Estimate Poker works without accounts, which keeps the data we handle to a minimum. This policy describes exactly what we store, where it lives, and how to get rid of it. It is written to match how the product actually works, not the other way around.

1. What we store on our servers

To run a planning session we store: the display name and emoji avatar you choose when joining; the rooms you create or join (room name, invite code, deck choice including any custom card values the host enters, timer state, and your membership in them); and the stories and accepted estimates entered in those rooms. Guest profiles are lightweight: no email address, no password, no real-name requirement. If a host sets a room password, we store only a cryptographic hash of it (argon2), never the password itself.

We also keep basic operational records so the service can function and stay secure: your login sessions (when each was issued, when it expires, and whether it was signed out, so we can end sessions server-side), and coarse timestamps such as when your profile, sessions, and room memberships were created, when a room was last active, and whether a host has removed you from a room.

2. Votes are private by design

Individual card picks during a round are held in server memory only and are never written to our database. Nobody, including the room host, can see who picked what until the host reveals the round to everyone at once. When the round ends the per-person votes are discarded. What we save is the round's outcome: the accepted estimate on the story, plus a history of accepted estimates for that story (the value, when it was accepted, and which member accepted it), so re-voting a story does not erase the earlier decision.

3. What other participants can see

Estimate Poker is collaborative, so some of your activity is visible to the other people in a room you join. They can see your display name and avatar, whether you are currently online, whether you have voted in the current round (but not your value, until reveal), your vote value once the host reveals the round, and any reactions you send. If a host removes you from a room, the other participants are notified of the removal. Behind the scenes, other participants' apps also receive a technical identifier for your guest profile; it is the same identifier in every room you join and does not change when you rename yourself, so someone who shares more than one room with you could recognize you across those rooms even under a different display name. Your name also stays on a room's participant list after you leave, and because you have a single profile, changing your display name or avatar updates how you appear in every room you have ever joined, including rooms you are no longer active in. Only share rooms with people you are comfortable seeing this.

4. What lives only in your browser

The app uses your browser's local storage for three things: your session token (a signed credential that keeps you logged in for up to 7 days, and which corresponds to the session record described in section 1), a cached copy of your own guest profile, and your light/dark theme preference. We set no cookies ourselves: not for sessions, not for advertising, not for anything. (Our network provider, Cloudflare, may set strictly necessary security cookies of its own as part of the traffic protection described in section 8; we have no access to or use for them.) Clearing your browser data for the site removes all of this and effectively signs you out.

5. Technical data and logs

Like almost every web service, our servers see your IP address when you connect. We use it in memory for rate limiting (abuse prevention); our application logs do not record it. Those application logs do record your internal user id, room codes, and the actions taken, and we use them only for debugging and keeping the service running and abuse-free. Your IP address may additionally appear in the standard access logs of our web servers and edge providers (Cloudflare, Railway). We do not store IP addresses in our database or build location profiles from them. Note that, in the current version, a connection credential is passed in the address of the real-time connection, so it can appear in those access logs; we treat them as sensitive and plan to change this.

6. What we don't do

We don't require accounts or email addresses. We don't sell or share personal data for advertising. We run no advertising and, at present, no analytics or tracking scripts of any kind. We don't track you across other websites.

One exception applies to everything above: if we are legally required to disclose data, for example by a court order or another binding request from an authority, we will comply. We hold so little that there is rarely anything useful to hand over, and where the law allows it we will tell you it happened.

7. How long we keep it

Rooms, stories, estimates, guest profiles, and session records are all retained so that your team can return to them; we do not currently delete anything automatically. Sessions stop working after 7 days (or when you sign out), though the session record itself, like everything else, is kept until you ask us to delete your data. Deleting a story inside the app hides it from the room but does not remove it from our database; its content is retained like everything else. Browser-stored data stays on your device until you clear it. If you want a room, your profile, a story, or anything else removed from our servers, email us (section 11) and we will delete it.

8. Service providers

Estimate Poker runs on infrastructure operated by third parties, each of which processes technical request data (such as IP addresses) as part of serving you: Cloudflare (DNS, TLS, and traffic protection; all our domains, including the web app at app.estimatepoker.com, are served through Cloudflare's network), Railway (hosting the backend API), Neon (managed database), and GitHub Pages (serving this marketing site). Fonts and the animated reaction emoji are loaded from Google Fonts (fonts.googleapis.com, fonts.gstatic.com), so your browser makes requests to Google when loading them. We have no advertising or data-resale relationship with any of these providers.

These providers are companies headquartered in the United States, so the data they process for us, including the technical request data described above, can be processed on servers outside the country you live in, including outside the EEA. Where that happens, the transfer relies on the safeguards those providers offer, such as EU standard contractual clauses. These providers are subject to United States law, so US authorities can in principle compel them to disclose data they hold, wherever the servers physically stand; safeguards like standard contractual clauses cannot fully rule that out. As with everything in this policy, our best protection is that we hold very little data in the first place.

9. How we protect your data

All connections to Estimate Poker are encrypted with TLS. Room passwords are never stored readably, only as argon2 hashes. Session tokens are signed credentials that we can revoke server-side, individual votes are held in memory and never written to the database, and we set no cookies of our own. No online service can promise perfect security, but we deliberately hold so little data that there is not much to lose in the first place.

10. Your rights

Where the GDPR or similar laws apply, our legal bases are simple: we process the profile, room, and session data described in sections 1 and 2 because it is necessary to provide the service you are asking us for, and we process the technical data in section 5 based on our legitimate interest in keeping the service secure and abuse-free. We process nothing for any other purpose.

Depending on where you live (for example under the GDPR), you may have rights to access, correct, export, or delete data relating to you. Since we hold so little, the practical routes are: clear your browser storage for on-device data, or email us to have server-side data (your profile, rooms, room contents) deleted. We answer every request within 30 days. If you are in the EEA or the UK, you also have the right to lodge a complaint with your local data protection authority; we would appreciate the chance to sort things out first, so just email us.

11. Contact

Estimate Poker is built and operated by Mehmet Canhoroz (mehmet.io), an individual. For data-protection purposes he is the data controller for the data described in this policy. Questions about privacy, or a deletion request? Reach us at [email protected]. If you email us, we receive your email address and whatever you write; we use that only to answer you, it never enters the product database, and you can ask us to delete the correspondence as well.

12. Children

Estimate Poker is a workplace tool and is not directed at children under 13. We do not knowingly collect data from them.

13. Changes to this policy

If we change what we collect or how we use it, we will update this page and its date. Material changes will be called out in the product.

1. The service

Estimate Poker provides online planning-poker rooms for collaborative estimation, currently free of charge and usable as a guest without an account. We may change, suspend, or discontinue features at any time. By using the service you accept these terms. How we handle the data involved in running the service is described in the Privacy Policy above on this page; it applies alongside these terms.

2. Rooms, hosts, and invite links

Whoever creates a room is its initial host, and a host can transfer the host role (with all its controls) to any participant. The host controls revealing rounds, managing stories, the timer, the optional room password, removing participants, and sending an attention chime that plays a sound on a chosen participant's device (or on every other participant's device at once). Anyone with a room's invite link or code (and its password, if set) can join. You are responsible for who you share your room links with; add a password for anything you would not want a stranger stumbling into. Note that a room's name and whether it is password-protected are visible to anyone who has its link or code, even before entering a password (its stories, members, and estimates are not), so keep room names non-sensitive. Removing a participant disconnects them and takes them off the participant list, but it is not a ban: anyone with the room's link or code (and its password, if set) can rejoin. To keep a removed person out, set or change the room password.

3. Acceptable use

Don't use the service for anything unlawful; don't enter sensitive personal data (health, financial, government identifiers) into story titles, descriptions, or names; don't harass other participants; don't attempt to access rooms you weren't invited to; and don't disrupt or overload the service. We enforce technical limits (including rate limits and caps on rooms and stories) and may adjust them to keep the service healthy for everyone.

4. Your content

Story titles, descriptions, estimates, and other content you enter remain yours. You grant us the limited rights needed to store that content and display it to the people in your room; that is the entire purpose of the product and we claim nothing beyond it.

5. Our name and software

Your content stays yours; the service itself stays ours. The Estimate Poker name, logo, and the software and design behind the service belong to us. These terms give you the right to use the service, not to copy it, rebrand it, or resell access to it.

6. No warranty

The service is provided "as is" and "as available", without warranties of any kind, express or implied. Do not treat Estimate Poker as the system of record for your backlog: record accepted estimates in your own tracker (there is currently no built-in export).

7. Limitation of liability

To the maximum extent permitted by law, we are not liable for indirect, incidental, or consequential damages arising from use of the service. Our total aggregate liability is limited to the amount you paid us for the service, which, for a free service, is zero.

8. Responsibility for your use

If the way you use the service breaks these terms or the law and someone brings a claim against us because of it, you agree to cover the costs and damages that result. Use the service for what it is built for, estimating work with your team, and this section will never matter.

9. Suspension and termination

We may suspend or terminate access that violates these terms or threatens the service's integrity (for example, abuse, flooding, or attempts to break into rooms). You can stop using the service at any time, and can ask us to delete your data per the privacy policy.

10. Changes to these terms

We may update these terms from time to time; this page always carries the current version and its date. Material changes will be announced in the product. Continued use after changes means you accept the new terms.

11. Governing law

These terms are governed by the laws of the Republic of Türkiye. If you use the service as a consumer, this does not take away protections granted to you by the mandatory laws of the country you live in.

12. Contact

Questions about these terms? [email protected].