This policy explains what information Truebex (“we”) collects when you use truebex.com, your Truebex account, the dashboard, the Truebex API and the desktop app, and what we do with it. We collect only what we need to run the service, and we do not sell personal information.
What we collect
- Account details. Your email address and, if you sign up with a password, a one-way hash of it (never the password itself).
- Google sign-in. If you choose “Sign in with Google”, Google shares your name, email address, profile picture and a Google account identifier with us. We use them only to create and identify your account. We do not receive access to your Google Drive, Gmail, contacts or any other Google data.
- API keys and usage. A one-way hash of each API key, its name, and per-day counts of the API endpoints each key called. We use this to authenticate requests, enforce plan limits and show you your usage.
- Devices. When you sign in to the Truebex app on a computer, we record the computer’s name, its operating system, the app version, when it was activated and last seen, and a fingerprint: a one-way hash the app makes from the computer’s identifiers, never the identifiers themselves. We use them to keep the computer signed in, to count your devices against your plan, to offer the free trial once per computer, and to show the list in your dashboard, where you can remove any of them.
- Organisations. If you create or join an organisation, we record your role, your seat, when you joined, and an audit log of licence and organisation events (sign-ins to the app, seat changes, shared-seat use, invitations), which the organisation’s owners and admins can see and export. We keep the audit log for 24 months. If your organisation signs you in through its own identity provider, that provider shares your e-mail address and name with us; we use them only to sign you in.
- Billing records. Your plan, billing interval and seats, payment amounts and tax, invoices, dates, status, the payment provider’s reference, and the version and time of the cancellation terms you accepted at checkout. Card details are entered on the provider’s own checkout and never reach our servers.
- Demo requests. The name, email, company and project description you send through the “Request a Demo” form.
- Session token. When you sign in, your browser keeps a session token in local storage so you stay signed in. We do not use advertising or tracking cookies.
Website analytics
On the public pages of truebex.com (not in your dashboard or account pages) we count page views with Cloudflare Web Analytics. It uses no cookies and no local storage, does not fingerprint your device, and does not follow you across other websites.
It records the page, the referring site, the browser, the device type and the country, aggregated by Cloudflare. We use it only to see which pages are read.
Sign-ups, downloads, trials and purchases are counted from our own account and billing records, as daily totals with no personal details.
How we use it
- To provide your account, dashboard, API keys and the API itself.
- To process subscriptions and show your billing history.
- To answer demo requests and support questions.
- To keep the service secure and prevent abuse.
Who processes it for us
We rely on a small number of providers, each only for its part of the service:
- Google — Sign in with Google, and the spreadsheet that stores demo requests.
- Paddle — card payments, as our reseller and Merchant of Record: your name, email address, country and postcode for tax, and the payment details you enter on its checkout.
- Stripe — business invoices, and card subscriptions started before Paddle.
- Cloudflare — network security and delivery for truebex.com and the API, and cookieless page-view counts (Cloudflare Web Analytics).
- GitHub — hosting of the public website.
- Server hosting — the data centre that runs the Truebex API and its database.
- Object storage — files the API keeps, such as crash reports and feedback screenshots, and encrypted database backups held with a second provider.
- Email delivery — replies to your feedback and account emails.
- Uptime monitoring — checks from outside that the API is running; it sees only our status pages, no personal data.
We share information with others only when the law requires it.
Desktop app: usage events, crash reports and feedback
The Truebex desktop app can send three kinds of operational data. Nothing is sent unless you agree, on every plan, and none of it carries your projects: no file names, folder paths, project titles, room, storey, sheet or layer names, typed text, coordinates or geometry.
- Usage events. Off until you say yes. Which commands and tools run and how long they take, which kinds of export you make, the app version, Windows version, language and plan, and hardware model names (graphics card, memory, processor threads, number of displays).
- Crash reports. Off until you say yes. A minidump — the call stacks, the list of loaded modules and the error, never the app's memory, so never your open project — and the end of the app's log, with your user folder, project names and email addresses replaced before it leaves your computer. You can see both before they are sent.
- Feedback. Sent only when you send it. Your message, a screenshot of the Truebex window that you preview first (never your desktop) and, if you tick it, the end of the log. Your account's email address is attached only when you ask for a reply.
Usage events and crash reports carry a random installation id, not your account. We do not store your IP address with any of them; it is used only, in memory, to limit how often requests can arrive.
How long we keep the app's data
- Usage events: 13 months; then only daily totals per event and app version remain.
- Crash files (minidump and log): 180 days; then the crash signature and counts remain.
- Feedback: 2 years, or until you ask us to delete it; then deleted with its screenshot and log.
- Server request logs: 14 days; then deleted.
- Database backups: 30 days; then rotated, so deleted data leaves the backups within 30 days.
Delete my data, in the app's privacy settings, asks us to delete everything your installation has sent. We complete it within 30 days. Resetting the installation there starts a new installation id.
How long we keep it
Account, key and billing records are kept while your account exists. Usage counts are kept for as long as they are useful for billing and your dashboard. Demo requests are kept while we are in conversation with you. Billing records may be kept longer where the law requires.
Your choices and rights
- Revoke any API key, or remove any signed-in computer, at any time from your dashboard.
- Turn the desktop app’s usage events and crash reports on or off at any time in its privacy settings.
- Ask us for a copy of your data, to correct it, or to delete your account and its data, by emailing [email protected].
- Remove Truebex’s access to your Google account at any time from your Google account settings.
Security
Passwords, API keys and device sign-in tokens are stored only as one-way hashes, all traffic uses HTTPS, and plan changes are accepted only from payment events we verify with the provider.
Children
Truebex is not directed at children under 16, and we do not knowingly collect their information.
Changes
If we change this policy we will update the date above, and tell account holders by email about any significant change.
Contact
Questions about privacy: [email protected].