Privacy policy
| Status | In force. |
| Version | 1.0 |
| Last revised | 30 September 2026 |
| Applies to | The Truostray service and truostray.com |
Truostray is run by Truos Tray / ត្រួសត្រាយ, based in Phnom Penh, Cambodia (we, us). This policy says what the product collects, why, where it is kept and how to have it removed. It describes what the software actually does, including where that is awkward.
1. Whose data it is
Workspace content belongs to the organisation that opened the workspace. Messages, files, requests, tasks, bookings and people records are under that organisation's control: it decides what goes in, who sees it and how long it stays, and we handle it on its behalf. If you are an employee with a question about what your employer can see, ask your employer — and we will help them answer.
Your account, and anything you send us, we look after ourselves — your sign-in details, security records, and what you write to us.
2. What we collect
| What | Examples |
|---|---|
| Workspace content | Messages, files, form answers, tasks, requests and approvals, room bookings, calendar events, signature images |
| Profile | Name, email address, phone number, photo, job title, status, position in the org chart |
| Sign-in details | Your password, stored only as a salted scrypt hash, never as itself |
| Sessions | Each session's IP address and device, and when it started and ended |
| Mobile devices | A push notification token, if you allow notifications |
| Security records | Who did what and when on security- and approval-related actions, with the IP address and device |
| Messages to us | What you write to us, and the address you write from |
| Technical logs | Server logs and error reports |
3. Why we use it
To run your account and the service, to keep it secure and look into misuse, to answer you when you contact us, and to meet legal obligations.
We do not sell personal data, show advertising, build advertising profiles, or use workspace content to train machine-learning models.
4. Where it is kept, and who else handles it
Uploaded documents are stored in Singapore, on Amazon Web Services. We will state where the rest of the service's data — its servers and database — is hosted here before this policy comes into force.
A few other companies handle limited data so that the service can work:
| Company | What for | What it sees |
|---|---|---|
| Amazon Web Services | Storing uploaded documents | Document files, encrypted by us before they are stored |
| Expo, and through it Apple and Google | Push notifications to the mobile apps | Device token and the notification's content |
| Vercel Analytics | Page-level usage statistics in the web app | Pseudonymous page views |
Otherwise we disclose personal data only when the law requires it.
5. How long we keep it, and removing it
- Workspace content stays until someone deletes it, or until a retention period an administrator has set on a conversation removes it. There is no automatic default: a workspace that sets nothing keeps everything.
- Sessions expire 30 days after last use, and end at once when you sign out.
- Security records are kept. A record of who approved what is only useful if it survives.
Removing a person. An administrator with the separate permission to erase can remove someone's name, email address, phone number, photo and status, and delete their sessions, devices, private approval phrases, pending invitations and signature images. What they did — approvals, decisions, messages — stays, shown as "Erased account", so the organisation's records still make sense. Copies other people already downloaded or read are beyond our reach.
To delete your own account, ask your workspace administrator, or write to us.
6. Security
- Documents, form answers and signature images are encrypted by the application, each with a key of its own.
- Message text is not encrypted by the application, and Truostray is not end-to-end encrypted. We can technically read content, and do so only where running, securing or supporting the service requires it.
- Uploaded files are not scanned for malware.
If we learn of a breach affecting personal data, we will tell the affected workspace administrators promptly. The security page has the detail.
7. Cookies
This website sets no cookies and runs no trackers. The product sets a single cookie, which keeps you signed in. The mobile apps keep your sign-in in the phone's own secure keychain or keystore.
8. Children
Truostray is a workplace product and is not meant for children.
9. Your choices
You can ask to see, correct or delete personal data about you. For data inside a workspace, ask the organisation that runs it. For your own account, or anything you sent us, write to us.
10. Changes
We will post changes here with a new version number and date, and tell workspace administrators about significant ones.
11. Contact
Truos Tray / ត្រួសត្រាយ
Phnom Penh, Cambodia
Email: hello@truostray.com
Phone: +855 93 933 676