Privacy Policy

1. Who we are

TrueWork is operated by Cloudhood, Inc. ("TrueWork", "we", "us"). We provide an anonymous peer-evaluation service for retail and service teams via our mobile apps (iOS and Android) and our website at thetruework.com.

You can reach our privacy team at hello@thetruework.com.

2. The data we collect

From everyone who creates an account

• Identification: your full name plus either an email address or phone number. We use whichever you provide to send one-time codes for verification and password recovery.
• Authentication credentials: a hashed password (we never store the plaintext) and, optionally, a refresh token tied to your device for biometric (Face ID / Touch ID) sign-in.
• Device information: when you grant permission, a push-notification token used solely to deliver alerts about evaluation cycles and reports.
• Language preference: your selected display language (English, Spanish, or Korean).

From store owners

• Store name, store time zone, and team membership information.
• Subscription information processed by Stripe for paid tiers. We receive a Stripe customer ID and the tier you selected; we do not store your card number.

From employees

• Your membership in one or more stores, including your role and start date.
• The evaluations you submit about teammates. These are stored without any identifier linking them back to you in any visible form — see the Anonymity guarantees section for the technical details.
• If you subscribe to Employee Premium ($2.99/month), the subscription receipt from Apple App Store or Google Play. We never receive your payment method.

Automatically collected

• Diagnostic logs of significant actions (a cycle was opened, results were published, an account was created). These contain user identifiers for auditability, but never together with evaluation content.
• Standard request metadata (IP address, user agent, timestamp) at the application layer, retained for 90 days for security and abuse prevention.

3. How we use data

We use the data we collect to:

• Operate the service: route evaluations to the right cycle, compute averages, deliver published results to the people entitled to see them.
• Authenticate you and recover your account.
• Send the alerts you've opted into (cycle reminders, results published, anonymous reports).
• Process subscriptions (owner tiers via Stripe, Employee Premium via Apple/Google).
• Detect and prevent abuse (rate limiting, suspicious patterns).
• Comply with legal obligations and respond to lawful requests.

We do not sell your personal data. We do not use evaluations to train AI models. We do not run behavioral ad networks. We do not share data with employers beyond the published aggregate results that are part of the service itself.

4. Anonymity guarantees

The most important promise in this policy is technical, not aspirational. When you submit an evaluation, the system stores who submitted it long enough to compute the aggregate result, then enforces these guarantees:

• Database-level lock on identity exposure. The evaluator-to-rating link exists in one internal table used only by the publish job. It is never joined into any API response, never logged alongside the ratee or the result, and never visible in any user-facing screen.
• No participation tracking. The service does not show "X of Y completed", "who finished", or "how many are left." Owners cannot infer which specific person did or did not participate.
• Anonymous reports. When you submit an anonymous report to your store owner, your device generates a one-way hash from a salt and a device-local identifier. The owner only ever receives the hash. The hash is used solely to enforce the 1-report-per-24-hours rate limit. It cannot be reversed.
• Anonymous votes. Your vote is recorded in a way that lets the system enforce "one vote per member" without storing your identity in the vote result. Owners see vote counts, never voter identities.
• Immutable history. Published results are written once and locked at the database level. Nobody — not your employer, not TrueWork — can edit or delete a published cycle.

If we ever change these guarantees, this policy will be updated and existing users will be notified before the change takes effect.

5. Sharing with third parties

We share the minimum data needed with the following service providers:

• Apple App Store and Google Play — for app distribution and Employee Premium subscriptions. Apple and Google handle payment and tell us whether your Premium subscription is active. We never receive your card number.
• Stripe, Inc. — for owner subscription billing. Stripe receives your billing details and tells us your subscription status.
• Cloud hosting — our application and database run on commercial cloud providers in the United States. They process data on our behalf under standard data-processing agreements.
• Email and SMS delivery — transactional notifications (verification codes, password resets) are sent via standard third-party providers.

We will disclose information to law enforcement only when legally compelled, and only the specific data the order covers. We will, where legally permitted, notify the affected user before complying.

6. Data retention

• Account information: retained while your account is active. After you delete your account, identifying fields are removed within 24 hours; see Your rights.
• Published evaluation results: retained indefinitely as part of your portable record. You can request removal of your own published history at any time.
• Anonymous reports: retained for 90 days from submission, then automatically deleted. If a store owner archives a report, it is retained for 3 years before deletion.
• Anonymous vote results: retained for 30 days after the poll closes, then automatically deleted.
• Diagnostic logs: 90 days, then automatically deleted.
• Backups: encrypted backups are retained for up to 30 days. Deletion requests propagate to backups on their normal recycle cycle.

7. Your rights and choices

Access and portability

You can view all of your own published evaluation results in the app at any time. Employees can generate a shareable, verifiable record (TrueResume) that you control and share on your own terms.

Deletion

You can delete your account from Settings → Delete account inside the app. Deletion is irreversible and takes effect within 24 hours: your name, email, phone, and authentication credentials are removed; your account is marked disabled; and any future evaluation activity is blocked. Your historical published results remain in the system in de-identified form (no name or contact attached), because removing them entirely would break aggregate calculations for cycles that included you.

If you would like your full record removed (including the de-identified historical aggregates), email hello@thetruework.com and we will process the request within 30 days.

Correction

You can update your name, contact information, and language preference at any time from in-app settings. Published cycle results are immutable by design and cannot be edited.

Marketing and notifications

You can disable push notifications from your device settings at any time. We do not send marketing emails; only transactional ones (verification codes, password resets, billing receipts).

Region-specific rights

If you are in the European Economic Area, the United Kingdom, or California, you have additional rights under the GDPR, UK GDPR, and CCPA respectively, including the right to know what personal information we hold about you, the right to deletion, and the right to opt out of any sale of personal information. We do not sell personal information in any jurisdiction. To exercise these rights, contact hello@thetruework.com.

8. Security

We take security seriously and apply the following safeguards:

• All traffic between your device and our servers is encrypted in transit (TLS 1.2 or higher).
• Passwords are hashed with bcrypt at cost factor 12; we never store plaintext passwords.
• Authentication tokens are short-lived and can be revoked by the user or by us at any time.
• Sensitive database tables are designed to support encryption at rest via key management. Data backups are encrypted.
• We operate the service with the principle of least privilege: most internal staff have no access to user data.

No system is perfectly secure. If you believe your account has been accessed without your permission, contact us immediately at hello@thetruework.com.

9. Children

TrueWork is intended for users 16 years of age and older. We do not knowingly collect personal information from children under 16. If you believe a child has provided personal information to us, contact us and we will delete it.

10. International users

TrueWork is operated from the United States. If you access the service from outside the United States, your information will be transferred to, stored in, and processed in the United States. By using TrueWork, you consent to this transfer.

11. Changes to this policy

We may update this policy from time to time. When we make a change, we update the "Last updated" date at the top. For changes that affect how we use your data, we will notify active users in the app or by email at least 30 days before the change takes effect. Your continued use of TrueWork after the effective date constitutes acceptance of the updated policy.

12. Contact

Questions, complaints, or requests about this policy or your data? Email us at hello@thetruework.com. We respond within 5 business days.