Privacy Policy

Last updated: 30 October 2026

Anna Kryvokhat (os. Jana III Sobieskiego 40/2N, 60-688 Poznań, Poland, Działalność nierejestrowana (art. 5 Prawa przedsiębiorców)) is the controller of personal data processed by Turbogen. This policy explains what we collect and why, in line with the EU General Data Protection Regulation (GDPR).

What we collect

• Account data: e-mail address, a normalised form of it used to prevent duplicate accounts, and a password hash (we never store your password itself).
• Usage data: generation history (prompts, settings, files you upload, results), credit transactions.
• Payment data: handled by Stripe; we receive only the payment status, amount and country, never full card numbers. With each order we store the time and version of the consent you gave at checkout.
• Safety data: when our automatic checks refuse a prompt or upload, we store the refused text, the rule that matched, your account id and IP address.
• Technical data: IP address, browser user agent and session cookies, used for sign-in, security and abuse prevention (for example sign-up limits per network).
• Two-factor sign-in (optional): the secret key of your authenticator app and hashes of your recovery codes, kept only while two-factor sign-in is on.

Usage analytics

Every visitor is counted anonymously by Rybbit, an open-source analytics tool we run on our own server (stats.turbogen.app, EU): which pages are opened, from which site or link, the country, browser and device type. It sets no cookies, stores no IP address and does not identify you. If you click "Allow" in the banner, Rybbit also records where you click and anonymised session replays (all form fields and e-mail addresses are masked). Data stays on our server, is not shared or sold, and is deleted after 12 months. You can change your choice any time with "Analytics settings" in the footer.

Sign in with Google

If you choose "Continue with Google", we ask Google only for the basic sign-in scopes (openid and email). From Google we receive your e-mail address, whether Google has verified it, and your Google account identifier. We do not request or receive your name, profile picture, contacts, Gmail, Drive, Calendar or any other Google data.

• How we use it: only to create your account or sign you in to the account with the same e-mail address, and to recognise you the next time you sign in with Google. The e-mail address is also used for the service e-mails described below.
• Storage: the e-mail address and the Google account identifier are stored with your account, on our servers in the EU, for as long as the account exists. We do not keep Google access or refresh tokens: the token from Google is used once at sign-in and then discarded.
• Sharing: we do not sell, rent or share data received from Google with anyone, do not use it for advertising, and do not use it to train AI models. It is not passed to the AI model providers.
• Deletion: deleting your account deletes this data. You can also remove Turbogen's access at any time at myaccount.google.com/permissions.

Turbogen's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Why we use it (legal basis)

• To provide the Service and your account (performance of a contract).
• To prevent fraud, multi-account abuse, illegal content and attacks, including the automatic checks of prompts and uploads (legitimate interest; legal obligations where content is illegal).
• To keep accounting, tax and consumer-law records, such as the checkout consent (legal obligation).
• To send service e-mails such as e-mail confirmation, payment confirmations and important changes. We do not send marketing without your consent.

Who receives it

Only processors we need to run the Service: hosting and network protection (e.g. Cloudflare), payments (Stripe), e-mail delivery (Brevo), sign-in with Google (Google, only if you choose it), and the AI model providers that process your prompt and uploaded files to produce the result. Some of them are outside the EU; transfers rely on the EU Standard Contractual Clauses or adequacy decisions. Where the law requires it, we pass information about illegal content (in particular child sexual abuse material) to the competent authorities. We do not sell personal data and we do not use your content to train models.

Labels in your files

Files we deliver contain a machine-readable "AI-generated" label (see How we label AI content). The label names Turbogen and the model; it does not contain your name, e-mail or account id.

How long we keep it

Generated files and uploads are kept for 7 days after the generation finishes so you can download them, then deleted automatically (earlier if you delete them or close the account); your generation history (prompt, model, cost) stays in the account. Account data is kept while the account is active; payment records and checkout consents for the period required by tax and consumer law. Security logs are kept for up to 90 days; records of refused prompts for up to 12 months, longer only where needed for a report to the authorities or a legal claim.

Cookies

We use only necessary cookies: a session cookie that keeps you signed in and a security token against cross-site requests. No advertising or tracking cookies are set by the studio.

Your rights

You can ask to access, correct, export or delete your data, restrict or object to processing, by writing to [email protected]. You may also complain to your local data protection authority (in Poland: the President of the Personal Data Protection Office, UODO).