Privacy Policy
This policy explains what information Scrum Poker (the "Service") processes and why. The Service is operated by Hexense Tech OÜ, a company registered in Estonia, which acts as the data controller for the personal data described below. The Service is designed to collect as little personal data as possible.
1. Information we collect
- Information you provide: a display name you choose when joining a room, and the estimation content you enter, such as room names, story descriptions, and votes.
- Information collected automatically: when you use the Service, our infrastructure providers process technical data such as your IP address, browser type, and timestamps in order to deliver and secure the Service.
- We do not ask for your real name, email address, or any account credentials.
2. How we use information
We use this information solely to operate the Service: to run realtime estimation rooms, show participant presence, synchronise votes, and keep the Service secure and reliable. We do not sell your data and we do not use it for advertising.
3. Cookies and local storage
The Service stores a small amount of data in your browser: a pseudonymous session identifier (an anonymous sign-in token) that keeps you signed in to a room, and preferences such as your chosen theme and display name. These are strictly necessary to provide the Service. We do not use advertising or analytics cookies.
4. Service providers
We rely on the following processors, each acting on our behalf under its own data-processing terms:
- Supabase — database, authentication, and realtime messaging. Project data is hosted in the European Union.
- Vercel — application hosting and content delivery.
- If you choose to connect an external issue tracker, data you push to or pull from it is also processed by that provider.
We are not responsible for the privacy practices of third-party services you choose to connect; their processing of your data is governed by their own policies.
5. Data retention
Estimation rooms are transient. Room and vote data is generally removed automatically after a period of inactivity and is not intended for long-term storage. Technical logs are retained by our providers, according to their own retention policies, for a limited period for security and reliability.
6. Security
We use reasonable technical and organisational measures designed to protect the information processed through the Service. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.
7. Legal basis
Where the EU General Data Protection Regulation applies, we process the limited data described above on the basis of our legitimate interest in providing a functioning, secure estimation tool, and, where applicable, to perform the service you have requested.
8. Your rights
Depending on your location, you may have the right to access, correct, or delete personal data, or to object to or restrict its processing. Because the Service does not use accounts, we may be unable to identify your data without additional information. To make a request, contact us using the details below.
9. International transfers
Primary data is hosted in the European Union. Some providers may process technical data in other regions under appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission where required.
10. Children
The Service is not directed at children under 16, and we do not knowingly process personal data from children under 16.
11. Changes to this policy
We may update this policy from time to time. Each version carries the version number and effective date shown at the top of this page.
12. Contact
For any privacy question, or to exercise your rights, contact info@hex-tech.xyz.