Privacy Policy
Your privacy is important to us. This policy explains how we collect, use, and protect your information when you use Online Planning Poker — as an anonymous guest, with a free account, or on a paid plan.
Last updated: July 10, 2026
Introduction
Online Planning Poker ("we," "our," or "us") is committed to protecting your privacy and being transparent about how we handle your information. This Privacy Policy explains our practices regarding the collection, use, disclosure, and protection of information when you use our planning poker application and related services — including guest sessions, registered accounts, paid Business subscriptions, and optional integrations such as Jira.
By using Online Planning Poker, you agree to the collection and use of information in accordance with this policy. We will not use or share your information with anyone except as described in this Privacy Policy.
Information We Collect
Information You Provide
- Display Name: When you join a session, you provide a display name that is visible to other participants in your session.
- Account Information: If you create an account, we collect your name, email address, password (stored as a secure hash — we never see or store your plain-text password), and an optional avatar image.
- Session Data: Your votes, participation status, session interactions, and any stories, topics, or backlog items you add to a session for estimation.
- Team & Workspace Data: Workspace and team names, member roles, custom branding assets (such as your logo and colors), and the email addresses of people you invite to your team.
- Billing Information: If you subscribe to a paid plan, payments are processed by Stripe. We store a customer reference, your subscription status, and your card brand and last four digits — never your full card number, which goes directly to Stripe and never touches our servers.
- Preferences: Session settings, deck preferences, room defaults, and other customization choices you make.
Information Automatically Collected
- Connection Data: IP address, browser type, device information, and connection timestamps for session management and security.
- Usage Analytics: Page views, feature usage, and interaction patterns collected through Google Analytics and Microsoft Clarity (which may include anonymized heatmaps and session replays) to improve our service.
- Technical Data: Browser capabilities, screen resolution, and WebSocket connection status for optimal functionality.
Information from Integrations (Jira)
If a team admin connects Jira (a Business plan feature), we collect and store only what the integration needs to work:
- OAuth Tokens: Access and refresh tokens issued by Atlassian, encrypted at rest. We never see or store your Atlassian password.
- Site Details: Your Jira site URL, cloud ID, the project you select, and the story points field used for syncing.
- Issue Data: Issue keys, summaries, and story point values for the issues you import into a session backlog.
- What we don't store: We do not store Atlassian account IDs, Jira user profiles, names, avatars, or email addresses of your Jira users.
See the Jira Integration section below for full details.
Information We Don't Collect
- We do not require an email address or account to run or join guest planning poker sessions
- We do not store full payment card numbers — card details are handled entirely by Stripe
- We do not collect personal identification documents or sensitive personal information
- We do not track your activity outside of Online Planning Poker
How We Use Your Information
Service Delivery
- • Enable real-time collaboration in planning poker sessions
- • Maintain accounts, workspaces, teams, and member roles
- • Provide voting statistics, session history, velocity reports, and exports
- • Operate integrations you enable, such as importing and syncing Jira issues
Billing & Subscriptions
- • Process subscription payments through Stripe
- • Manage free trials, renewals, and plan changes
- • Send billing receipts and payment notifications
- • Gate paid features to active subscriptions
Security & Safety
- • Prevent abuse and unauthorized access
- • Detect and prevent fraudulent activities
- • Maintain session integrity and data accuracy
- • Protect against technical vulnerabilities
Communication
- • Send transactional emails: verification, password resets, team invitations
- • Respond to support requests and inquiries
- • Send important service and billing updates
- • Share relevant product announcements
Data Storage and Security
Data Storage
Session Data: Stored securely on our servers. For Business teams, session history and estimation records are retained as a product feature so you can review and export them.
Account Data: Your profile, workspace, team, and subscription records are stored for as long as your account exists.
Local Storage: Your display name and preferences are also stored locally in your browser using cookies and local storage for convenience.
Backups: We keep regular encrypted database backups for disaster recovery; backups are rotated on a fixed schedule.
Security Measures
Technical Safeguards
- • HTTPS encryption for all data transmission
- • WebSocket secure connections (WSS)
- • Passwords stored as secure one-way hashes
- • Integration tokens (e.g. Jira) encrypted at rest
Access Controls
- • Limited access to production systems
- • Role-based access within teams and workspaces
- • Team rooms restricted to invited members
- • Regular security updates and monitoring
Data Sharing and Disclosure
We Do Not Sell Your Data
We do not sell, rent, or trade your personal information to third parties for marketing or any other purposes. Your data is used solely to provide and improve our planning poker service.
Limited Sharing Scenarios
Session Participants and Team Members
Your display name and voting activity are visible to other participants in the same session. Within a team, your name, avatar, role, and estimation history are visible to other team members as part of the collaborative features.
Service Providers
We share limited data with trusted providers who help us operate: Stripe (payment processing), Atlassian (only when you connect Jira — we exchange issue and estimate data with your Jira site on your instruction), Google Analytics and Microsoft Clarity (usage analytics), and our hosting and email delivery providers. Each processes data only as needed to provide their service.
Legal Requirements
We may disclose information if required by law, court order, or to protect our rights, property, or safety, or that of our users or others.
Jira Integration
Using our app for Jira from the Atlassian Marketplace? That app runs entirely inside Atlassian's infrastructure and has its own policy — see the Jira app Privacy Policy. This section covers the website's optional Jira integration only.
The Jira integration is optional and available on the Business plan. It uses Atlassian's OAuth 2.0 authorization flow — you grant access on Atlassian's own consent screen, and you can revoke it at any time. Online Planning Poker is an independent product and is not affiliated with or endorsed by Atlassian.
What we access
With your permission, we read issues from the Jira project you select (to import them into your estimation backlog) and write to those issues (to save confirmed story point estimates, or add a comment when the story points field isn't available). We request the minimum scopes needed: read and write access to Jira work data, plus offline access so your connection keeps working between sessions.
What we store
Encrypted OAuth access and refresh tokens, your Jira site URL and cloud ID, the selected project key and story points field, and the issue keys, summaries, and story point values of issues you import. We do not store Atlassian account IDs, Jira user profiles, or the personal data of your Jira users.
How to disconnect
A team admin can disconnect Jira at any time from the team settings page — this immediately deletes the stored tokens and connection details from our systems. You can also revoke the app's access from your Atlassian account settings at any time.
Data Retention
Session Data
Guest session data is retained so you can return to a session by its link; we may clean up long-inactive guest sessions. For Business teams, session history and estimation records are retained while your account is active so you can review, report on, and export them.
Account and Billing Data
Account data is retained until you delete your account. Billing and transaction records are retained as required for tax, accounting, and legal compliance.
Integration Data
Jira connection details and tokens are deleted immediately when you disconnect the integration or delete the team they belong to.
Local Data
Data stored in your browser (display name, preferences, cookie consent choice) remains until you clear your browser data.
Your Rights and Choices
Access and Control
You can view and update your name, email, password, and avatar at any time in Settings → Profile. Business teams can export their session history as CSV.
Account Deletion
You can delete your account at any time from Settings → Profile. For full data erasure requests, or if you used the service as a guest, contact us at [email protected].
GDPR & CCPA Requests
Depending on where you live, you may have rights to access, correct, export, restrict, or erase your personal data. Email us and we'll honor applicable requests — typically within 30 days.
Contact Us
For any privacy-related questions or requests, contact us at [email protected].
Cookies and Tracking
Essential Cookies
We use essential cookies and local storage to keep you signed in, maintain your session state, remember your preferences, and protect against cross-site request forgery. These are required for the application to function.
Analytics Cookies
We use Google Analytics to understand how the service is used and Microsoft Clarity to identify usability problems (heatmaps and anonymized session replays). A consent banner is shown on your first visit; you can also limit tracking through your browser settings or extensions.
Third-Party Services
Stripe sets cookies on its checkout and billing portal pages for security and fraud prevention. Our hosting providers may set cookies for security and performance. None of these are used for advertising.
International Users
Online Planning Poker is accessible globally. Your information may be transferred to, stored, and processed in the country where our servers and service providers are located, which may be outside your own. By using our service, you consent to this transfer. We take appropriate measures to ensure your data is protected in accordance with this Privacy Policy wherever it is processed.
Children's Privacy
Online Planning Poker is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately so we can delete such information.
Changes to This Privacy Policy
We may update our Privacy Policy from time to time — for example, when we add features or integrations. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top of this policy.
You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page. Continued use of our service after any changes constitutes acceptance of the new Privacy Policy.
Contact Us
If you have any questions about this Privacy Policy, our data practices, or your rights regarding your personal information, please contact us:
We will respond to your inquiry within a reasonable timeframe, typically within 30 days.
Ready to Start Planning?
Create your first planning poker session and experience collaborative estimation with your team.