Security

1. What we access, and why

TurboIndex asks Google for the smallest set of permissions (scopes) that lets each feature work, and asks for the optional ones only at the moment you choose the feature that needs them.

Scope	When	What it is used for
`openid`, `email`, `profile`	Sign-in	Your account ID, name, email address and picture, to create your account and recognise you. We never see your password.
`webmasters.readonly`	Sign-in	Read-only Search Console. We list your properties, read the sitemaps you submitted and ask the URL Inspection API what Google thinks of each page. Also Search Analytics (clicks and impressions) for the Search tab. Nothing in Search Console can be changed with this scope.
`siteverification`	Only when you pick One click or Set it up for me	One call that adds the indexing account to the owners of the property you chose. When you delete a key that Set it up for me made, or remove a site, one call that takes our accounts off that property again. When we move a site to another of our accounts (for example when your plan needs more room), one call that adds the new one and one that takes the first off; the site's Overview says so. It never verifies new sites and never removes or changes another owner.
`cloud-platform`	Only when you press Set it up for me, or delete a key it made	Creates, in the Google account you pick on Google's screen, the projects your plan needs (never more than one per site), turns on three APIs in each (Indexing, Search Console, IAM), and creates one service account and one key in each. Google gives an access token that lasts under an hour and no refresh token: it is used during that run and never stored, so afterwards TurboIndex has no access to your Google Cloud. The same one-time access shuts down that one project when you delete the key and ask for it; Google keeps the project restorable for 30 days. A project TurboIndex did not create is never touched.

The indexing account is yours to choose

Google only accepts Indexing API requests from an account that is an Owner of the property in Search Console. Your sign-in is never used for that. The requests are made by a service account, and you decide which one:

Your own key. A service account in your own Google Cloud project, made by Set it up for me in your account or created by you and uploaded. TurboIndex holds its key, encrypted, and uses it for one thing: telling Google that a URL on your site is new or updated. You can delete the key under Indexing keys here, or revoke it in Google Cloud, at any time. Either one stops every submission at once.
The TurboIndex account. A service account TurboIndex runs, shared by the sites that do not bring their own key. You add it as an Owner of your property (Google does it after your approval with One click, or you paste its address in Search Console), and you can remove it under Settings, Users and permissions whenever you like. From that moment it can send nothing for your property.

What an Owner can do and what the indexing account actually does with it is spelled out on the setup page of every site and in the setup guide. A service account has no password and no inbox: nobody can sign in to Search Console with it in a browser.

2. What we store, and how

Your Google refresh token, so the daily checks can run while you are not on the site. Encrypted with AES-256-GCM before it is written to the database, with a key that lives in the server's environment, not in the database. Losing that key would make every stored credential unreadable, which is the intended failure.
Service account keys you uploaded or Set it up for me created: the private key, encrypted the same way, plus the account's email address and project ID.
Your sites: the properties of your Search Console with your permission level, the sitemaps, every URL found in them or pasted by you, what the pre-check found on each page, what Google's URL Inspection API said about each one, and when each URL was sent where (a site's Activity).
Search Analytics for the sites you connected, when the Search tab is on: clicks, impressions and position per day, page and query.
API keys you create are stored as a SHA-256 hash; the key itself is shown once. Webhook secrets are stored as they are, because the signature has to be computed with them.
An event log of failures and state changes (a refused submission, a quota hit, a key that lost Owner access, a sign-in), which is what the admin pages read.
Emails we sent you, as a log with their text.
Your subscription, if you bought a paid plan: the IDs Paddle gave your customer record, subscription and payments, the plan, its status and its dates. No card numbers: the payment runs in Paddle's checkout and the card stays with Paddle.

All of it is in one PostgreSQL database on one server in Germany (Hetzner). The server is reachable only through a Cloudflare Tunnel and over SSH; no database port is open to the internet. A nightly backup goes to an object storage bucket at Cloudflare; a backup holds what the database held, including the encrypted tokens and keys, and never the encryption key. The session cookie is signed and HTTP-only, and it is the only cookie we set (the Paddle checkout on the Billing page brings its own). No analytics scripts, no advertising.

3. What we never do

Change a setting in your Search Console, add or remove a user, remove a property, or remove a URL from Google.
Read, change or list a property you did not add to TurboIndex. The property list itself is read to show you what you can add.
Keep the Google Cloud access of Set it up for me, or touch a project in your Google Cloud that TurboIndex did not create.
Touch your website. There is no plugin, script, DNS record or login. TurboIndexBot only reads sitemaps and pages, like any visitor, and obeys a TurboIndexBot rule in robots.txt (how it behaves).
Sell your data, show ads, build profiles, or train machine learning models with it. People at TurboIndex read your data only when you ask for help with a problem, or when security or the law requires it.
Promise indexing. Nobody can; we show you what Google answered.

4. How to take the access back

Each of these works on its own and takes effect at once. Do all four and nothing of TurboIndex is left in your accounts.

Your sign-in. Open myaccount.google.com/permissions, choose TurboIndex and remove it. Google stops honouring the refresh token; index checks and sitemap reads stop the same minute. This also withdraws the optional One click permission.
The TurboIndex indexing account. In Search Console open Settings, Users and permissions, find the address ending in .iam.gserviceaccount.com that was added for TurboIndex, and remove it. The Indexing API refuses its requests from then on. If you gave the One click permission, Remove site in the dashboard does this for you and says so; otherwise it tells you which address to remove.
Your own key. Delete it under Indexing keys here (for a key Set it up for me made you can shut its project down in the same step, after one Google screen), or in Google Cloud under IAM, Service accounts, where you can delete the key, the account or the whole project. A revoked key stops every submission at once.
Your data. For one site: More, Remove site on the dashboard. It deletes everything we hold for that site, its pages, history, sitemaps, settings, the log lines and emails about it, and the keys only it used. For everything: Delete account at the bottom of your account page. It cancels a running subscription at Paddle, revokes the refresh token at Google, then deletes you, your sites, their URLs and history, your API keys and webhooks and the keys you uploaded, in one step. Projects that Set it up for me created stay in your Google account: shut them down from Indexing keys first if you want them gone. Or write to [email protected] from the address of your account.

5. How long we keep data

Data	Kept for
Account, refresh token, uploaded and created keys	Until you delete the account or remove the key. A token you revoked at Google is marked expired on the next check and is not used again; deleting the account removes it.
Sites, sitemaps, URLs and their status and history	While the site is connected. Remove site deletes all of it at once, with the log lines and emails about the site; adding it again starts from zero. Delete account does the same for every site.
Inspection history (every answer of the URL Inspection API)	180 days, then pruned; the latest answer stays on the URL.
Submission log (a site's Activity)	180 days.
Event log	90 days.
Subscription record	Until you delete the account. Paddle keeps the payments and invoices as tax law requires.
Copies of Paddle's notifications about a subscription	90 days.
Worker job log	14 days.
Server logs (IP address, user agent, path, time)	Up to 30 days.
Backups	Deleted data can remain in a nightly backup for up to 30 days.

6. Who else handles data

Provider	What for	Where
Hetzner Online GmbH	The server that runs the web app, the worker and the database	Germany
Cloudflare, Inc.	DNS, the tunnel in front of the server, caching and DDoS protection, the backup bucket (R2)	Global network
Coolify Cloud	Deployment of the server. It holds SSH access to the server and the environment variables, the encryption key among them	See Coolify's own terms
Resend, Inc.	Sending the emails you turned on (drop alerts, the weekly report, a broken sitemap, product news)	United States
Paddle.com Market Limited	Not a sub-processor: the reseller of the paid plans and merchant of record. It runs the checkout, keeps the card details and sends us the state of your subscription, under its own privacy notice	United Kingdom
Google LLC	Not a sub-processor: the source of your Search Console data and the recipient of the URLs you ask us to submit, under Google's API Services User Data Policy	Google's infrastructure
IndexNow (api.indexnow.org)	Only when you turn IndexNow on: the public URLs of your pages, shared with the participating search engines	Operated by Microsoft

The legal side of all this, the lawful bases and your rights under the GDPR, is in the privacy policy.

7. Contact

Questions about any line on this page, a request to delete data, or a security problem you found: [email protected]. For a vulnerability, tell us what you found and how to reproduce it. We answer within a few days and do not take action against people who report in good faith.