Last updated: 13 November 2026
This policy explains how turingate, of 344/4 Netaji Subhash Chandra Bose Kolkata, India 700047 ("Turingate", "we", "us"), collects and uses personal data when you use the Turingate website, Console, APIs, widget and tools (the "Service"). We act as the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), and as the controller for the purposes of the EU/UK GDPR where it applies.
In short: we collect as little as possible. We never see your card number. We store email addresses and card details used for identity checks only as salted hashes. We use no advertising or analytics trackers, and we don't sell personal data.
| Data | When | Why we use it | How it's stored | How long we keep it |
|---|---|---|---|---|
| Google account details: name, email address, profile picture and Google account ID | When you sign in to the Console with Google | To create and secure your account, and to show you your Sites | As received | Until you delete your account |
Session cookie (tg_session) and sign-in cookie (tg_oauth) | When you sign in | To keep you signed in and to protect the sign-in flow | A random token in your browser; we store only a hash of it | Session: up to 30 days or until you sign out. Sign-in cookie: 10 minutes |
| Site details: site name, site ID, API key (stored as a hash), plan and monthly usage counts | When you create or use a Site | To run the Service and enforce plan quotas | API keys only as a hash | Until the Site or account is deleted |
| Billing details: Razorpay subscription ID, plan, currency, status and renewal date | When you buy a paid plan | Subscriptions, renewals and invoices | We store only these references. Razorpay processes your card or payment details; we never receive them | For as long as Indian tax and accounting laws require (typically up to 8 years) |
| Principal and agent public keys, display name | When you register a Principal or delegate to an Agent | To verify signatures and issue Passes | As is | Until you ask us to delete them |
| Email address for identity verification (optional, tier 1) | If you verify an email for a Principal | To confirm a real inbox and prevent people evading bans | Only a salted hash. The address is used once to send a code and isn't stored | Until deletion. See section 6 for blocked identities |
| Card fingerprint for identity verification (optional, tier 2) | If you verify a card for a Principal | One card per identity, to prevent ban evasion | Only a salted hash of a fingerprint from our payment provider. We never receive card numbers | As above |
| Reputation data: good and bad report counts | When Sites report outcomes | The shared trust signal across the network | Counters per Agent and Principal | Until deletion |
| IP address and request data | Every request | Rate limiting, abuse prevention and security | Rate-limit counters in memory only. Our hosting provider keeps standard request logs | Our counters: about an hour. Hosting logs: per the provider's retention |
| Hall of Shame entry: nickname, score and time | Only if you choose to add one after failing the test | The public leaderboard | Public | Until you ask us to remove it |
| Challenge answers | When solving a challenge | Grading | In memory only | Minutes, deleted after grading |
Challenge questions are generated using Anthropic's AI service. We send it only puzzle-generation instructions. No personal data, answers or identities are sent.
A Pass you or your Agent presents to a website can include your principal ID and display name, verification tier, your Agent's ID and name, the Site it was issued for, the scopes and spending limit you delegated, and a reputation score. You choose which websites to present Passes to. Each website uses this information under its own privacy policy.
We use only strictly necessary cookies: the sign-in cookies described in section 1. We don't use advertising, analytics or cross-site tracking cookies. If you choose "Remember on this browser" in the Console, your Site's API key is saved in your browser's local storage; you can clear it by signing out or clearing site data. When you upgrade a plan, Razorpay's checkout script loads in your browser under Razorpay's own policies.
We don't sell or rent personal data. We share it only with service providers who process it for us under contract, as permitted by law, or with your consent:
We may also disclose data where required by law, by court order, or to a government authority with lawful power to request it, or to protect the rights, property or safety of our users, the public or us.
Our servers are hosted by Render in the United States, so your data may be processed outside India. We transfer data abroad only as permitted under the DPDP Act and, for users in the EU/UK, with appropriate safeguards such as standard contractual clauses where required.
If an identity is blocked for abuse, we keep the salted hashes of its verified email and card for up to 3 years after the block, so the same person can't simply register again. We rely on our legitimate interest in preventing fraud and abuse, which is a legitimate use under the DPDP Act and Art. 6(1)(f) GDPR. A blocked identity can appeal as described in our Terms.
Keys are generated on your device, and we receive only public keys. API keys, session tokens, emails and card fingerprints are stored only as hashes. All traffic uses HTTPS. Access to production systems is restricted. No system is perfectly secure. If a personal data breach occurs, we'll notify affected users and the Data Protection Board of India as the DPDP Act requires.
Subject to applicable law, you can:
To use these rights, email rudraneel93@gmail.com from the email on your account, or include your site ID or principal ID. We'll respond within 30 days.
The Service is not intended for anyone under 18, and we don't knowingly process children's personal data. If you think a child has given us personal data, contact us and we'll delete it.
turingate, turingate, 344/4 Netaji Subhash Chandra Bose Kolkata, India 700047. Email: rudraneel93@gmail.com. We acknowledge grievances within 48 hours and aim to resolve them within 30 days.
We may update this policy. For material changes, we'll notify you by email or in the Console before they take effect, and update the "Last updated" date above.