Privacy policy
In short
- The apps store data on your computer. We do not receive your tickets, comments, notes or other content you type.
- The apps have no user accounts, analytics or telemetry. turndesk.app counts visits and downloads without cookies, with a tool running on our own server.
- The apps contact our server only for updates and licence keys. The server does not log these requests.
- If you buy a licence or write to us, we process your contact and invoice details to answer, perform the contract and keep the accounting records the law requires.
Controller
The controller of the personal data described in this policy is CODCUBE Krzysztof Krupski, ul. Dunikowskiego 22, 56-200 Góra, Poland, NIP 5010073322, REGON 361126767. For matters concerning personal data, write to kontakt@codcube.pl or to the postal address above. We have not appointed a data protection officer, because Art. 37 GDPR does not require one.
Data on your computer
Turndesk and Turndesk Tray run on your computer and connect directly to your Easy8 or Redmine server. On your computer, the apps keep and process:
- tickets, comments, attachments, time entries and other data from Easy8 or Redmine,
- your notes, reminders, saved tickets and agent proposals,
- information about your habits that the apps use to plan your day,
- meetings from your calendar and the times of your Microsoft Teams calls, which Turndesk uses to suggest work hours,
- your conversations with an AI model,
- your Easy8 or Redmine API key and AI provider keys.
We do not receive any of this data. The apps keep API keys in the system keychain (Keychain on macOS, Credential Manager on Windows, Secret Service on Linux) and all other data in the apps' data folder. Deleting the apps together with that folder and their keychain entries removes this data entirely; we have no copy. The section "Connections the apps make" describes what the apps send to others, such as an AI provider.
Connections the apps make
Your Easy8 or Redmine server
The apps read and change tickets through the Easy8 or Redmine API, using the address and key you enter. They send a change only after you click. A change made without a connection to the server is sent when the connection is back. Your company is the controller of that data. We are neither the controller nor a processor of that data, because we do not receive it.
Update check (updates.turndesk.app)
At start-up and then every 6 hours, the apps ask our server for the newest version number. When there is a new version, they download the installer. The server receives your IP address in the process. The server does not log requests (it keeps no access logs). An IP address can be written to the server's system log only for a technical event, such as a connection error. Entries in that log are deleted automatically after 14 days. The legal basis for processing the IP address is our legitimate interest in delivering updates and security fixes (Art. 6(1)(f) GDPR). Older versions of the apps reach the same server at e8.codcube.pl, under the same rules.
Licence key (updates.turndesk.app)
The licence key is checked on your computer; the apps do not send us the number of people or the end date. With each update check, the apps also ask our server whether there is a newer key for your licence. That request contains only the licence ID, a random string assigned to your company's licence.
If the team set up in Turndesk has more than five people and Turndesk has no valid licence key, it asks our server whether there is a key for your Easy8 or Redmine server. It asks with each update check and each time you save the team. That request contains only the server's host name, such as easy.example.com.
Both requests follow the logging rules described under the update check. The legal basis is the performance of the licence agreement (Art. 6(1)(b) GDPR). We keep the details of the licences we issue (customer name, number of people and licence period) as contract records, for the period set out in the table under "When you buy a licence or write to us".
Public holidays (date.nager.at)
Turndesk Tray first takes days off from the working calendar in Easy8. If that calendar has no days off, the Tray asks the Nager.Date service, run by Tino Hager in Austria, for its list of countries and for the holidays of the chosen country in the previous, current and next year. The requests contain only the year and the country code; the Tray sends them about once every 30 days. Nager.Date receives your IP address and processes it under its own privacy policy; we do not receive these requests. Instead of this service, you can enter a link to your own holiday calendar, which the Tray fetches directly from that address about once a week, or set weekends as the only days off.
Meetings calendar (optional)
Turndesk can suggest work hours from the meetings in your calendar. On macOS it reads events from the Calendar app if you allow this in the system prompt. You can also enter a link to an .ics calendar; Turndesk fetches it directly from that address when it prepares suggestions, and keeps the link itself in the system keychain. On macOS Turndesk also reads the times of your Microsoft Teams calls from the system power log. This data stays on your computer.
AI providers (optional)
AI features are off until you enter your own Anthropic or OpenAI API key. After that, the app connects to the provider when you ask a question or start an AI feature. When you save the key or open the AI settings, the app fetches the list of models from the provider. The request goes from your computer directly to the chosen provider and contains your question and the ticket data needed to answer it.
Before sending the request, the app removes secrets such as passwords and keys, and card numbers, IBANs, phone numbers, PESEL and NIP numbers. At the default access level it also replaces the names of people it knows from Easy8 or Redmine, and email addresses, with labels such as Person-1 (pseudonymisation). The Everything level turns this off. The app detects this data automatically and may not catch every case, and ticket text may also contain other personal data. Before switching on AI features, check that your employer allows such data to be passed to an AI provider.
The provider processes the request under the agreement you or your company concluded with it and under its own policies (Anthropic, OpenAI). We take no part in that exchange and have no access to it.
MCP server for AI agents
Turndesk can act as an MCP server for an AI client running on your computer, such as Claude Code or Codex. The server gives the client the copy of data Turndesk keeps on your computer: tickets with their comments and attachments, your notes and reminders, logged time, and the team's load and history. Turndesk fetches a ticket that is not in that copy yet from Easy8 or Redmine. The client does not get the API key. What the AI client does with this data, including whether it sends it to its own provider, is governed by the client's own terms. The client's proposals change nothing in Easy8 or Redmine until you accept them in Turndesk.
Websites
codcube.pl, turndesk.pl, turndesk.eu and turndesk.app are static websites on our server. They use no cookies and load no fonts or scripts from other servers. The web server does not log visits (it keeps no access logs). Your IP address is processed while the page is sent and under the system log rules described under the update check. The legal basis is our legitimate interest in making the sites available (Art. 6(1)(f) GDPR). The DNS servers for these domains are run by Cloudflare; traffic to the sites does not pass through Cloudflare.
If you switch on dark mode, your browser saves that choice in its own storage (localStorage) and does not send it to us. Storing it is strictly necessary for a feature you choose, so it does not require consent (Art. 399(3)(2) of the Polish Electronic Communications Law).
On turndesk.app we collect statistics with Umami, an open-source tool running on our server. The statistics show us how many people visit the site and download the apps, and where they come from. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).
When a page opens, a script from turndesk.app sends us the page address and title, the address of the page you came from, your screen size and your browser's language. When you click a download button, a link to the download page, a licence key request or our email address, the script also sends the name of that element and the part of the page it is in. From your IP address and browser identification (User-Agent) the server derives the country, region and city, the browser, the operating system and the device type. It also derives a visitor identifier that changes every day, so visits on different days cannot be linked. The server does not store the IP address or the User-Agent. We delete the statistics after 13 months. The script sets no cookies and stores nothing in your browser. If your browser sends a Do Not Track signal, the script sends nothing.
When you buy a licence or write to us
We process the details you give us: name, company name, email address, phone number if you give it, invoice details and the content of our correspondence. If your company gave us your details, for example by naming you as the contact person for the licence, they come from your company and include your name, work email address, phone number and job title.
| Purpose | Legal basis | Retention |
|---|---|---|
| Answering questions, preparing an offer, providing a trial version | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering (Art. 6(1)(f) GDPR) | Up to 12 months after the last message, if no contract is concluded |
| Concluding and performing the contract: licence key, app versions, technical support | Performance of the contract (Art. 6(1)(b) GDPR); for a contact person named by a company: our legitimate interest in performing the contract with that company (Art. 6(1)(f) GDPR) | For the term of the contract, then until the limitation period for claims expires |
| Invoices and accounting records | Legal obligation under tax law (Art. 6(1)(c) GDPR) | 5 years from the end of the calendar year in which the tax payment deadline passed (Art. 86 § 1 in conjunction with Art. 70 § 1 of the Polish Tax Ordinance) |
| Establishing, pursuing and defending claims | Our legitimate interest in protecting our rights (Art. 6(1)(f) GDPR) | Until the limitation period expires; for claims related to business activity, as a rule 3 years, with the period ending on the last day of a calendar year (Art. 118 of the Polish Civil Code) |
Providing invoice details is a statutory requirement. Providing an email address is a condition of concluding and performing the contract, because we send the licence key to that address. Without these details we cannot sell a licence. Providing any other details is voluntary.
Recipients
- The company in Poland from which we rent our server.
- Our email provider in Switzerland. The European Commission has found that Switzerland provides an adequate level of personal data protection (Decision 2000/518/EC of 26 July 2000).
- Those who handle our accounting, and our bank, to the extent needed to issue invoices and settle payments.
- The National e-Invoice System (KSeF) run by the Head of the National Revenue Administration (Szef Krajowej Administracji Skarbowej), when we issue an invoice in it.
- Public authorities, where the law requires us to disclose data.
We do not sell personal data or share it for other parties' marketing. Apart from the transfer to Switzerland, we do not transfer data outside the European Economic Area.
Security
Connections to our server are encrypted (HTTPS). Only people who need access to run the business can reach the server and the mailbox. We sign updates and licences with keys kept off the server; the apps check an update's signature before installing it.
Your rights
You have the right to request access to your data, a copy of it, its rectification, erasure and restriction of processing. You can also receive data processed under a contract in a structured format that can be passed to another controller. Send requests to kontakt@codcube.pl. We will respond within one month of receiving the request. If the request is complex or there are many requests, we may extend this by two months; we will tell you so before the first month ends and give the reason. If we have reasonable doubts about your identity, we may ask for additional information. We will not delete invoices or other data we must keep by law before the required period ends.
If you believe we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl.
We do not take decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.
Right to object
On grounds relating to your particular situation, you may object at any time to processing of your data based on our legitimate interest (Art. 21 GDPR). We will then stop processing that data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed to establish, pursue or defend claims.
Changes to this policy
We publish an amended policy on this page with a new version number and effective date, and summarise the changes at the top. If a change concerns data sent by the apps, we publish it before releasing the app version it applies to. Earlier versions are available on request.