Last updated: October 2026
IMPORTANT: This site contains +18 content (pictures). Please do not register if you are under 18 years old.
This service is not directed at children. We do not knowingly collect personal data from anyone under 18 years of age; if we become aware that such an account exists, we will delete it together with all associated data.
A. Introduction & Data Controller
TurboWrappers (turbowrappers.com) is a non-commercial hobby project for collectors of chewing-gum wrappers, packaging and unopened gum. It is operated by a private individual (a natural person), not a company. The operator acts as the data controller for all personal data processed through this site.
Contact: turbogumwrappers@gmail.com. The data controller's identity will be disclosed on request via this email address.
We are committed to protecting the personal information of our users. This statement explains what data we collect, the legal basis for processing it, how long we keep it, and what your rights are.
By registering an account you acknowledge that your personal data will be processed as described in this statement. Note that most processing is based on the performance of our contract with you or on our legitimate interests (see section C), not on consent; where we rely on consent, we ask for it separately.
B. Personal Information We Collect
We may collect, store and use the following types of personal information:
Account data: username, email address, hashed password, role, language, country, city, optional avatar/badge, registration date, last-login timestamp.
Collection data: which papers (wrappers, covers, gums) you own, which you offer for exchange, and which series you are actively collecting.
Bad-condition list: papers you own in poor quality and wish to replace.
On-the-way list: papers currently in transit to/from you.
News feed entries (activity announcements visible to other collectors).
Optional donation history (PayPal donations made to the site).
Activity / login history (pages visited within the site, login date and platform), kept for security and abuse-prevention purposes.
Private messages exchanged with other collectors (see section K).
Email-verification and password-reset tokens, used only to confirm your email address or reset your password.
If you sign in with Google: your Google account identifier (subject ID) and the email address provided by Google (see section P).
The timestamp of your acceptance of this privacy statement (proof of consent/acknowledgement).
Profile data: the optional "About me" text and profile picture.
Further collection data: boxes and accessories you own or offer for exchange, and the monthly (P.No) marks of Turbo Kent covers and gums.
Site activity: earned badges, completed games, the acknowledgement that you have read the Help page, series requests you have submitted, and recognitions (e.g. bug finder, supporter).
We do NOT store on our servers: postal addresses, phone numbers, payment card data, identity documents, GPS location or IP address. However, when your browser loads third-party resources embedded in the site (see sections E and F), those third parties technically receive your IP address.
C. Legal Basis for Processing
We process your personal data on the following legal bases (GDPR Art. 6):
Performance of a contract (Art. 6(1)(b)): Account management, collection data, exchange activity, feed entries and private messages are all necessary to provide the service you signed up for.
Legitimate interests (Art. 6(1)(f)): Activity and login history are retained to protect the security of the service and to detect and prevent abuse. The Google reCAPTCHA check on the registration form (see section Q) is likewise based on our legitimate interest in preventing automated/bot registrations.
Consent (Art. 6(1)(a)): Language-preference cookies are set with your consent. You may withdraw consent at any time via your browser settings. Signing in with your Google account (see section P) is entirely optional and happens only at your initiative.
Legal obligation (Art. 6(1)(c)): We may process or retain data where required to comply with applicable law (e.g. responding to lawful requests from authorities).
D. How We Use Your Information
We use your personal information to:
Operate and administer this website;
Personalise your experience on the site;
Make the collection and exchange features available to you;
Display your public profile (username, country, city, email address) in the user list so that other registered members can contact you for exchanges — this is the core purpose of the site;
Send you transactional (service) emails: account activation, password reset, and inactivity warnings before account deletion (see section G). We do not send marketing or newsletter emails.
We will not transfer your personal information to third parties for direct marketing purposes.
E. Disclosure of Personal Information & Service Providers (Processors and Recipients)
We may disclose your personal information:
To the extent required by applicable law;
In connection with ongoing or future legal proceedings;
To establish, exercise or defend our legal rights.
In addition, the following service providers process limited personal data on our behalf or as independent controllers when you use the site:
Google (Gmail SMTP): Transactional emails (activation, password reset, inactivity warnings) are sent through Google's Gmail service; Google therefore processes your email address and the content of these service emails.
Google reCAPTCHA: Used on the registration form to prevent bot registrations (see section Q).
Google Sign-In: Optional login with your Google account (see section P).
PayPal: If you choose to donate, the payment is handled entirely by PayPal on PayPal's own website under PayPal's own privacy policy; we never receive or store your payment details — we only record that a donation was made (see section B). The PayPal donate button on our About page loads a script from PayPal's servers.
Content delivery networks (CDNs): Some fonts, stylesheets and JavaScript libraries are loaded from third-party CDNs (Google Fonts, Cloudflare cdnjs, jsDelivr, DataTables CDN). When your browser fetches these resources, the CDN provider technically receives your IP address and browser metadata. These providers act as independent controllers for that processing.
OpenAI (AI Help assistant): The questions you type into the optional AI Help assistant are sent to OpenAI to generate the answer (see section R).
Hosting provider: The servers on which the site and its database run.
Except as described in this statement, we do not share your personal information with third parties, and we never sell your data.
F. International Data Transfers
Your account and collection data are stored and processed on servers located within the European Union.
Some of the service providers listed in section E (Google, PayPal, Cloudflare and other CDN operators) are headquartered in the United States, so limited data (e.g. your email address for service emails, or your IP address when your browser loads embedded third-party resources) may be transferred to the USA. These providers are certified under the EU–U.S. Data Privacy Framework and/or rely on the European Commission's Standard Contractual Clauses (SCCs) as safeguards under Chapter V of the GDPR.
We do not sell or share your data with overseas third parties for marketing or analytics purposes.
By accessing this site from any country you acknowledge that data may technically traverse international network infrastructure.
The questions typed into the AI Help assistant, together with the related context, are processed by OpenAI in the United States (see section R).
G. Retention of Personal Information
Account and collection data are retained for as long as your account is active.
If you have not logged in for more than 3 years, we will send a warning email. If no login follows within 30 days of the warning, your account and all associated data may be deleted as a data-minimisation measure.
You may request immediate deletion of your account and all associated data at any time (see section I).
Login / activity logs are retained for a maximum of 3 years for security purposes.
Email-verification and password-reset tokens are single-use and are deleted once used or expired.
Donation history is retained for as long as your account exists and is deleted together with the account.
H. Security
We take appropriate technical and organisational measures to prevent loss, misuse, or unauthorised alteration of your personal information.
All personal data is stored on password- and firewall-protected servers.
Passwords are stored as a one-way bcrypt hash; we cannot recover your original password.
Private message subjects and bodies are stored AES-encrypted at rest in the database.
All data in transit between your browser and our server is protected by HTTPS/TLS.
You are responsible for keeping your password confidential.
I. Your Rights Under the GDPR
If you are resident in the EU/EEA you have the following rights regarding your personal data:
Right of access (Art. 15): You may request a copy of the personal data we hold about you.
Right to rectification (Art. 16): You may correct inaccurate or incomplete data. Most account data can be updated directly via the Settings page; for anything you cannot change yourself, contact us.
Right to erasure / "right to be forgotten" (Art. 17): You may request deletion of your account and all associated personal data. Contact us at turbogumwrappers@gmail.com.
Right to restriction of processing (Art. 18): You may ask us to restrict the processing of your data in certain circumstances (e.g. while accuracy is contested).
Right to data portability (Art. 20): You may request your data in a structured, commonly used, machine-readable format.
Right to object (Art. 21): You may object to processing based on our legitimate interests.
Right to withdraw consent: Where processing is based on consent (e.g. cookies), you may withdraw that consent at any time without affecting the lawfulness of prior processing.
To exercise any of the above rights, contact us at turbogumwrappers@gmail.com. We will respond without undue delay and in any event within one month of receiving your request (extendable by up to two further months for complex requests, in which case we will inform you). Exercising these rights is free of charge. We may ask you to confirm your identity (e.g. by writing from the email address registered on your account) before acting on a request.
Automated decision-making: We do not use your personal data for automated decision-making or profiling within the meaning of Art. 22 GDPR.
J. Right to Lodge a Complaint
You have the right to lodge a complaint with a data-protection supervisory authority. If you are located in Hungary, the competent authority is:
NAIH — Nemzeti Adatvédelmi és Információszabadság Hatóság
Website: www.naih.hu
If you are located in another EU/EEA member state, please contact your national data protection authority.
You also have the right to an effective judicial remedy before the courts (Art. 79 GDPR), without prejudice to any complaint lodged with a supervisory authority.
K. Private Messages
The site offers a private messaging feature between collectors. Important details:
Fields stored per message: sender user ID, recipient user ID, thread ID, subject, body, creation timestamp, last-update timestamp, read flag.
Subject and body are stored AES-encrypted at rest; they are decrypted only when the legitimate sender or recipient reads them.
Only the two participants of a conversation can read its contents. Administrators do not normally read user messages.
Messaging is restricted to users with the Collector, Admin or Developer role.
Message content is never shared with third parties for advertising or analytics; it may only be disclosed where strictly required by law or court order.
Messages are retained as long as your account exists. Deleting your account also removes your messages.
When an account is deleted, its conversations are removed for both participants.
L. Cookies
This website uses cookies as follows:
Session cookie (JSESSIONID): Strictly necessary to keep you logged in. Deleted when the session ends.
Language cookie ("lang"): Remembers your selected language.
Google reCAPTCHA cookies: On the registration page only, the embedded Google reCAPTCHA widget may set its own cookies (see section Q).
Browser local storage (localStorage): Stores technical and preference settings in your own browser only (e.g. acceptance of the cookie notice, display theme, view preferences, session-timeout activity). This data is not sent to us or to third parties.
We do not use advertising, tracking or analytics cookies. Our own cookies do not contain personally identifying information beyond what is strictly necessary for the functioning of the site.
M. Third-Party Websites
Our website may contain links to third-party websites. We have no control over, and are not responsible for, the privacy policies or practices of those sites.
N. Changes to This Statement
We may update this privacy statement from time to time. The date at the top of this page shows when it was last updated. Where significant changes are made, we may notify you by email or via the site's private messaging system.
O. Image Search – Uploaded Images
The Image Search feature allows you to upload a photo to find visually similar wrappers, covers or boxes in the collection. Uploaded images are used only for the duration of the search request and are never permanently stored, never logged, and never shared with third parties. The image is discarded immediately after the similarity search is complete.
P. Google Sign-In (Optional)
You may optionally sign in to an existing TurboWrappers account using your Google account:
When you use Google Sign-In, Google provides us with your Google account identifier (subject ID) and email address. We use these solely to match and link your existing TurboWrappers account; the Google ID is stored so that future Google logins work.
Google Sign-In cannot be used to create a new account — registration is only possible via the normal registration form.
We do not receive your Google password, contacts, or any other Google account data.
Google processes your data during sign-in as an independent controller under its own privacy policy: policies.google.com/privacy.
Legal basis: performance of a contract (Art. 6(1)(b)) — providing the login method you chose to use.
Q. Google reCAPTCHA
The registration form is protected by Google reCAPTCHA v3 to prevent automated (bot) registrations:
The reCAPTCHA widget is loaded from Google's servers. When you visit the registration page, Google receives your IP address, browser information and may set its own cookies to determine whether you are human.
We do not receive or store any of this data ourselves; we only receive the pass/fail result of the check.
Google acts as an independent controller for this processing under its own privacy policy: policies.google.com/privacy.
Legal basis: our legitimate interest (Art. 6(1)(f)) in protecting the service against abuse and automated registrations.
R. AI Help Assistant (Chatbot)
The site offers an optional AI assistant that answers questions about TurboWrappers. Its answers are generated through the API of OpenAI (USA).
Data sent to OpenAI: the text of your question and the relevant parts of the site's content (Help, catalogue, public statistics). If your question names a collector, the profile data that you are allowed to see on the site (e.g. username, country, location, collection counts and, if visible to you, email address) may also be included.
We never send your password, your private messages or your session data. Please do not enter personal data in your questions.
We do not store the questions or the answers in our database; the activity log only records that the assistant was used.
According to OpenAI's API data-usage policy, data sent through the API is not used to train its models and is retained by OpenAI for a limited time (up to 30 days) for abuse monitoring only.
Legal basis: our legitimate interest (Art. 6(1)(f)) in providing help to users. Using the assistant is entirely optional.