its own policies and cookies. You can also sign in with a code by email.

13. Children

Turnativo is a work tool and isn’t directed at children under 14.

14. Changes

If we change this policy in a meaningful way, we’ll give reasonable notice through the service’s channels.