Privacy Policy
Last updated: March 25, 2026
1. Introduction
Winnovate Labs (OPC) Pvt. Ltd. (“we”, “us”, “our”) operates turbo2do.com (“the Service”). This Privacy Policy explains how we collect, use, and protect your personal data when you use turbo2do.
By using turbo2do, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.
2. Information We Collect
Account information
Name, email address, and password (hashed using bcrypt — never stored in plain text).
Task data
Tasks, lists, categories, checklists, comments, and file attachments you create within the app.
Usage data
Login timestamps, last active time, and feature usage for service improvement.
Payment information
Payments are processed by Razorpay (India) and Stripe (international). We do not store card details — only subscription status and plan tier.
Communications
Feedback and support messages you send us.
3. How We Use Your Information
- To provide and improve the turbo2do service
- To send transactional emails (welcome, password reset, task notifications)
- To process subscription payments
- To respond to support requests
- To monitor system health and prevent abuse
We do NOT sell your data to third parties. We do NOT use your task data for advertising.
4. Data Storage and Security
- Data stored on Supabase (hosted on AWS, Singapore region)
- File attachments stored in Supabase Storage
- All data encrypted in transit (TLS) and at rest
- Passwords hashed using bcrypt — never stored in plain text
- Access controls enforced via Row Level Security (RLS) in our database
- We conduct regular security reviews
6. Third-Party Services
- Supabase — database and authentication (supabase.com)
- Resend — transactional email delivery (resend.com)
- Razorpay — payment processing for Indian users (razorpay.com)
- Stripe — payment processing for international users (stripe.com)
- Vercel — hosting and deployment (vercel.com)
Each third party has their own privacy policy governing their use of data.
7. Data Retention
- Your data is retained as long as your account is active
- On account deletion, your data is permanently deleted within 30 days
- Anonymised usage statistics may be retained for analytics
8. Your Rights
Under the Indian IT Act and GDPR (where applicable), you have the right to:
- Access your personal data
- Correct inaccurate data
- Delete your account and data
- Export your data (coming soon)
Contact support@turbo2do.com to exercise these rights.
10. Children's Privacy
turbo2do is not intended for users under 13 years of age. We do not knowingly collect data from children.
11. Changes to This Policy
We will notify users of material changes via email. Continued use of turbo2do after changes constitutes acceptance of the updated policy.