Responsible AI

Where AI shows up

AI is used to generate the seed content a facilitator needs to run a round — questions, prompts, words, topics. The facilitator types a theme (e.g. "team culture", "summer holidays"), AI returns a list of round-ready content, and the facilitator picks which ones to use.

Across the 18 games today, 14 use AI for content generation:

This list is a snapshot as of April 2026. We add new games and AI-assisted flows as the platform grows, so the table above is illustrative rather than exhaustive — we reserve the right to introduce new AI scenarios consistent with the principles on this page.

What we send to the AI model

• The facilitator's theme or topic — a short text string they typed
• A count (how many items to generate)
• For Story Builder titles only: the team's collaboratively-written story text

What we don't send

• No participant names or display names
• No participant content — votes, drawings, statements, guesses, positions on a spectrum
• No session metadata beyond what's needed to authenticate the request
• No personally identifiable information from facilitators (beyond the auth token)
• No commercial information about your team or company

The AI model never sees what your team actually does in a session. It only sees the seed the facilitator typed before the session started.

Provider and models

• AI calls go to Amazon Bedrock — AWS's managed inference service — and run on Anthropic's Claude model family hosted there. Requests do not leave AWS to reach Anthropic directly.
• We use a mix of claude-haiku and claude-sonnet, picking the smaller model where it's good enough (e.g. Story Builder titles) and the larger one where the content needs more nuance (e.g. spectrum questions, multiple-choice trivia).
• Bedrock does not use prompts or completions to train foundation models. See AWS's Bedrock data privacy FAQ for details.

Guardrails

Workplace-appropriate constraints

Every system prompt instructs the model to keep content suitable for a professional setting and inclusive of diverse teams. Specific games add their own constraints — e.g. Emoji Guess is restricted to widely-supported emoji and prohibits flag emojis to avoid geopolitical content.

Server-side validation

AI requests are validated against a JSON schema before being sent. AI responses are validated against an output schema before being returned to the client. Malformed input or output is rejected.

Encrypted prompts

The prompt templates themselves are AES-256-GCM encrypted at build time and only decryptable on the server. This prevents prompt tampering and keeps our prompt engineering work confidential.

No prompt injection from user input

The facilitator's theme is sent as structured JSON alongside the system prompt, never substituted into the prompt text. This prevents the kind of prompt injection where user input could be mistaken for instructions.

Opt-in

AI generation is always a button the facilitator chooses to click. The one automatic call is Story Builder's title generation, which runs after the team finishes a story — and falls back to a non-AI title if the call fails.

Graceful failure

If the AI service is unavailable, the AI button is hidden or the feature falls back. Sessions never block on AI.

Logging and retention

We log AI inputs and outputs server-side for quality and abuse-monitoring purposes — to catch regressions, debug failed generations, and refine prompts. Logs are retained for 90 days and then deleted automatically.

See the privacy page for the full data handling model.

Reporting issues

If you see AI-generated content that's offensive, biased, or otherwise inappropriate, email privacy@teamretro.com. Include the game name and the prompt you used so we can adjust the constraints.