Privacy Policy

Last updated: April 21, 2026

1. Introduction

TurboFlow ("we", "us", "our") is a Chrome Extension that automates bulk AI image and video generation on Google Flow. This Privacy Policy explains what data we collect, how we use it, and your rights.

2. What We Collect

Account Information — When you sign in with Google, we receive:

Your email address
Your display name
Your profile picture URL

Connection & Location Data — We automatically collect:

Your IP address (used to determine country, prevent fraud, and comply with regional policies)
Your country (derived from your IP via a public lookup service)
A device fingerprint hash (derived from your browser's screen, canvas, WebGL, and hardware characteristics — used only for abuse prevention and to verify device identity)

Usage & Analytics Data — We track on our server:

Number of image and video prompts used per day
Your subscription plan (Free, Pro, or Trial) and billing status
Batch generation analytics (duration, success/failure counts, error categories, rate limits encountered)
Feature usage events (which features you've used — e.g. video mode, reference mapper, auto-chain, tag matching, library uploads)
Interaction events (upgrade modal views, checkout starts/completions, daily limit reached, onboarding progress, session starts)
Generation settings per batch (model, aspect ratio, image/video count, quality settings, reference counts)
Client environment (operating system, browser locale, extension version, Google account tier)

Abuse Prevention — To prevent trial abuse and enforce fair use, we may correlate IP addresses, IP subnets (/24 blocks), and device fingerprint hashes across accounts. Accounts found to be circumventing free-tier limits may be suspended.

Local Storage — Stored in your browser only, never sent to our servers:

Your generation settings (model, aspect ratio, image count)
Your batch queue (prompts, batch names, statuses)
Your gallery history (media references, thumbnails)
Your reference image library (local thumbnails and Google Flow media IDs)
Your UI preferences (active tab, folder name, onboarding state)
Your Google OAuth access token

3. What We Do NOT Collect

Your prompts and generated media are processed within your browser on the Google Flow page. They are never sent to, processed by, or stored on TurboFlow servers. We have zero access to your creative content.

We do NOT collect, store, or transmit your prompt text
We do NOT collect, store, or transmit your generated images or videos
We do NOT collect browsing history outside the TurboFlow extension
We do NOT use cookies for tracking
We do NOT sell, rent, or share your personal data with third parties for their own purposes
We do NOT use third-party tracking scripts, advertising networks, or external analytics services

4. How Your Data Is Used

Authenticate your identity via Google OAuth
Determine your subscription plan and enforce daily usage limits
Process subscription upgrades via Lemon Squeezy
Detect and prevent abuse (multi-account trial farming, automated signups, etc.)
Improve the extension by analyzing aggregate usage patterns, error rates, and feature adoption
Provide customer support when you contact us

5. Data Storage and Security

All account, usage, and analytics data is stored in a secure Supabase database
All communication between the extension and our server uses HTTPS
Your Google OAuth token is stored locally in Chrome Storage and is only transmitted to Google's servers to verify your identity on each request — never to TurboFlow servers directly
Device fingerprints are hashed (SHA-256) before storage; we never store the raw fingerprint components

6. Third-Party Services

Google OAuth — For authentication (governed by Google's Privacy Policy)
Supabase — For secure database storage (governed by Supabase's Privacy Policy)
Lemon Squeezy — For payment processing (governed by Lemon Squeezy's Privacy Policy)
Vercel — For API hosting (governed by Vercel's Privacy Policy)
api.country.is — For IP-to-country lookup (only your IP address is sent; no account information)

We do not share your personal data with any other third parties.

7. Google API Services

TurboFlow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We only request the following Google OAuth scopes:

userinfo.email — to identify your account
userinfo.profile — to display your name and picture

8. Limited Use of Google API Data

TurboFlow's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

Allowed Use: We only use Google user data (email, name, profile picture) to authenticate your identity, manage your subscription, and enforce daily usage limits.
Allowed Transfer: We do not transfer Google user data to third parties except to trusted service providers (Supabase, Vercel, Lemon Squeezy) strictly as needed to operate the extension, or when required by law.
No Advertising: We never use Google user data to serve advertisements, including personalized, retargeted, or interest-based ads.
No Human Reading: We do not allow humans to read Google user data, except (a) with your explicit consent for support purposes, (b) for security investigations, (c) to comply with applicable laws, or (d) in aggregated and anonymized form for internal operations.

9. Data Retention

Account and usage data is retained as long as your account is active
If you sign out, your local data is cleared from Chrome Storage
Banned accounts and their associated identifiers (IP address, device hash) may be retained indefinitely for abuse prevention purposes
You may request complete deletion of your server-side data by contacting us

10. Your Rights

You have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data (except abuse-prevention records)
Export your data
Withdraw consent at any time by signing out and uninstalling

11. Children's Privacy

TurboFlow is not intended for use by children under 13. We do not knowingly collect personal data from children under 13.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes through the extension or our website.

13. Contact

For any questions about this Privacy Policy or to request data deletion, contact us at:

Email: support@turboflow.art
Website: turboflow.art