Privacy policy

Last updated: 19 October 2026

Turnover is operated by Faran Mahmood, an independent developer based in Lahore, Pakistan ("we", "us"). We are responsible for the personal information processed to provide Turnover. This notice covers the app, our website and support. Contact hello@useturnover.com for privacy questions or requests, including if a housemate added information about you and you do not have an account.

Information and sources

• Account information: email, authentication records, account identifier, display name, optional contact details and preferences that you provide. We also record the version of terms and privacy notice presented, your adult-eligibility affirmation and the server time of explicit acceptance. We do not collect your date of birth or an identity document for this affirmation.
• Shared house records: addresses, memberships and move-in/out dates, deposits, expenses, shared assets, payment references, disputes, notes, settlements, buy-in previews and condition evidence. You or another house member may supply these records, including information about people without accounts.
• Images and files: photographs or receipts you choose to capture or upload, extracted text and draft results. Uploaded content can include names, faces, addresses and other details visible in an image or contained in its metadata.
• Purchases: store and RevenueCat transaction, product, entitlement, renewal and refund information associated with account and house identifiers. Apple or Google handles payment credentials; Turnover does not receive your full card details.
• Technical information: IP addresses and request logs at our hosting providers; app, device and operating-system information; installation identifiers; feature interactions; error, crash and performance information; notification tokens and preferences. Optional app analytics and crash reporting are turned off, and any unsent local crash reports are discarded when the app starts. Push notifications and remote configuration still involve technical connection and installation information.
• Support: your messages and the information you choose to send us to resolve a problem.

Provide only information needed for a shared-house record. Do not upload passwords, complete payment-card or bank-login credentials, identity documents, intimate images or unrelated health and other sensitive information. Avoid including bystanders or private material in photos. You must have an appropriate basis to share someone else's information; another person's consent cannot be assumed.

Purposes and legal bases

Where EU or UK data-protection law applies, the basis depends on the activity, not on blanket acceptance of this notice:

• Providing the service: account access, syncing house records, calculations, requested exports and purchase access are necessary to perform our contract with you.
• Shared records about other people: our and house members' legitimate interests in maintaining an accurate, reviewable history, subject to those people's rights and a necessity and proportionality assessment.
• Security and support: legitimate interests in preventing misuse, investigating errors, responding to requests and protecting the service; legal obligations where applicable.
• Optional processing: consent where required, including applicable rules for optional analytics, device access and third-party AI sharing.
• Legal matters: applicable legal obligations and, where appropriate, legitimate interests in establishing or defending claims.

Required account and house information is needed for the associated feature to work. You can use manual record entry without scanning a receipt or generating an AI message. Turnover does not make a legally binding determination about a person's debt, creditworthiness or fault through automated processing.

Who can see a house record

Current and historical house members can access shared records under the app's access rules. Historical access does not generally permit changing financial or evidence records. Information entered after someone leaves may still be visible to them. Treat a house record as shared information, not a private diary.

An authenticated person with a valid invitation code can preview limited house information, including its address, before joining. Protect invite links. Members can export statements or share information outside Turnover. Evidence is stored in private storage, but temporary signed links grant access to anyone who obtains the link while it is valid. We cannot recall screenshots, downloaded statements or copies held independently by other people.

Service providers and other disclosures

Our service uses the following providers for the indicated purposes. The information sent depends on the feature and its configuration:

• Supabase: authentication, databases, private file storage and backend functions.
• Resend: delivery of authentication and account emails, including recipient address and message contents.
• RevenueCat, Apple and Google: purchase processing, subscription status, restoration and entitlement verification.
• Google Firebase and Apple notification services: remote configuration and push delivery. Firebase may retain diagnostics from older builds; optional analytics and crash uploads are disabled in the updated build. Notifications may show house activity on a lock screen.
• Claude by Anthropic, and Google Gemini: requested receipt/asset extraction and settlement-message drafts, described below. Later versions of the app use Claude by Anthropic. Turnover 1.0 uses Google Gemini only until the next version is released.
• Cloudflare: website delivery, hosting and network security, including processing connection and request information.

Providers may process information for us or, for activities such as store billing, under their own responsibilities. Their notices do not replace our obligations. We may also disclose information where necessary to comply with law, respond to a valid legal request, protect people or the service, or address a business transfer with appropriate safeguards and notice.

Turnover does not sell personal information or use house records for targeted advertising. The website does not include third-party advertising or analytics scripts. Hosting requests can still be logged.

AI processing

The first time you use each AI feature, the app names the AI provider it uses, describes the information that feature sends and asks for your explicit permission. Versions after 1.0 use Claude by Anthropic. Turnover 1.0 uses Google Gemini until the next version is released; after that, AI features use only Claude, and 1.0 offers manual entry instead. Your information goes only to the provider your app named when it asked. Cancel to use manual entry or a non-AI message instead. Permission is remembered for that feature on this device for your account until you withdraw it in Settings, under Help and legal; after that, or if this notice changes, the app asks again. Permission given for Google Gemini does not carry over to Claude: the app asks first.

Receipt scanning sends the selected image to that provider through our backend. Message drafting sends settlement context that can include the departing member's name, total, currency, line descriptions, amounts, categories and disputed-item indicators. House/member identifiers used by our backend for access checks are excluded from the provider's prompt, as are calculation-detail JSON and separate dispute notes. Descriptions can still contain personal information. This is a disclosure to an external provider, not on-device-only processing. Only submit material you are entitled to share.

AI responses can be wrong. Review and edit them before saving or sending. Turnover does not automatically treat generated text as a financial fact, another person's consent or a fault decision.

Requests to Claude use Anthropic's commercial API. Under Anthropic's Commercial Terms, Anthropic may not train models on this content; its privacy center explains how long it keeps API requests. Requests to Gemini use Google's paid Gemini API service; see Google's Gemini API terms. We do not promise zero provider retention. Manual entry remains available.

Retention and deletion

While your account is active, we keep information needed to provide its features. You can request account deletion in the app or via our deletion page. Successful account deletion removes the authentication account, profile and owned push tokens and disconnects the account from retained memberships.

Disconnecting an account does not fully anonymise the house record. Names in historical snapshots, descriptions, notes, images or receipts may still identify you. The current account deletion flow does not automatically erase all shared records, uploaded evidence, provider-held diagnostics or purchase history.

Shared records may be needed by other members to reconcile deposits or document a dispute. Their retention must be limited to a justified purpose and applicable law, not unrestricted permanent storage. Contact us to request review, correction, restriction or redaction of retained personal information. We consider the relevant records, other people's rights, legal obligations and any ongoing claims; we will explain a refusal or partial response where required.

Other retention criteria include the time needed to resolve support requests, investigate security events, meet accounting obligations and complete a documented legal hold. Logs, diagnostics and backups follow each provider's own retention cycle, so deleted information can remain in them for a time. Account deletion does not by itself send a deletion request to every independent provider.

Deleting Turnover does not cancel a store subscription. Cancel it through Apple or Google separately. Copies exported by other members are outside our direct control.

International processing

The operator is in Pakistan. Our providers operate internationally, including in the United States and other countries, and support access can involve processing outside your country. Protections may differ from those where you live.

Where transfer restrictions apply, the relevant transfers need a valid legal mechanism, such as an applicable adequacy decision or contractual safeguards and any required supplementary measures. Contact us for information about processing locations and safeguards relevant to your data.

Your choices and rights

Depending on the law that applies, you may request access, correction, deletion, a portable copy, restriction or objection to processing, and withdraw consent for processing based on consent. Withdrawal does not undo earlier lawful processing. Manage camera, photo and notification permissions in your device settings. Contact us about other privacy choices; do not assume turning off notifications disables diagnostics.

Email hello@useturnover.com with enough information to locate the relevant account or record. Settings → Help and legal → Privacy request can prepare an email; Report content or abuse provides a safety-report route. Neither sends a message until you send it in your email app, and no house records are automatically attached. Do not send passwords or full identity documents in the first message. We may request proportionate verification and, for an authorised agent, evidence of authority. We respond within the applicable legal deadline and explain any permitted extension or refusal. We do not penalise you for exercising privacy rights.

You can block a housemate from their row in House members. We keep a record that you blocked that account, visible only to you, until you unblock them or either account is deleted. A block hides their condition photos and notes from you; their financial records stay in the house record, and settlement notifications still reach you, because settlements are calculated from them. The member is not told.

EU/EEA and UK residents may complain to their competent supervisory authority, including the UK ICO. Where US state privacy laws apply to our processing, their access, correction, deletion, portability, opt-out and appeal rights apply as relevant. Email us to appeal a request decision.

Security and age

We use authenticated access, database access policies, private storage and server-side access checks. These are safeguards, not a guarantee against every breach or unauthorised disclosure. Report suspected security incidents to our contact address.

Turnover is intended for adults aged 18 or over. Do not create an account for a child or submit children's personal information unnecessarily. Contact us if you believe a child has supplied personal information so we can investigate and take appropriate action.

Updates

We date changes to this notice and tell you about material changes in advance. Where a change needs your fresh consent, we will ask for it. If Turnover moves to a company we form to operate it, we will tell you and update this notice; your rights carry over.