Privacy Policy
Truveal is built so that most of what people type is never tied to them. Nobody needs an account to join a game or answer a question, Voice answers are stored with no identifying field at all, and we sell nothing to anyone. This page explains exactly what is collected, by whom, and for how long.
Who this covers
This policy applies to truveal.co and the products on it — Truveal Play (live team quizzes and icebreakers) and Truveal Voice (anonymous team feedback). MHS Central is the data controller.
Two different roles appear throughout: a host, who creates a game or a feedback session, and a participant, who joins one. Participants never need an account.
Truveal Voice answers are stored anonymously
This is the most important thing on this page, so it goes first. When someone answers a Voice question, the stored record contains the session it belongs to, a generated display name such as "Curious Otter", a seed used to draw the matching avatar, the answer text, any follow-up answers, and a timestamp.
It contains no name, no email address, no IP address, no device identifier, and no account reference. There is no column to join against. Anonymity here is structural rather than a promise we are asking you to take on trust — a host cannot see who said what because we do not hold that link ourselves.
One consequence is worth stating plainly: because we cannot tell which answer belongs to which person, we cannot retrieve or delete an individual answer on request. The host who created the session can delete the whole session, which deletes every answer in it.
What we collect
We never ask for a date of birth, a phone number, a postal address, or a photograph, and there is nowhere in the product to provide them.
| Who | What is collected | Why |
|---|---|---|
| Anyone visiting the site | Standard web request data, plus product analytics (see below) when enabled | To keep the site working and understand which pages are useful |
| Play participants | A display name (assigned automatically from a word list — you are not asked for your real name), your answers and score in the game, and a reconnect token so a dropped connection can rejoin | To run the game and put you back in it if your connection drops |
| Play hosts | The same as participants, plus the questions and settings you create | To run the game you are hosting |
| Voice participants | Your answer and follow-up answers, a generated avatar name and seed, and a timestamp — nothing identifying | To show the host the themes across all answers |
| Account holders | Your email address, your plan, and the sessions you own | To sign you in and show you your own sessions |
| Pro subscribers | Subscription status and billing identifiers from our payment provider | To give you the plan you paid for |
Payment details
Card details are handled entirely by our payment provider and never reach our servers. We cannot see your card number, and we do not store it. We receive only the fact of a subscription, its status, and the identifiers needed to manage it.
Analytics and session recording
We use a product analytics service to monitor page views, clicks, errors, and page-performance measurements, so we can find and fix what is broken or confusing. It is not used for advertising, and we do not run ad trackers.
The same service provides session recording, and it is worth being precise about where it runs, because the answer is narrower than most products:
- Recording is switched off across the site by default. It does not run on the homepage, any marketing page, the blog, or anywhere in Truveal Voice.
- It starts only once you are inside a live Truveal Play game room, and it stops being relevant when the game ends.
- Everything typed into an input is masked before it leaves your browser, so recordings do not contain what you typed.
- Addresses that carry a secret — a Voice host dashboard link or a shared report link — are redacted before any analytics event is sent, so those credentials never reach our analytics provider.
- Analytics profiles are only created for people identified in a game; visitors browsing the site stay anonymous. The identifier used is a random participant id generated for that game, not your name or email.
How AI is used, and what it sees
Truveal Voice uses a large language model to ask follow-up questions, group answers into themes, and write a short summary. To do that, the text of the answers in a session is sent to a third-party AI provider, which processes it under contract and returns the result. It does not use your content to train its models.
The text sent is the answer content only. Because we hold nothing identifying alongside an answer, there is nothing identifying to send.
Themes shown to a host include a representative phrase, which is always a paraphrase written by the model and never a verbatim quote. This is deliberate: a verbatim sentence can identify its author to colleagues even when the record is anonymous.
Truveal Play does not use AI, and nothing in a Play game is sent to a model provider.
Sharing
We do not sell personal data, and we do not share it for advertising.
Like any online service, Truveal runs on third-party infrastructure — hosting, a database, analytics, payments, and the AI provider described above. They process data only on our instructions, to make the product work.
IP addresses
Your IP address is used briefly, in memory, to rate-limit abusive traffic such as repeated password guesses against a locked room. It is not written to our database and is not attached to anything you type. Our hosting and infrastructure providers keep their own request logs, as any web host does.
Cookies and local storage
We do not use advertising or cross-site tracking cookies. Your browser stores a small amount of data so the products can work: a sign-in session for account holders, and a reconnect token so a dropped game connection can rejoin. Analytics sets its own identifier when enabled.
How long we keep things
- Play game sessions are short-lived and are deleted automatically on a schedule after the game — they are not a permanent record.
- Voice sessions, their answers, and the generated themes stay until the host deletes the session or their account.
- Account data stays until you delete your account, after which it is removed.
- Analytics data is retained by our analytics provider under its own retention schedule.
Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a copy, object to certain processing, or complain to your local data protection authority. To exercise any of these, email hello@truveal.co.
The practical limits are worth knowing in advance. For an account, we can retrieve and delete everything tied to it. For a Voice answer, we genuinely cannot — there is no identifier connecting it to you, so we have no way to find it. For a Play game, records are short-lived and will usually have been deleted automatically before a request reaches us.
International transfers
Our providers operate in various countries, including the United States, so your data may be processed outside the country you live in. We use providers that offer appropriate safeguards for those transfers.
Children
Truveal is a workplace tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided personal data, contact us and we will delete it.
Changes to this policy
If we change how data is handled in a way that affects you, we will update this page and change the date at the top. Continuing to use Truveal after a change means you accept the updated policy.
Contact
For privacy questions or requests, email hello@truveal.co.