Privacy Policy

1.Summary

• What we collect. The details you enter at sign-up and in settings, everything you submit while working on a campaign, and the milestone events a publisher's backend sends us about you.
• Why. To match you with campaigns you can actually complete, to check that a milestone really happened before anyone is charged or paid, to pay you, and to settle disputes.
• What publishers get. Your answers, plus your first name and last initial, your contributor level, your country and your contributor score. Not your email address, not your full name.
• Who else handles it. Supabase stores it and runs sign-in, Vercel serves it, Stripe moves the money — plus Google, but only if you choose to sign in with Google.
• What we never do. Sell your data, use it for advertising, or show one publisher what you did for another.

2.What is collected

Every item below is a real field in the Tryvoa database, grouped by where it comes from. Beside them sit a few mechanical ones — how far through onboarding you got, the point target for your next level — and nothing else.

Your account

• Your email address and password, held by Supabase Auth. We never see the password itself. Sign-in is email and password, and where the Google button is shown, Google sign-in as well — in which case the email address and name on your Google account are what reach us.
• Your name as you type it, and the initials we derive from it for your avatar.
• Your country, the languages on your profile, the device types you said you own, and the product interests you picked during onboarding.
• The year you joined, your notification preferences, and a referral code.

What you do on a campaign

• Which campaigns you started, when you started them, when the attempt expires, and the tracking code issued for that enrolment.
• Which milestones you completed, which are still verifying, and the times of both.
• Research missions you booked or completed, and the interview slot you chose.

What you write

• Survey answers, stored exactly as you typed them.
• Usability task results: the outcome, the difficulty rating and any note you added.
• Bug reports: severity, title, description, and the reproduction steps.
• Dispute cases: the reason, the amount claimed, your written detail, and every message you send in the case thread. Messages you post carry your full name inside the case.

Money

• Every reward: what it was for, which campaign, the amount, and whether it is pending or approved.
• Your balance, pending total, today, this-month and lifetime earnings, and the running total of your bug bonuses.
• Every withdrawal: amount, status, the Stripe transfer id, and the failure reason if a transfer did not go through. See section 4 for what Stripe holds.
• Referral records and referral earnings.

Reputation

• Your contributor score and level, completion rate, feedback quality rating, campaigns completed, and ratings publishers have given you.
• Counts of valid and duplicate bug reports, and a count of fraud flags on your account.

Events publishers report

When you complete a step inside a publisher's product, their backend calls the Tryvoa events API. We store the event name, the campaign it matched, the milestone it unlocked, your account id, and the properties their backend chose to send — kept verbatim as text, whatever those properties happen to contain. Each event is recorded as either verified or held.

Before a milestone pays, that event is scored against a handful of signals: how new the account is, how many milestones it has cleared in the last hour, whether the campaign was completed far faster than its stated time, how many other accounts have recently used the same connection, and whether recent events from the account were already held. The publisher’s own report can also flag an anonymised connection. Which signals fired is stored against your account so a held event can be explained to you if you dispute it.

If the publisher sends the address an event came from, it is hashed with a secret salt before it reaches the database and the raw address is discarded. The hash is only ever compared with other hashes, which is enough to notice one connection behind several accounts without keeping the address, and it cannot be turned back into one.

An event is held for one of two reasons. The first is the fraud check, which today reads one thing only: the connection signal in the properties the publisher sends, so an event whose properties mark the connection as a VPN is held rather than paid. The second is money — if what is left of the campaign's budget cannot cover the reward plus the platform fee, the event is recorded as held and nobody is credited. Either way it is not charged to the publisher and not paid to you. Nothing in the app releases a held event on its own. The help centre explains how to get one reviewed.

Research sessions

Booking a moderated interview stores which mission you booked, which slot you took, and whether you have completed it. Finishing a comparison test stores your written answers as a survey response. Nothing else is captured: screen-recorded missions were withdrawn from the product, so Tryvoa does not record your screen, microphone or camera, and there is no audio file, video file or transcript of you anywhere in it.

Business accounts

If you open a business account you can give it a name; leave that field blank and it takes your profile name. Its support address is set to your email address and is shown only on your own business settings screen — contributors cannot read it, because the database lets only an account's own members read a publisher row. What contributors do see is the account id, built from the name plus six characters, which campaign pages turn back into a name. So a business account created with that field blank puts your profile name in front of every contributor who browses its campaigns. The secret key issued to the account is stored so we can authenticate your backend's events.

What is not collected

No advertising identifiers. No browsing history from outside Tryvoa. No card numbers, bank details or government ID (those go to Stripe, never to us). No location we work out ourselves: your IP address is never stored, and the country on your profile is the one you picked. No device fingerprint: where you see a device line on this site, it was written by us or sent by the publisher, not read from your machine.

One caveat on both of those. The event properties described above are stored exactly as the publisher's backend sends them, and we do not filter what goes in them — an IP address or a device string a publisher chooses to include is stored with the event.

3.What publishers see

This is the section most people want. A publisher can read the feedback, bug reports, sessions and events belonging to their own campaigns, and nothing else. They cannot read your profile: the database only lets a profile row be read by the person it belongs to, so there is no lookup from a response back to your account.

Your name, as it is written

When you submit a survey or a research answer, the code writes a redacted name: the first word of your profile name, a space, then the first letter of the second word followed by a full stop.

If your profile name is a single word, only that word is written and nothing follows it. Anything after your second name is never written.

The line beside your name

Alongside the name, one string is stored, made of your contributor level, your country and the fixed word desktop, joined by middots:

The word desktop is literal text in the code. It is not read from your device and does not describe what you actually used.

With a survey answer, a publisher also sees

• Your answers, word for word.
• Your contributor score as a number, and how many milestones you had completed at the time.
• A "time in product" figure. This is calculated from your milestone count, not measured from your actual session.
• A device label. It is the column's default value, the word Chrome; nothing in the app ever writes a different one.
• The timestamp of the submission.
• Most of that, downloadable by the publisher as a CSV: the name, the level-and-country line, the device label, your score, the timestamp and your answers. The time-in-product figure and the milestone count show on screen but are not in the file.

With a bug report

No name at all. The publisher sees the severity, the title, your description and reproduction steps as written, the tracking code from your enrolment, a device line Tryvoa fills in with a fixed value, and a reporter label of this form:

With a research session

A comparison test is filed as an ordinary survey response under the mission's own key, so it carries the same fields the survey list above describes — your shortened name, your score, your answers, and a meta line that on this route always ends in the fixed word desktop:

A booked interview stores only the booking itself: which mission, which slot, and whether you completed it.

Where research work actually lands is worth saying plainly, because it is not the mission's own publisher. A research answer is filed against a fixed campaign id left over from the seeded catalogue. Every seeded publisher was left without an owner when that catalogue was retired, and only an account's own members can read its rows, so nobody can read it through the app today. That is how the code happens to behave, not a protection we designed, and it will change when research is wired to real publishers.

On the event log

The event name, the milestone it matched, whether it was verified or held, and the exact properties their own backend sent us — that last part is their data coming back to them. The stored properties also carry a user id: the one their backend sent, or, if it sent none, the Tryvoa account id of the contributor the event was matched to.

The account id

Each response and report row carries your account id, a random identifier. It cannot be used to look you up, because publishers cannot read profiles. But the same id sits on every response you give, so a publisher can tell that two answers to their campaign came from the same contributor.

What a publisher never sees

Your email address. Your full name. Your password. Your balance, earnings or payout details. Any campaign you did for anyone else. Nothing in the app copies your dispute messages to a publisher: a case and its thread are readable only by the account that opened them, there is no publisher-facing view of either, and nothing resolves a case automatically. If a publisher rejects your feedback, you have 14 days to appeal from Support & disputes, and disagreeing with what you said is not a valid reason for rejection.

4.Payments data

Stripe is the payment processor on both sides of Tryvoa. We never hold card numbers or bank details.

• Publishers add funds through Stripe Checkout, on Stripe's own pages. Card details are entered there and never reach Tryvoa. We store the Stripe customer id so a second top-up recognises you.
• Contributors are paid through a Stripe Connect Express account. You start it from Tryvoa and finish it on Stripe: your identity documents, date of birth, address and bank details are given to Stripe directly, and Stripe runs its own verification. We never see them and never store them.

What Tryvoa keeps from that arrangement is short: your connected account id, whether Stripe has enabled payouts on it, a payout method label (the words "Stripe payouts" and the display name Stripe returns), and for each withdrawal the amount, its status, the Stripe transfer id and any failure reason.

Withdrawals start at $20; the database refuses anything smaller. Before every withdrawal we ask Stripe whether your account can still receive transfers — the answer is Stripe's, not ours. Stripe can refuse a payout, delay it while verification is outstanding, or reverse a transfer after it has been sent, and we cannot override any of that. If a transfer fails, the money goes back onto your Tryvoa balance.

Stripe handles what it collects under its own policy: stripe.com/privacy.

5.Processors

Three companies handle Tryvoa data on our behalf, and a fourth only if you choose to sign in with Google. That is the whole list.

• Supabase — the Postgres database and the authentication service. It holds everything in section 2 and runs sign-in, which serves on login.tryvoa.app. Any account email you get from Tryvoa, such as a sign-up confirmation, is sent by Supabase.
• Vercel — hosts and runs the site. Every request passes through Vercel, so it handles the usual serving data: your IP address, your browser's user agent and the URL requested.
• Stripe — payments, payouts and the identity verification behind them, as described in section 4.
• Google — only where the "Continue with Google" button is shown, and only if you use it. Google runs that sign-in and passes Supabase the email address and name on your Google account. Nothing else on this site touches Google: the typefaces are downloaded when the site is built and served from our own domain, so viewing a page sends Google no request.

There is no analytics vendor, no advertising network, no email marketing tool and no session-replay tool wired into this app. If one is ever added, it will be named here first.

6.Cookies

Tryvoa sets one kind of cookie: the Supabase session cookie, named sb-<project>-auth-token and sometimes split across numbered cookies when it is too large for one. It holds your signed-in session. Without it you would be signed out on every page.

That is the only cookie this app sets. No analytics cookies, no advertising cookies, no third-party trackers — which is why there is no cookie banner asking you to accept anything. Stripe's own pages set their own cookies while you are on them, under Stripe's policy.

7.Retention

While your account is open, everything in section 2 stays. Reward and withdrawal records are kept as the record of what you were paid.

If your account is deleted, your profile, wallet, reward history, notifications, disputes, referrals, enrolments and usability task results are deleted with it. Other work you already submitted is not: survey responses, bug reports and research session records stay with the publisher, with the link to your account removed. The redacted name and the level-and-country line were written into those rows at the moment you submitted them, and they remain there. A business account you created is not deleted either — it is left without an owner, which means nobody can administer it.

Recorded sessions need a plain answer, because earlier versions of this notice made retention promises about them. Screen-recorded missions have been withdrawn from the product: nothing in Tryvoa captures a screen, a microphone or a camera, so there is no recording of you to retain, to hand over, or to delete. The 90-day retention window and the 24-hour deletion window this notice used to quote described a feature that never shipped; they are not in force and there is nothing they could apply to. If capture is ever built, what is kept and how to delete it will be stated on the mission before you start.

There is no automatic deletion schedule running. Nothing is deleted on a timer.

The policy is this: records of money — rewards, withdrawals, publisher charges and invoices — are kept for seven years after an account closes, the period Canadian tax and payment record-keeping requires. Everything else — profile, survey answers, bug reports, dispute threads, participation history and fraud signals — is deleted twelve months after closure, which leaves enough time to answer a late appeal or dispute. Because nothing runs on a timer yet, those deletions happen when you ask for them at hello@tryvoa.app rather than automatically on the date.

8.Your rights

Laws in some places — the GDPR in the UK and EU, the CCPA in California, and others elsewhere — give people rights over data held about them. Whether one of those laws applies to you depends on where you live. Either way, here is honestly how each request works on Tryvoa today.

• See what we hold. Most of it is already on a screen: Settings, Wallet, Profile, My campaigns, Notifications and Support each show your own records. For anything not on a screen, email us.
• Correct it. Settings lets you change your name, your contact email, your country and your notification preferences yourself. Two things to know. Changing the email there changes the contact address on your profile, not the address you sign in with — email us to change that. And the devices and interests used for campaign matching are set during onboarding: Settings lists your devices without letting you change them and does not show your interests at all, and the onboarding flow does not reopen once it is finished, so email us to change either.
• Get a copy. While signed in, visiting /api/v1/export/rewards downloads your reward history as a CSV. There is no self-serve export for the rest of your data yet — email us and we will send it.
• Delete it. There is no delete-account button in the app. Email us from the address on the account and we will delete it. Section 7 sets out what survives that deletion.
• Object or restrict. Email us and say what you object to. Where it is something we need in order to run the service — verifying a milestone before paying you, for example — we will tell you that plainly rather than quietly ignore the request.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

9.Children

Tryvoa is for adults. You must be 18 or older to use it. We do not ask your age at sign-up and we do not verify it ourselves — Stripe's identity check, which happens before anyone can be paid, is the first point at which age is actually established.

If we learn an account belongs to someone under 18, we close it and delete it. If you are a parent or guardian and believe your child has an account here, email us and we will remove it.

10.International transfers

Tryvoa accepts contributors from twelve countries across North America, Europe, Australia, New Zealand and Singapore, so data about you may be stored or handled outside the country you live in. The database is a single Supabase project in one region, the site is served from Vercel's network, and Stripe operates globally.

The database is hosted in Supabase’s us-east-1 region, the app runs on Vercel’s global edge network, and Stripe processes payments across its own infrastructure. Data about you is therefore stored and processed in the United States as well as Canada. If you are in the UK or the EU, the transfer mechanism relied on is the one in each processor’s own data processing terms, which Tryvoa accepts as their customer — there is no separate mechanism of our own.

11.Changes and contact

When this policy changes, we change the date at the top. There is no mailing list for policy updates, so if this page matters to you, check it. If a change materially reduces the protection described here, we will say so at the top of the page rather than quietly edit a paragraph.

Questions, corrections and complaints: hello@tryvoa.app. For the money side of the relationship — the 25% platform fee, the $20 withdrawal minimum, the 14-day appeal window, and what happens when an event is held — read the Terms of Service.

StarletteAI, established in Alberta, Canada. Write to hello@tryvoa.app; a postal address is given on request where one is needed for a legal or regulatory purpose.