Privacy Policy

1. Controller (Art. 4(7) GDPR)

The controller responsible for processing personal data on scrumpoker-online.com is:

scrumpoker-online.com@gmail.com


E-mail: scrumpoker-online.com@gmail.com

A data protection officer has not been appointed, as none is legally required.

2. Overview

scrumpoker-online.com is a real-time Scrum poker tool. You can use it without an account; creating an account is optional. This policy explains what data we process, on which legal basis (Art. 6 GDPR), which service providers (processors) are involved, how long data is kept, and which rights you have. Analytics only runs after you have given consent via the cookie banner; you can change or withdraw your choices at any time via the cookie settings button in the bottom corner of every page.

3. Hosting (Vercel)

The website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit the site, Vercel technically processes connection data (IP address, time of request, requested resource, browser and operating system information) in server logs to deliver the site and keep it secure.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating the website securely and reliably. Vercel may process data in the USA; transfers are safeguarded by the EU standard contractual clauses and Vercel's certification under the EU-US Data Privacy Framework. A data processing agreement pursuant to Art. 28 GDPR is in place.

4. Application database and realtime backend (Supabase)

Rooms, participants and votes are stored with Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992. Our Supabase project is hosted in: eu-central-1 (Frankfurt, Germany). Supabase also provides the optional account system (see section 5) and the realtime updates within a room. A data processing agreement pursuant to Art. 28 GDPR is in place.

Legal basis: Art. 6(1)(b) GDPR — processing is necessary to provide the service you request (creating, joining and running a planning session).

5. Account registration (optional)

If you create an account, we process your e-mail address and a password (stored only as a cryptographic hash by Supabase Auth). The account lets you manage your rooms from a dashboard. Sign-in state is kept in strictly necessary session cookies (sb-*-auth-token).

Legal basis: Art. 6(1)(b) GDPR. You can delete your account yourself at any time via the Delete account section of the dashboard — this permanently removes your account and all rooms, votes and participant entries linked to you. Alternatively contact scrumpoker-online.com@gmail.com (see section 12 for your rights).

6. Planning sessions and visibility of room data

Within a planning session we process the display name you enter, your votes, and session metadata (timestamps, room configuration). Please note: anyone who has the link or code of a room can read the display names and votes of that room via our API. Room links are unguessable random identifiers, but they are not access-controlled — only share a room link with people who should see the session, and feel free to use a pseudonym as your display name.

Legal basis: Art. 6(1)(b) GDPR — running the planning session you and your team request.

7. Anonymous device identifier

To let you use rooms without an account, we generate a random identifier (UUID) and store it in the localStorage of your browser (anonymousId). It links your browser to your participant entry and votes in the rooms you join. It contains no name, e-mail address or other direct identifier, and we do not use it to track you across other websites. If you have consented to analytics, the same identifier is used to recognize you in our analytics (see section 9). You can remove it at any time by clearing the site data of your browser.

Legal basis: Art. 6(1)(b) GDPR and § 25(2) No. 2 TTDSG (strictly necessary to provide the room functionality you request).

8. Cookies, consent and local storage

On your first visit a consent banner lets you accept all, reject all, or choose categories individually. Analytics is off by default and only activates after your consent (Art. 6(1)(a) GDPR, § 25(1) TTDSG). You can change or withdraw your choices at any time via the cookie settings button in the bottom corner of every page; withdrawing is as easy as consenting.

9. Analytics (PostHog)

With your consent we use PostHog to understand how the service is used (pages visited, features used). PostHog only initializes after you enable analytics in the cookie banner; without consent no analytics script runs, no identifier is stored and no data is sent. Events are sent to the EU cloud of PostHog (PostHog, Inc., hosted in the EU at eu.i.posthog.com). IP address collection is disabled, session recording is disabled, and text content is masked. If you withdraw consent, tracking stops and the stored analytics identifier is deleted.

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TTDSG — your consent, revocable at any time via the cookie settings.

10. Error monitoring (Sentry)

To detect and fix technical faults we use Sentry (Functional Software, Inc.). Our Sentry project uses EU data residency (Frankfurt, Germany); error reports are sent to an EU ingestion endpoint. Reports contain technical context about the error (browser, operating system, the actions immediately before the error). We configure Sentry to remove IP addresses from error reports, and session replays are captured only for a small share of sessions in which an error occurs, with all text masked. A data processing agreement pursuant to Art. 28 GDPR is in place.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in the technical stability and security of the service. You may object to this processing (section 12).

11. Retention

We store personal data only as long as needed for the purposes above:

• Rooms, participant names and votes: until the room is deleted by its host, and at the latest 90 days after the last activity in the room — a nightly job automatically deletes rooms (including all participants and votes) that have been inactive for 90 days.
• Account data: until you delete your account — either directly in the dashboard (Delete account) or by request — after which it is removed immediately.
• Consent choices: 12 months, then the banner asks again.
• Analytics data: [RETENTION PERIOD CONFIGURED IN POSTHOG, e.g. 12 months].
• Error reports: [RETENTION PERIOD CONFIGURED IN SENTRY, e.g. 90 days].

12. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• have inaccurate data corrected (Art. 16),
• have your data erased (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20),
• object to processing based on legitimate interests, such as error monitoring (Art. 21), and
• withdraw any consent at any time with effect for the future (Art. 7(3)) — for cookies and tracking simply via the cookie settings button.

To exercise these rights, contact us at scrumpoker-online.com@gmail.com. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence or place of work. The authority responsible for us is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Ansbach.

13. No automated decision-making

We do not use your data for automated decision-making or profiling within the meaning of Art. 22 GDPR.

14. Changes to this policy

We update this policy when the service or its providers change. The date at the top shows the current version. Material changes to consent-based processing will be presented via the consent banner again.

15. Contact

For any privacy question or request: scrumpoker-online.com@gmail.com. Postal address: see section 1 or the Impressum.