Privacy Policy

This privacy policy is applicable to the Turnia app for mobile devices, together with any related services operated by Jorge Gonzalez (collectively, the "Application"). Jorge Gonzalez is hereinafter referred to as the "Service Provider".

Data Controller Information

Jorge Gonzalez acts as the Data Controller responsible for the processing of your personal data.

Name: Jorge Gonzalez
Email: geoviksoft@gmail.com

For data protection inquiries and to exercise your GDPR rights, please contact the Data Controller using the contact information above.

What information does the Application obtain and how is it used?

Turnia is a tool for healthcare teams to organise their shifts and swap them. To use it you must create an account with your email address and a password, or sign in with a Google or Apple account. The Application processes the following information:

Account: your email address and your account identifier, managed by Firebase Authentication. If you sign up with your email address, your password is stored by Firebase Authentication in hashed form and is never visible to the Service Provider; if you sign in with Google or Apple, the identifier of that account is stored instead.
Profile: your name, your username and the avatar you choose (an animal icon and a background colour).
Groups: the groups you create or join, your role in them (member or admin), and your requests to join.
Shifts and events: the group events you create, take or offer for swap, together with the history of who transferred each shift to whom; and your personal events and event types, including any notes you add to them.
Calendar sharing: the list of users you grant access to your calendar.
Preferences: the colours you choose for event types and whether notifications are enabled.
Device and push: a push notification token for each device you sign in on.
Subscription: whether you have an active premium subscription, as verified with the Google Play or App Store receipt. Payment details are handled entirely by Google or Apple; the Service Provider never receives your card data.

This information is used only to provide the Application: showing your calendar and your groups' calendars, keeping the record of shift swaps, notifying the people involved in a change, and managing your subscription. The Service Provider does not sell your personal data and does not send you marketing communications.

Who can see your information inside the Application?

Any signed-in user of the Application can see your name, username and avatar, so that they can find you, and the list of users you share your calendar with.
Members of a group you belong to can see the group's events, including yours and their swap history. Group event documents never contain your private notes.
Users you grant access to your calendar can see all your events, across groups, including your personal events and their notes. You can revoke this access at any time.
Your email address, push tokens, preferences and subscription status are visible only to you.

Push notifications

The Application sends push notifications, through Firebase Cloud Messaging and Apple Push Notification service, to tell the people involved about relevant changes, such as a shift you offered being taken or a join request being answered. You can turn them off in the Application's settings or in your device's settings.

Advertising and subscriptions

Users on the free plan see a banner ad served by Google AdMob. To show and measure ads, AdMob collects information such as your device's advertising identifier, your IP address (from which an approximate location is derived), information about your device, and how you interact with the ads. Google processes this data as described in its own privacy policy.

Where the law requires consent for advertising, such as in the European Economic Area, the United Kingdom and Switzerland, Google's consent message (Google User Messaging Platform) is shown when the Application starts, and you must answer it before using the Application. You can agree to personalised ads or refuse them; if you refuse, only non-personalised ads are shown, based on the context and not on a profile built from your data. You can change your choice at any time under Settings → Preferences → Ad privacy, and reset or limit the advertising identifier in your device's settings.

On iOS, the Application does not ask for permission to track you across other companies' apps and websites, so AdMob does not access your device's advertising identifier (IDFA).

Premium subscribers, when subscriptions are available, see no ads. Subscriptions are purchased through Google Play or the App Store and are subject to their terms.

Legal basis for processing your personal data

Where the GDPR applies, the Service Provider relies on one or more lawful bases to process your personal data, including:

Contract performance: processing necessary to provide the Application or fulfil a contract with you.
Consent: where you have given explicit consent to processing, including for personalised advertising, analytics, or optional features. You may withdraw consent at any time without affecting processing that occurred before withdrawal.
Legitimate interests: where processing is necessary for the Service Provider's specific legitimate interests, such as maintaining network and information security, preventing fraud and abuse, or improving the Application's core functionality through analytics, provided those interests are not overridden by your data protection rights or fundamental freedoms.
Legal obligation: to comply with laws or government requests.

Cookies and similar technologies

The Application or its third-party SDKs may use cookies, SDKs, pixels, and similar technologies to support functionality, analytics, and service delivery. Where required by law, the Service Provider will obtain your consent before using non-essential tracking technologies.

Automated decision-making and profiling

If the Application uses automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you, you have the right to request human review, express your point of view, and contest the decision. Information about the logic involved and the likely consequences of that processing will be provided where required by law.

What information does the Application collect automatically?

In addition, the Application may collect certain information automatically, including, but not limited to, the type of mobile device you use, your mobile device's unique device ID, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browsers you use, and information about the way you use the Application.

Does the Application collect precise real time location information of the device?

This Application does not gather precise information about the location of your mobile device.

Does the Application use Artificial Intelligence (AI) technologies?

The Application does not use Artificial Intelligence (AI) technologies to process your data or provide features.

Do third parties see and/or have access to information obtained by the Application?

The Application relies on third-party service providers that process personal data on behalf of the Service Provider in order to run it: Google Firebase stores your account and calendar data and delivers notifications, Google Analytics for Firebase and Firebase Crashlytics collect usage statistics and crash reports to improve the Application, Google AdMob serves the ads shown on the free plan, and Google and Apple handle sign-in and subscription payments. These providers only process the data needed for their service.

International Data Transfers

The Service Provider or its third-party service providers may transfer personal data outside the European Economic Area (EEA). Where such transfers occur, the Service Provider will use an appropriate transfer mechanism required by GDPR Chapter V.

Adequacy decisions by the European Commission
Standard Contractual Clauses (SCCs) approved by the European Commission
Other safeguards or derogations recognized under GDPR Chapter V, including consent where legally permitted

Countries outside the EEA may not provide the same level of data protection as the EEA. Where required by law, the Service Provider will apply appropriate safeguards and obtain any consent required for the transfer.

Please note that the Application utilizes third-party services that have their own Privacy Policy about handling data. Below are the links to the Privacy Policy of the third-party service providers used by the Application:

The Service Provider may disclose User Provided and Automatically Collected Information:

as required by law, such as to comply with a subpoena, or similar legal process;
when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
with their trusted services providers who work on their behalf, do not have an independent use of the information the Service Provider discloses to them, and have agreed to adhere to the rules set forth in this privacy statement.

Where the GDPR applies, the Service Provider enters into Data Processing Agreements (DPAs) with third-party service providers that process personal data on its behalf, as required by Article 28 of the GDPR. These DPAs impose the same data protection obligations on those service providers as described in this Privacy Policy.

What are my opt-out rights?

You can stop further collection of information from your mobile device by uninstalling the Application. Uninstalling will stop the Application from collecting data from your device, but it does not automatically delete information that has already been transmitted to the Service Provider or to third parties.

To request deletion of your personal data, withdraw consent, or exercise any of your rights, contact the Service Provider at geoviksoft@gmail.com.

What is the data retention policy and how can you manage your information?

The Service Provider retains personal data only as long as it is needed:

Account, profile, groups and preferences: kept while your account exists, and removed or anonymised when you delete it (see Data Deletion).
Shifts, personal events and their history: removed from the servers automatically once the event date is more than one month in the past. After that they are kept only in the local storage of the devices that had synced them, and are removed from a device when the Application is uninstalled or its data is cleared.
Analytics and crash reports: kept by Google for the periods set in Firebase's own retention settings.
Subscription records: kept as long as required by tax and consumer law.

You have the right to request deletion of your personal data at any time, except where retention is required by law. You can also contact the Service Provider at geoviksoft@gmail.com, who will respond within the time required by applicable law.

Data Deletion

You can delete your account at any time from the Application, under Settings → My profile → Delete account. Deletion removes your name, username, avatar, email address, push tokens, preferences, personal events and their notes, calendar-sharing grants and pending join requests, deletes any group in which you are the only member, and finally deletes your sign-in account.

So that other members' shift history stays consistent, group events you created or covered, and their history of transfers, remain in their groups linked to an anonymous identifier that is no longer associated with your name or any other information about you; they are shown as a former member. If you are the only admin of a group with other members, you must first remove its other members or delete the group. If you cannot access the Application, you can request deletion by writing to geoviksoft@gmail.com.

How does the Application address children's privacy?

The Application is intended for healthcare professionals and is not directed at children under 16 years of age, or where a higher age of digital consent is established under applicable law. The Service Provider does not knowingly solicit data from children or market the Application to them.

Where parental or guardian consent is required under applicable law, the Application is not intended for use without that consent. The Service Provider does not knowingly collect personally identifiable information from children under 16 years of age, or where a higher age of digital consent is established by applicable law, in violation of applicable law. In the event the Service Provider discovers that a child has provided personal information, the Service Provider will immediately delete this from their servers. If you are a parent or guardian and you are aware that your child has provided the Service Provider with personal information, please contact the Service Provider (geoviksoft@gmail.com) so that they will be able to take the necessary actions.

How is your information kept secure?

The Service Provider is committed to safeguarding the confidentiality of your information. Data is transmitted over encrypted connections and stored in Google Firebase, where access is restricted by security rules so that each user can only read the data they are entitled to; Firebase App Check helps ensure requests come from the genuine Application. However, no security system can prevent all potential security breaches.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, the Service Provider will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by applicable law. Where the breach is likely to result in a high risk to your rights and freedoms, the Service Provider will also notify you without undue delay, providing information about the nature of the breach, the categories of data affected, and the measures taken or proposed to address the breach.

How will you be informed of changes to this Privacy Policy?

The Service Provider may update this Privacy Policy from time to time. The Service Provider will notify you of material changes by posting the updated Privacy Policy with an effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect.

Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the Service Provider at geoviksoft@gmail.com.

This privacy policy is effective as of 2026-09-15

What are your GDPR data protection rights?

Under the GDPR, you have the following rights:

Right of Access: You can request access to your personal data.
Right to Rectification: You can request correction of inaccurate data.
Right to Erasure: You can request deletion of your personal data (the "right to be forgotten").
Right to Restrict Processing: You can request that the Data Controller limits how they use your data.
Right to Data Portability: You can request a copy of your data in a structured, commonly used, machine-readable format.
Right to Object: You can object to processing based on legitimate interests. You have an absolute right to object to processing for direct marketing purposes at any time.
Right to Withdraw Consent: Where processing is based on your consent, you can withdraw it at any time. Withdrawal is as simple as toggling preferences in the Application's settings or contacting the Data Controller.
Rights Regarding Automated Decision-Making: You have rights related to automated decisions that affect you.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local Data Protection Authority. Contact details for each country's Data Protection Authority can be found at:https://edpb.ec.europa.eu/about-edpb/members_en

If you are located in the United Kingdom, you may contact the Information Commissioner's Office athttps://ico.org.uk

What are your California privacy rights (CCPA/CPRA)?

If you are a resident of California, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information:

Right to Know: You can request disclosure of the categories and specific pieces of personal information the Service Provider has collected about you.
Right to Delete: You can request deletion of personal information the Service Provider has collected from you, subject to certain exceptions.
Right to Correct: You can request correction of inaccurate personal information.
Right to Opt-Out: You can opt out of the sale or sharing of your personal information for cross-context behavioral advertising.
Right to Limit Use of Sensitive Personal Information: You can limit the use of your sensitive personal information to essential purposes.
Right to Non-Discrimination: The Service Provider will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise any of these rights, please contact the Service Provider at geoviksoft@gmail.com. The Service Provider will verify your request using the information you provide and respond within the timeframes required by law. You may designate an authorized agent to make a request on your behalf.

How do you give your consent?

Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases, including contract performance, legitimate interests, or legal obligations, is carried out as described above.

How can you contact the Data Controller?

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at geoviksoft@gmail.com.

To request deletion of your personal data or to exercise any of your rights, contact the Service Provider using the details provided above. The Service Provider will respond within one month of receiving your request, extendable by up to two months where necessary due to the complexity or volume of requests, as permitted by applicable law.

This privacy policy page was generated by App Privacy Policy Generator