Privacy: what is stored, where and for how long
Exactly what Turnchores stores on its server, where it is kept, for how long, what stays on your device, and how to export and delete it.
Last updated 28 October 2026
In short: Turnchores stores unit nicknames, items, intervals, done marks with the cleaner link label, and supplies on Cloudflare D1, region not pinned, until you delete them. Deleted units go 7 days after you delete them. There is no guest data.
Where it is kept
Units, jobs, marks and accounts are kept in one Cloudflare D1 database that belongs to this site. Cloudflare chooses where the database lives; the region is not pinned, so it may be outside your country. The pages themselves are static files served by Cloudflare Pages.
What is stored for an owner
- A random account id, the account name you chose for your passkey manager (or Turnchores owner), your time zone, and when the account was made.
- For each passkey: its public key, its id, a signature counter, the name you gave it and when it was added and last used. Never a fingerprint, a face or any biometric data: those stay on your device.
- A scrambled form (SHA-256) of your recovery code. The code itself is shown to you once and not kept.
- For each signed in device: a scrambled form of its session id, and when it was made, last used and when it expires (90 days after the last use, counted a day at a time).
- Your email address, only if you add one, whether you confirmed it, and a scrambled form of the confirmation link while it is waiting. It is the one place an email address is ever stored, and it is used only for the Monday email.
- Each unit: its nickname (not an address), its time zone, the next check-in date you type, and when it was made and changed. No guest names, bookings or contact details: only that one date.
- Each job: its title, its interval, its first due date, your note for cleaners, whether cleaners see it, and its place in the list.
- Each done mark: the job, the day it was done, when it reached the server, whether the host or a cleaner link made it with that link's label, an optional note, and whether it was undone and by whom (host or cleaner). No photos.
- Each turnover: the day, the time and the link label that recorded it. Each supply: its name, the amount you typed and whether it is running low.
- The Monday emails for you, and a record of each email sent, kept 30 days.
What is stored for a cleaner
- Nothing about the person: no name, email address, phone number or account. Their ticks are stored as done marks with the label you gave the link.
- For each cleaner link and calendar feed: a scrambled form (SHA-256) of its secret, plus a sealed copy that only this server can open with its own secret key, so you can see the link again, and when the link was last used.
Limits on how fast requests come
To stop a link being flooded, the server counts writes per link and per network address in hourly buckets. The address is stored only as a keyed scramble that cannot be turned back into the address, and each bucket is deleted after 2 hours. Network addresses are never written to logs.
How long it is kept
- Your account, units, jobs and marks: until you delete them.
- A deleted unit: 7 days, while it can be restored, then deleted for good with its jobs, marks and links.
- An undone mark: 30 days after it was undone.
- A deleted account and everything in it: 7 days, while you can sign in and cancel, then deleted for good.
- Sessions: until 90 days after the last visit on that device, or until you sign out.
- Passkey sign in requests: 5 minutes. Rate limit buckets: 2 hours. Email records: 30 days.
What stays on your device
A cleaner's ticks are kept in the browser's local storage under keys beginning with rentalupkeep until the server confirms them, so a tick made with no signal is not lost while that storage works; the nickname of a new unit a host is typing is kept the same way. The secret part of a cleaner link sits after the # sign, which browsers do not send to any server in the address.
How to see and delete it
On your account page, Download everything gives one file with all of it, and each unit's history can be downloaded as a CSV. Delete my account removes everything after the 7 days above; you can also undo single marks and delete single units. Requests by email go to [email protected].
Cookies
One cookie, and only for owners who sign in: a session cookie that keeps you signed in. It cannot be read by page scripts and is never sent to another site. Cleaners get no cookie.
Page counts
Visits may be counted by Cloudflare's own page counter, which sets no cookie and records that a page was opened, never what you typed. There is no other analytics.
Payments
No paid plan is offered at present; if one is added, this page will describe it.
Only owners can receive email: one confirmation link to an address they added, and then, once confirmed, the Monday email. Nothing else is ever sent to an unconfirmed address. Cleaners are never emailed. Emails carry no tracking images.
Typeface
Headings are set in Archivo by the Archivo Project Authors, under the SIL Open Font License 1.1, served from this site. The licence is at /fonts/OFL.txt.
Changes and contact
If this policy changes in a way that affects what is stored, the change will appear on this page. Questions go to [email protected].