Privacy Policy

The short version

The extension itself collects nothing. If you never create an account, no server ever learns that you exist. If you do create an account, we hold the minimum needed to give you a licence: your email, your order records, and a hashed device identifier.

1. Who is responsible

The operator of Turan is the data controller for the information described here. Contact details are at the end of this page.

2. What the extension handles

The extension processes the following on your device only, and never transmits it:

• your chosen preset, intensity, and toggle states;
• per-site overrides you create (which are matched locally against the current tab's host);
• whether a licence is active, and the last successful check timestamp.

There is no analytics library in the extension, no crash reporter, and no remote configuration that could start collecting data later without a visible version update.

3. What the server handles, and why

Data	Why we have it	Legal basis
Email address	Sign-in, licence delivery, receipts, and service notices	Contract
Password hash (bcrypt)	Sign-in with a password, if you choose that method	Contract
Order records (id, amount, currency, status)	Honouring the purchase, tax records, support	Contract, legal obligation
Hashed device identifier	Enforcing one-person, multi-device licensing	Legitimate interest
Licence events (activation, deactivation)	Support and abuse prevention	Legitimate interest
Audit log of admin actions	Security and accountability for our own staff	Legitimate interest
Feedback you submit	Answering you and fixing the problem	Consent

We do not hold your card number, and we cannot obtain it — the payment provider never sends it to us.

4. The device identifier

The extension generates a random value — a UUID, not a fingerprint of your hardware — and sends it when a licence is activated. The server immediately derives an HMAC-SHA256 digest using a key held server-side, and stores only the digest. The value you sent is never written to the database or to logs, which is why we can honestly say we do not know which machine a licence is running on.

Consequences worth stating plainly:

• we cannot reverse a digest into a machine, account, or person;
• the digest is only meaningful inside our own database;
• clearing the extension's storage produces a new identifier, which is why reactivation after a browser reset may require signing in again.

5. Cookies

This website uses a small number of strictly necessary cookies for sign-in and session integrity. There are no advertising cookies and no cross-site tracking cookies. See the Cookie Notice.

6. Sharing

We share data only with processors that are necessary to run the service:

• the payment provider, to charge you and to send us signed order webhooks;
• the email provider, to deliver sign-in links, receipts, and service notices;
• the hosting provider, on which the database and application run.

We do not sell personal data. We do not share it for advertising. We do not transfer it to third parties for their own purposes.

Where a processor is outside your region, transfers rely on appropriate safeguards such as standard contractual clauses.

7. Retention

• Account and licence records: while the account exists, then up to 24 months for tax and accounting obligations.
• Order records: as long as tax law requires, typically 7–10 years depending on jurisdiction.
• Audit logs: 12 months.
• Feedback: 24 months, then deleted or anonymised.
• Email delivery logs: 90 days.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your data, to object to processing based on legitimate interest, and to withdraw consent at any time.

Practical notes:

• To delete your account, email us from the address on the account and we will remove it after verifying that it is you. This removes your profile, sessions, and licence bindings; order records are retained where tax law requires it, and we will tell you exactly what was kept.
• You can request an export by email. We respond within 30 days.
• You can object to licence-check processing, but a licence cannot be enforced without it, so the practical result is ending the licence rather than continuing it unverified.

If you are in the EU/EEA or UK you may also complain to your local supervisory authority.

9. Security

Passwords are hashed with bcrypt. Sessions are stored server-side and invalidated on sign-out. Admin actions are logged. Payment webhooks are signature-verified before they change any state. See the Security page for the full description.

No system is perfect. If we become aware of a breach affecting your data, we will notify affected users and any required authority without undue delay.

10. Children

The service is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

11. Changes

Material changes will be announced in the changelog and, for account holders, by email at least 14 days before they take effect.

12. Contact

Privacy questions and data requests: see the contact address at the bottom of this page. For a data export or deletion request, please write from the email address on the account so we can verify it is you.