← Back to TurboFlow
Privacy Policy
Last updated: April 21, 2026
1. Introduction
TurboFlow ("we", "us", "our") is a Chrome Extension that automates bulk AI image and video generation on
Google Flow. This Privacy Policy explains what data we collect, how we use it, and your rights.
2. What We Collect
Account Information — When you sign in with Google, we receive:
- Your email address
- Your display name
- Your profile picture URL
Connection & Location Data — We automatically collect:
- Your IP address (used to determine country, prevent fraud, and comply with regional policies)
- Your country (derived from your IP via a public lookup service)
- A device fingerprint hash (derived from your browser's screen, canvas, WebGL, and hardware
characteristics — used only for abuse prevention and to verify device identity)
Usage & Analytics Data — We track on our server:
- Number of image and video prompts used per day
- Your subscription plan (Free, Pro, or Trial) and billing status
- Batch generation analytics (duration, success/failure counts, error categories, rate limits
encountered)
- Feature usage events (which features you've used — e.g. video mode, reference mapper, auto-chain, tag
matching, library uploads)
- Interaction events (upgrade modal views, checkout starts/completions, daily limit reached, onboarding
progress, session starts)
- Generation settings per batch (model, aspect ratio, image/video count, quality settings, reference
counts)
- Client environment (operating system, browser locale, extension version, Google account tier)
Abuse Prevention — To prevent trial abuse and enforce fair use, we may correlate IP
addresses, IP subnets (/24 blocks), and device fingerprint hashes across accounts. Accounts found to be
circumventing free-tier limits may be suspended.
Local Storage — Stored in your browser only, never sent to our servers:
- Your generation settings (model, aspect ratio, image count)
- Your batch queue (prompts, batch names, statuses)
- Your gallery history (media references, thumbnails)
- Your reference image library (local thumbnails and Google Flow media IDs)
- Your UI preferences (active tab, folder name, onboarding state)
- Your Google OAuth access token
3. What We Do NOT Collect
Your prompts and generated media are processed within your browser on the Google Flow page. They are
never sent to, processed by, or stored on TurboFlow servers. We have zero access to your creative
content.
- We do NOT collect, store, or transmit your prompt text
- We do NOT collect, store, or transmit your generated images or videos
- We do NOT collect browsing history outside the TurboFlow extension
- We do NOT use cookies for tracking
- We do NOT sell, rent, or share your personal data with third parties for their own
purposes
- We do NOT use third-party tracking scripts, advertising networks, or external
analytics services
4. How Your Data Is Used
- Authenticate your identity via Google OAuth
- Determine your subscription plan and enforce daily usage limits
- Process subscription upgrades via Lemon Squeezy
- Detect and prevent abuse (multi-account trial farming, automated signups, etc.)
- Improve the extension by analyzing aggregate usage patterns, error rates, and feature adoption
- Provide customer support when you contact us
5. Data Storage and Security
- All account, usage, and analytics data is stored in a secure Supabase database
- All communication between the extension and our server uses HTTPS
- Your Google OAuth token is stored locally in Chrome Storage and is only transmitted to Google's servers
to verify your identity on each request — never to TurboFlow servers directly
- Device fingerprints are hashed (SHA-256) before storage; we never store the raw fingerprint
components
6. Third-Party Services
- Google OAuth — For authentication (governed by Google's Privacy Policy)
- Supabase — For secure database storage (governed by Supabase's Privacy Policy)
- Lemon Squeezy — For payment processing (governed by Lemon Squeezy's Privacy Policy)
- Vercel — For API hosting (governed by Vercel's Privacy Policy)
- api.country.is — For IP-to-country lookup (only your IP address is sent; no account
information)
We do not share your personal data with any other third parties.
7. Google API Services
TurboFlow's use and transfer of information received from Google APIs adheres to the Google API
Services User Data Policy, including the Limited Use requirements.
We only request the following Google OAuth scopes:
- userinfo.email — to identify your account
- userinfo.profile — to display your name and picture
8. Limited Use of Google API Data
TurboFlow's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically:
- Allowed Use: We only use Google user data (email, name, profile picture) to
authenticate your identity, manage your subscription, and enforce daily usage limits.
- Allowed Transfer: We do not transfer Google user data to third parties except to
trusted service providers (Supabase, Vercel, Lemon Squeezy) strictly as needed to operate the
extension, or when required by law.
- No Advertising: We never use Google user data to serve advertisements, including
personalized, retargeted, or interest-based ads.
- No Human Reading: We do not allow humans to read Google user data, except (a) with
your explicit consent for support purposes, (b) for security investigations, (c) to comply with
applicable laws, or (d) in aggregated and anonymized form for internal operations.
9. Data Retention
- Account and usage data is retained as long as your account is active
- If you sign out, your local data is cleared from Chrome Storage
- Banned accounts and their associated identifiers (IP address, device hash) may be retained indefinitely
for abuse prevention purposes
- You may request complete deletion of your server-side data by contacting us
10. Your Rights
You have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data (except abuse-prevention records)
- Export your data
- Withdraw consent at any time by signing out and uninstalling
11. Children's Privacy
TurboFlow is not intended for use by children under 13. We do not knowingly collect personal data from
children under 13.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify users of significant changes through the
extension or our website.
13. Contact
For any questions about this Privacy Policy or to request data deletion, contact us at:
Email: support@turboflow.art
Website: turboflow.art