1. Who is responsible
TurboIndex (turboindex.io) is run by SCRIPTEX SRL, Piața Voievozilor nr. 16, bl. C3, sc. B, ap. 10, Iași, Romania, registered in the trade register of Romania under number J2023003324227, VAT number RO49008040. SCRIPTEX SRL is the data controller for the personal data described here. Contact for every privacy matter: [email protected].
2. What we collect
Account data
- Your Google account identifier, name, email address and profile picture URL, received from Google when you sign in.
- The list of Google permissions (scopes) you granted, the time you created the account and the time you last signed in.
- An encrypted Google refresh token. It lets us read your Search Console data while you are not on the site, so daily checks can run. It is encrypted before it is written to the database. We never receive or store your Google password.
Site data
- The list of Search Console properties your account can access, with your permission level for each.
- For the sites you add: sitemap addresses, the URLs found in those sitemaps, URLs you paste by hand, and settings such as your IndexNow key.
- The index status Google reports for those URLs (for example indexed, crawled but not indexed, blocked by robots.txt), the last crawl time and the canonical URL Google chose.
- Submission logs: which URL was submitted when, to which service, and the response we got.
- If you use your own Google Cloud key, uploaded by you or created for you with Set it up for me: the service account email, project ID and the private key, and for a key Set it up for me made, the email address of the Google account that holds its project. The private key is stored encrypted.
- For Set it up for me: a record of each run (which steps finished, the ID of the project we created in your account, the service account email and any error Google returned), so the setup can be resumed and support can see what happened.
Billing data, if you buy a paid plan
- Paddle, our reseller and the merchant of record, collects what the checkout asks for: your email address, country and postal code, your payment details and, if you give them, a company name, address and VAT number. Paddle keeps the card or payment account details. We never receive them.
- From Paddle we receive and keep: your Paddle customer ID, your subscription (its ID, plan, status, price, currency, billing period, next payment date and any scheduled cancellation) and the IDs of your payments.
- Paddle sends us a notification each time your subscription or a payment changes. We keep a copy of each one for a short time, to find and fix billing problems.
Technical data
- Server logs with IP address, user agent, requested address and time. We use them for security and debugging.
- The free tools process the URL or text you enter to produce the result. IP addresses are held in memory for a short time for rate limiting. Tool inputs are not tied to an account, except in the Google Index Checker.
- The Google Index Checker works only when you are signed in. It sends each address you check to Google's URL Inspection API with your own Search Console access (the
webmasters.readonlypermission below), for the properties in your Search Console. We do not store the addresses or the answers; how many checks your account used today is held in memory. - If you join a waitlist for a paid plan: your email address and the plan you are interested in.
- If you email us: your message and address.
We do not collect or store card numbers or any other payment details. Paddle does, under its own privacy notice.
3. Google user data: which permissions we use and why
TurboIndex asks for the smallest set of Google OAuth scopes that lets the product work.
| Scope | When | What we do with it |
|---|---|---|
openid, email, profile | Sign-in | Create your account and recognise you when you come back. We read your Google account ID, name, email address and profile picture. |
https://www.googleapis.com/auth/webmasters.readonly | Sign-in | Read-only access to Search Console. We list your properties and your permission level, read the sitemaps you submitted, and request the index status of your URLs through the URL Inspection API. With this scope we cannot change anything in your Search Console. |
https://www.googleapis.com/auth/siteverification | Optional, only if you choose the one-click setup or Set it up for me | Add the indexing service account (ours, or the one created in your account) to the owner list of the property you selected, by one call to the Site Verification API. When you delete a key that Set it up for me created, we take that service account off the owner lists of your properties again, and when you remove a site, we take our indexing accounts off that property's owner list. When we move a site to another of our indexing accounts (for example when your plan needs more room than the first one has), we add the new one to that property's owner list and take the first one off, and the dashboard tells you. When a site gets a key of your own we add that key to the property's owner list (also for your other sites that share it, when you ask for that on the Indexing keys page) and take ours off once yours works; if your key stops working later, we add one of ours again so the site keeps sending. We do not verify new sites, and we never remove or change other owners. You can skip this scope and add the owner by hand instead (see the setup guide). |
https://www.googleapis.com/auth/cloud-platform | Optional, only if you press Set it up for me (in a site's own key setup, or on the Indexing keys page) | Create your own Google Cloud keys in the Google account you pick on Google's screen (the one you sign in with, or another account of yours): Google Cloud projects, only as many as your plan needs and never more than one per site (Resource Manager API), the Web Search Indexing, Google Search Console and IAM APIs turned on in each (Service Usage API), one service account and one JSON key in each (IAM API). We store those keys encrypted and use them only to submit your URLs to the Indexing API, to add your property to the service account's own Search Console list (which is what gives it access there) and to confirm that it is an owner of your property. Google gives us an access token for this scope that expires within an hour and no refresh token; we use it during the setup and do not store it, so afterwards we have no access to your Google Cloud. We do not read, change or delete anything else in your Google Cloud. The projects, service accounts and keys stay in your account, and you can delete them at any time. When you delete a key in TurboIndex and choose to delete its Google Cloud project too, we ask the account that holds it for this access once more and use it to shut down that one project; Google keeps it restorable for 30 days. We never shut down a project we did not create. |
URL submissions to the Google Indexing API are not made with your Google account. They are made by a service account (ours, or your own, uploaded by you or created in your account for you) that is an owner of your property in Search Console. You can remove that owner in Search Console at any time.
Limited Use disclosure
TurboIndex's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In plain terms, for data we get through Google APIs:
- We use it only to provide and improve the features you see in TurboIndex: listing your sites, tracking index status, submitting your URLs and, when you ask for it, setting up your own Google Cloud key.
- We do not transfer it to others, except where needed to provide those features (our hosting sub-processors), to comply with the law, or as part of a merger or acquisition with the same protections and with notice to you.
- We do not use it for advertising, and we do not sell it.
- We do not use it to train generalised AI or machine learning models.
- People do not read it, unless you ask us to look at a problem in your account, it is needed for security or to investigate abuse, or the law requires it.
4. Why we process data, and the legal basis
- To provide the service you signed up for (account, site data, Google data, submission logs): performance of a contract, Article 6(1)(b) GDPR.
- To keep the service secure and prevent abuse (server logs, rate limiting): our legitimate interest, Article 6(1)(f) GDPR.
- To give you the paid plan you bought (billing data from Paddle): performance of a contract, Article 6(1)(b) GDPR. Records we must keep for tax and accounting: our legal obligation, Article 6(1)(c) GDPR.
- To email you about a paid plan you asked to hear about (waitlist): your consent, Article 6(1)(a) GDPR. You can withdraw it by writing to us.
- Service emails about your account, for example a lost Google connection, a failed payment or a change to these terms: performance of a contract.
- Product news, a few times a year at most, about what changed in TurboIndex: our legitimate interest in telling account holders about the product they use, Article 6(1)(f) GDPR. You can turn it off in the account settings or with the link at the end of every one.
We do not make automated decisions with legal or similarly significant effects, and we do not sell or share your email address.
5. How long we keep it
| Data | Kept for |
|---|---|
| Account data and Google refresh token | Until you delete your account. The token is also deleted when you disconnect Google or Google tells us it was revoked. |
| Sites, sitemaps, URLs and index status | Until you remove the site or delete your account. |
| Submission logs and inspection history | 180 days. The latest status stays on the URL. |
| Event log (what happened in your account, for support) | 90 days. |
| Your own service account keys (uploaded or created for you) | Until you remove the key or the site, or delete your account. |
| Records of Set it up for me runs | Until you remove the site or delete your account. The Google Cloud access token used for a run is never stored. |
| Subscription records (plan, status, dates, Paddle IDs) | Until you delete your account. Paddle keeps its own records of your payments and invoices for as long as tax law requires. |
| Copies of Paddle's notifications | 90 days. |
| Server logs | Up to 30 days. |
| Waitlist entries | Until the plan launches and you were told, or until you ask us to remove you. |
| Backups | Deleted data can remain in encrypted backups for up to 30 days before it is overwritten. |
Accounts that have not been used for 24 months may be deleted after a warning email.
6. Deleting your data
- Remove a site on the dashboard (More, Remove site). This deletes everything we hold for that site from the live database at once: its URLs, statuses and history, sitemaps, settings, submission logs, the log lines and email records that mention it, and the keys only that site used.
- Delete your account in the dashboard settings. This cancels a running subscription at Paddle and removes your profile, the refresh token, your sites, URLs, statuses, logs, uploaded keys and subscription records from the live database.
- Or ask us: write to [email protected] from the address of your account. We delete within 30 days and confirm by email.
- Revoke Google access at myaccount.google.com/connections. Our stored token stops working at once.
- Remove the indexing account in Search Console under Settings, Users and permissions. This is on Google's side. When you remove a site and you gave the one-click permission, we do it for you; without that permission we cannot, and the dashboard tells you which address to remove.
7. Who else processes data
We use a small number of service providers (sub-processors) that process data on our behalf under a data processing agreement:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | The server that runs the web app, the worker and the database | Germany |
| Cloudflare, Inc. | DNS, the tunnel in front of the server, caching and DDoS protection, the backup bucket | Global network |
| Coolify Cloud | Deployment of the server, with access to it and to its settings | See Coolify's own terms |
| Resend, Inc. | Sending service emails and the emails you turned on | United States |
Other recipients, who are not our sub-processors:
- Paddle (Paddle.com Market Limited, United Kingdom, and its group companies) is the reseller of our paid plans and the merchant of record. When you buy a plan, Paddle processes your billing data as an independent controller under its privacy notice. We tell Paddle your email address and your TurboIndex account ID when you open the checkout, so the payment reaches the right account.
- Google is the source of your Search Console data and the recipient of the URLs you ask us to submit.
- IndexNow: if you turn it on, the URLs of your pages are sent to the IndexNow endpoint, which shares them with the participating search engines. URLs of public pages are the only thing sent.
- Our accountant and legal advisers, where they need it for their work, and authorities, only when the law obliges us to.
If a provider processes personal data outside the European Economic Area, we rely on an adequacy decision (the United Kingdom has one, and so do US companies certified under the EU-US Data Privacy Framework) or on the European Commission's standard contractual clauses.
8. Cookies
TurboIndex sets one cookie for signed-in users: ti_session. It is a signed, HTTP-only session cookie that keeps you logged in, and it expires after 30 days. While you are signing in, a second cookie (ti_oauth) exists for a few minutes to protect the Google sign-in against forgery, and is then deleted.
Both are strictly necessary, so there is no cookie banner. We use no advertising cookies, no cross-site tracking and no third-party analytics scripts. If that ever changes, this page changes first and we ask for consent where the law requires it.
The Paddle checkout is loaded only on the Billing page of the dashboard and on the payment page Paddle sends you to from a receipt. It runs from Paddle's servers and may set the cookies Paddle needs to take the payment and prevent fraud. Paddle's privacy notice covers them.
9. Security
- All traffic uses HTTPS.
- Google refresh tokens and service account private keys are encrypted in the database with a key that is kept outside the database.
- Access to production systems and to the database is limited to the people who run TurboIndex at SCRIPTEX SRL.
- If a breach affects your personal data, we tell you and the supervisory authority as the GDPR requires.
10. Your rights
Under the GDPR you have the right to access your data, have it corrected, have it deleted, restrict or object to processing, receive it in a portable format, and withdraw consent at any time. Write to [email protected]. We answer within one month.
You also have the right to complain to the data protection authority of the EU country where you live or work. We would like the chance to fix the problem first, but you do not need to ask us before you complain.
11. Children
TurboIndex is a tool for website owners and is not directed at children under 16. We do not knowingly collect their data.
12. Our crawler
When we fetch sitemaps or pages, for your sites or for the free tools, requests identify themselves as TurboIndexBot. What it does and how to block it is described on the TurboIndexBot page.
13. Changes to this policy
When we change this policy we update the date at the top. If a change affects how we use your Google data or is otherwise significant, we email account holders before it takes effect, and we ask for consent again where Google's policies or the law require it.