Turnifure Privacy Policy

Effective Date & Last Updated: October 20, 2026

1. Introduction & Scope

Turnifure (“Turnifure,” “Turnifure Studio,” “turnifure.com,” “we,” “us,” or “our”), developed and operated by Javier Carrera (“Javier Carrera”), provides parametric furniture design, customization, and digital fabrication tools, including the ModMaker parametric tool, the Turnifure Studio web-based CAD/CAM integrated development environment (IDE), cloud recipe storage services, and the physical furniture marketplace.

This Privacy Policy explains how we access, collect, use, process, store, protect, and disclose your personal data, Google user data, technical telemetry, and digital design files when you visit our website (https://turnifure.com), register or authenticate an account (including via Google Sign-In / OAuth 2.0), author or edit digital furniture recipes in Turnifure Studio, persist designs to cloud storage, or purchase products and subscriptions from us.

2. Turnifure Studio: Customer Design Data & Recipe Privacy

Turnifure Studio is a professional software-as-a-service (SaaS) tool for digital woodworking, allowing creators to write,
simulate, and inspect parametric recipes in YAML or JSON. We treat your engineering files with strict confidentiality:

2.1 Private by Default & Customer Confidentiality

By default, private recipes saved in Turnifure Studio are accessible solely by your authenticated user account. We do not
index, publish, sell, rent, or publicly expose your private Customer Design Data, nor do we permit other users to access
your private recipes without your explicit authorization.

2.2 No Machine Learning / AI Model Training on Private Recipes or Google User Data

We do not use or transfer your proprietary Customer Design Data, custom joinery algorithms, private recipe files, or any Google user data to train, fine-tune, or improve generalized or non-personalized artificial intelligence (AI), machine learning (ML), or large language models without your affirmative, explicit written consent.

2.3 Cloud Persistence & Google Cloud Storage (GCS)

When you choose to save recipes to the cloud in Turnifure Studio, files are transmitted securely over TLS-encrypted connections
and stored within our dedicated Google Cloud Storage infrastructure (Bucket: tf-recipes-uswest1):

• Per-User Partitioning: Recipes are strictly partitioned and isolated by authenticated user ID
  (e.g., recipes/{user_id}/{recipe_id}.yaml). Storage buckets enforce Uniform Bucket-Level Access and are
  guarded by server-side Google Compute Engine IAM service account token authentication.
• Object Versioning: Native GCS object versioning automatically captures historical snapshots of your
  saved recipe generations. This enables you to inspect, compare, duplicate, and restore earlier revisions within Turnifure
  Studio.
• File Constraints: Recipe files stored in GCS are capped at 512 Kilobytes (524,288 bytes) to ensure
  optimal performance and prevent abuse.
• Self-Service Deletion: You retain complete control to delete any individual version or entire recipe
  directly from the Studio interface at any time. When deleted, associated cloud objects are purged in accordance with
  Google Cloud Platform deletion protocols.

2.4 Geometry Solving & Data Minimization

To provide real-time 2D CNC vector inspection, mortise/tenon clearance verification, Three.js 3D assemblies, and sheet nesting
layouts, your recipe parameters are evaluated by our cloud geometry solvers:

• Data Minimization: The browser client receives only the computed geometric path coordinates, un-nested
  SVG paths, and mesh vertices necessary to render the preview. Proprietary backend solver algorithms, machine feeds, and
  internal tooling parameters remain secure.
• Zero-Eval Parsing: Recipe configurations are parsed using strict declarative parsers (js-yaml
  and JSON.parse). We do not execute dynamic arbitrary code (eval or new Function) in
  your browser or on our geometry servers.

2.5 Ephemeral Augmented Reality (AR) Preview Sessions

When you activate “View in AR” in Turnifure Studio, our engine generates temporary 3D assets (such as USDZ models for iOS Quick
Look or GLB models for Android WebXR) and produces an on-demand QR code:

• Transient Tokens: Preview handoff relies on cryptographically secure, random transient session tokens.
• Automatic Expiry: Transient AR session data is held temporarily in memory or transient cache and expires
  automatically after a short validity window. It is not retained as permanent customer profile data.

2.6 Turnifure AI Copilot Side-Sheet

Turnifure Studio features an integrated AI Copilot to assist creators with YAML syntax, coordinate calculations, and formula
troubleshooting:

• User-Initiated Inquiries: The AI Copilot operates solely when you interact with the drawer. Only the
  specific query text, formula question, or code snippet you submit is transmitted to the processing endpoint.
• Encrypted Transit: All communications with the AI copilot service are encrypted in transit via HTTPS/TLS.
• No Autonomous Background Harvesting: We do not continuously transmit your keystrokes, Google user data, or entire editor canvas to AI endpoints in the background.

2.7 Client-Side Local Storage & Editor State

Turnifure Studio utilizes your browser’s local storage (localStorage and sessionStorage) strictly for
client-side functional preferences:

• turnifure-studio-theme: Stores your visual interface preference (Auto, Light, or Dark mode).
• turnifure_studio_tour_seen_v1: Records whether you have completed or dismissed the interactive onboarding tour.
• In-Memory Undo/Redo History: Your granular editing history (up to 250 states) is maintained strictly in volatile browser RAM during an active session and is never transmitted to our telemetry servers.

3. General Personal Data We Collect and Why

3.1 Account Registration & Profile Data

When you register for an account, subscribe to Maker’s PASS, purchase plan credits, or apply for the Designer Program, we
collect:

• Contact details: Name, email address, physical address, billing address, and country.
• Account credentials: Securely hashed passwords (we never store plain-text passwords).
• Designer profile details (optional): Portfolio URLs, social handles (Instagram, LinkedIn, YouTube), and professional bios.

Purpose: We will use your data to provide you with the services you requested, authenticate your identity, fulfill purchases, deliver digital plans, send essential transactional email notifications, distribute designer royalty payouts, and provide customer support.

3.2 Comments & Community Contributions

When visitors leave comments on the site, we collect the data shown in the comments form, the visitor’s IP address, and browser
user agent string to aid spam detection. An anonymized string created from your email address (hash) may be provided to the
Gravatar service to check for an associated avatar (see Gravatar Privacy Policy).

3.3 Media & Image Uploads

If you upload images to the website (such as profile pictures, design photos, or portfolio renders), you should avoid uploading
images with embedded location data (EXIF GPS). Visitors can download and extract location data from images published publicly.
Designer profile pictures you choose to publish are displayed publicly on your designer profile.

3.4 General Cookies

In addition to Studio local storage preferences, we use standard WordPress session cookies:

• Authentication Cookies: When you log in, cookies are set to preserve your session (lasting two days, or two weeks if you check “Remember Me”). Log-out clears these cookies immediately.
• Comment Cookies: If you leave a comment, you may opt-in to saving your name and email in cookies for future convenience (lasting one year).
• Session Verification Nonces: Cryptographic nonces verify that requests originate from your authenticated browser session to protect against cross-site request forgery (CSRF).

3.5 Analytics & Server-Side Telemetry

To maximize performance and respect user privacy, external third-party site-wide tracking scripts (such as Cloudflare Web Analytics)
have been disabled. We log only essential, aggregated server-side operational metrics (HTTP status codes, request durations, and
error rates) to maintain platform stability.

4. Targeted Advertising & Third-Party Marketing (Excludes Google User Data)

To introduce our platform to makers and furniture designers on public marketing pages, we utilize conversion tracking and marketing pixels from Google Ads, Meta Pixel, and the Pinterest Tag:

• Strict Exclusion of Google OAuth Data: We never use, share, or transfer any Google user data obtained via Google OAuth / Google API Services for targeted advertising, personalized advertisements, retargeted advertisements, or interest-based advertisements.
• Information Collected on Public Pages: On general public browsing sessions, these services may use cookies or web beacons to receive non-personally identifiable browsing information, device types, and site interactions (such as visiting a product landing page or completing a standard checkout).
• Purpose: Strictly to measure campaign efficacy and assess general website conversions.
• Opt-Out Rights: You can opt out of targeted ad tracking at any time by configuring your browser’s cookie
  blocker, using privacy extensions, or visiting the Digital Advertising Alliance opt-out portal.

5. Google User Data & OAuth Authentication Disclosures

When you choose to sign in, register, or connect your account with Turnifure (“Turnifure” / “Turnifure Studio”) using Google Identity Services (OAuth 2.0), this section comprehensively discloses how our application accesses, collects, uses, stores, protects, retains, and shares your Google user data in compliance with Google’s OAuth verification requirements (Google App Privacy Policy Guidelines).

5.1 What Google User Data We Access and Collect

When you authenticate via Google Sign-In, Turnifure requests access only to the following basic, non-sensitive OAuth 2.0 scopes (openid, email, and profile):

• Email Address (.../auth/userinfo.email): Your primary Google account email address and verification status, used as your unique account identifier and for essential transactional notifications.
• Basic Profile Information (.../auth/userinfo.profile): Your full name and public Google profile picture URL, used to personalize your Turnifure account workspace and optionally display your avatar in the navigation bar.
• OpenID Identifier (openid): A unique, cryptographic Google user ID token used strictly to verify your identity across login sessions.

5.2 How We Use Google User Data

We use your Google user data solely to provide and improve user-facing features of the Turnifure application that are prominent in our application’s user interface. Specifically, we will use your data to provide you with the services you requested, including:

• Authenticating your identity and creating or logging into your Turnifure user account.
• Managing your authenticated session and associating your private parametric furniture recipes in Turnifure Studio with your user account.
• Sending essential transactional communications (such as order receipts, subscription confirmations, and security alerts).

Prohibited Uses: All other uses of Google user data are strictly prohibited. Specifically, Turnifure does not use Google user data for:

• Targeted advertising, personalized advertisements, retargeted advertisements, or interest-based advertisements.
• Selling data to third parties or data brokers, or providing data to information resellers.
• Determining credit-worthiness or for lending purposes.
• Creating third-party marketing databases or behavioral profiles.
• Training, fine-tuning, or improving non-personalized or generalized artificial intelligence (AI) and/or machine learning (ML) models.

5.3 How We Share, Transfer, or Disclose Google User Data

We do not transfer or disclose your information to third parties for purposes other than the ones provided in this Privacy Policy. We will not sell your data to third parties, data brokers, or information resellers, but we may share it only with our essential infrastructure service providers (such as Google Cloud Platform for database and cloud storage hosting) who help us provide and operate our services under strict confidentiality and data protection obligations, or when strictly required to comply with applicable law.

We never transfer Google user data to third parties for targeted advertising, personalized advertisements, retargeted advertisements, interest-based advertisements, selling to data brokers, providing to information resellers, or training generalized machine-learning (ML) or artificial intelligence (AI) models.

5.4 How We Store and Protect Google User Data (Data Protection Mechanisms)

Security procedures are in place to protect the confidentiality, integrity, and security of your Google user data. We use encryption to protect your information both in transit and at rest:

• Encryption in Transit: All Google user data transmitted between Google APIs, your browser, and Turnifure servers is encrypted using industry-standard HTTPS / TLS 1.3 protocols.
• Encryption at Rest: Google user data stored in our database and Google Cloud Platform infrastructure is encrypted at rest using AES-256 encryption.
• Access Controls & Isolation: Access to systems storing Google user data is strictly restricted to authorized personnel and least-privilege IAM service accounts required to maintain the platform.

5.5 Retention and Deletion of Google User Data

We retain your Google user data only for as long as your Turnifure account remains active and as necessary to provide you with the services you requested.

• Expiration of Retention Period: When the data retention period expires for a given type of data (such as upon account closure or deletion request), we will permanently delete or destroy it from our active databases and cloud storage buckets within 30 days, except where minimal financial transaction records must be retained to comply with statutory tax and accounting laws.
• How to Request Deletion: You may request for your data to be deleted at any time through your account settings or by contacting us via email at privacy@turnifure.com. Upon receiving your verified request, we will permanently delete your Google user data and confirm completion.
• Revoking Google OAuth Access: You can also revoke Turnifure’s access to your Google account at any time directly via your Google Account Security & Permissions page.

6. Subprocessors & Third-Party Service Providers

We partner with industry-leading infrastructure providers to deliver our services under strict data protection agreements:

• Google Cloud Platform (GCP): Secure cloud hosting, computing, and private bucket storage (tf-recipes-uswest1) in the United States.
• Cloudflare: Content delivery network (CDN), DDoS mitigation, and SSL/TLS edge certificate termination.
• Stripe & PayPal: Payment processing. Cardholder numbers are processed directly by PCI-DSS compliant gateways and never touch or reside on Turnifure servers.
• Transactional Email Providers: To deliver static plan files, order receipts, and password reset links.

7. General Data Retention & Erasure

• User Accounts & Recipes: Maintained for the lifetime of your account. You can delete individual recipes and versions anytime in Turnifure Studio.
• Transactional Records: Financial records are retained for the duration mandated by applicable tax and accounting laws.
• Account Erasure: When the data retention period expires for a given type of data, or upon verified user deletion request to privacy@turnifure.com, we will permanently delete or destroy your account, personal details, Google user data, and all associated recipes stored in Google Cloud Storage.

8. Your Rights Over Your Data (GDPR, CCPA & Global Rights)

Regardless of your geographic location, Turnifure extends comprehensive data rights:

• Right of Access & Portability: You can download and export all your digital recipes at any time in native YAML or JSON format, or download generated CNC drawings (DXF, SVG). You may also request an export of all personal data held about you.
• Right to Rectification: You can update or correct your profile information anytime through your account settings or Turnifure Studio.
• Right to Erasure (“Right to be Forgotten”): You may request the complete deletion of your personal data, Google user data, and cloud-stored recipe files by emailing privacy@turnifure.com, subject only to statutory accounting retention obligations.
• Right to Object & Restrict: You can opt out of marketing communications and targeted advertising cookies at any time.

9. Security Measures

Security procedures are in place to protect the confidentiality of your data, and we use encryption to protect your information across all layers of our platform:

• End-to-end TLS 1.3 encryption for all data in transit across our web applications, APIs, and cloud storage endpoints, and AES-256 encryption at rest.
• Least-privilege Google Cloud IAM role isolation and metadata token rotation.
• Strict declarative syntax validation to prevent script injection and code execution vulnerabilities.
• Continuous monitoring and automated rate-limiting to protect against denial-of-service attempts.

10. Changes to This Privacy Policy

We keep this Privacy Policy current and will update it if we change how our application accesses, collects, uses, stores, or shares personal data or Google user data. Whenever we make material changes, we will update the “Last Updated” date at the top of this page and notify registered users via email or an in-application notification prior to the changes taking effect.

11. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy, your Google user data, your Customer Design Data, or your personal information, please contact our Data Protection representative:

Turnifure Data Privacy
Application & Organization Name: Turnifure (Turnifure Studio)
Developer & Representative: Javier Carrera
Website: https://turnifure.com
Email: privacy@turnifure.com