Privacy policy

Who we are

Keystimate (keystimate.com) is an online planning poker tool run by Arminas Grigonis, Vinčų g. 2, LT-46298 Kaunas, Lithuania (“we”, “us”). We are the controller of the personal data described in this policy.

For anything about your data, write to [email protected]. We answer within one month.

Using Keystimate without an account

When you join or create a room as a guest, we process:

• What you show the room: the name you type, the avatar you pick or upload (a small image), your role (voter or spectator) and, if the room has groups, your group.
• What you do in the room: your votes, the tasks and their estimates, chat messages and the photos, videos, drawings and GIFs you send there, the shared notes, the timer and emoji reactions.
• A browser id: your browser makes up a random id and a private key the first time you visit. The id lets you rejoin your seat after a refresh; the key proves it is you. We store only a one-way hash of the key, next to the id, so nobody who learns your id can take your seat.

A live room exists only in our server’s memory. Chat, notes, attachments, reactions and the timer are never written to our database, and they go when the room does: 4 hours after the last person leaves (30 minutes for a saved room). When we restart the server on purpose (for an update), live rooms are written to a file on the server until it is back up (usually a few seconds), read back, and the file is deleted. This week’s guest room summaries (below) ride along. Chat attachments are not part of that file.

When a room ends with nobody signed in, it is never written to our database. We keep a summary of it (room name, tasks and their results, and the names and avatars at the table, without uploaded images) in memory only, so that anyone who was there can sign in during the same week and add it to their history. These summaries are wiped every Monday at 00:00 UTC.

If someone in the room is signed in, the session goes into their history as described below, and that includes the name and avatar you used in it, with no time limit (see How long we keep it). Everyone at a table sees each other’s names, avatars and, once revealed, votes, unless the host turned on anonymous voting.

If you sign in

You can sign in with Google or with a 6-digit code sent to your email address. We then store:

• A pending sign-in code, while you have asked for one and not used it. The email with the code (and a one-click sign-in link, as an alternative to typing it) is sent from our server through Resend. We store only a record named after a hash of your email address (SHA-256), holding keyed hashes (HMAC-SHA256) of the code and of the link, never the code or the link themselves, plus the page to bring you back to, how many wrong codes were tried, and when it was made and expires. It stops working after 10 minutes, and a new code replaces it. It is deleted as soon as you sign in with it, after 5 wrong tries, and when you delete your account; one that expired unused is deleted within about an hour. If no account exists for the address, signing in with the code creates one.
• Your sign-in account, held by Google Firebase Authentication: your email address, and if you use Google, the name and profile photo address Google shares with us, plus when you created the account and last signed in.
• Your profile: email address, the name and photo Google shares with us (if you use Google), the name and avatar you use in rooms (a generated avatar, your Google photo or a small uploaded image), the browser id you used as a guest before signing in, the ids of the browsers you signed in from (so that deleting your account can find your seats), your plan and trial dates, and when you joined and were last seen.
• Session history for every room with at least one signed-in person in it: the room’s name, description and settings, who took part (name, role, avatar, browser id, and account id for signed-in people), and each estimated task with its title, description, link and result: the average, how many people played each card (not who played what) and the final estimate. Only a still image of an animated avatar is kept.
• Organizations you create or join: the organization’s name and settings, its members with their names, roles, teams and join dates, and its invite code.
• Saved rooms: a room whose link you chose to keep, with its name, settings, groups, cards and the tasks that were still open at the end of the last meeting.

What your plan shows versus what we store

Session history is stored in full for everyone who was signed in, whatever their plan. What the dashboard shows depends on the plan: a free account sees the last 14 days, and older sessions appear as locked entries without their content. Paid plans show the full history of the organization. Guests see no history. Stored is still stored: “Export my data” includes older sessions too, and deleting your account removes you from all of them (see Your rights).

Google user data

When you choose “Continue with Google”, Google asks whether to share your name, email address and profile picture with Keystimate (Google’s basic sign-in permissions). We ask for nothing else: no access to your Gmail, Drive, Calendar, contacts or any other Google service or data.

• Email address: identifies your account, so signing in with Google and with an email code reaches the same account, and is shown to you in your account menu.
• Name: suggested as your name in rooms. You can change it; others in a room see the name you use.
• Profile picture: your avatar in rooms unless you pick another. We keep the address of the picture at Google, not a copy.

They are stored with your sign-in account and profile (see If you sign in) and shared only as this policy describes: with the people in your rooms and organizations (your name and avatar) and with the providers that run the service for us. We never sell Google user data, use it for advertising or to train AI models, or let anyone else do so. Keystimate’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Deleting your account deletes this data (see Your rights). You can also remove Keystimate’s access in your Google Account; that stops future Google sign-ins but does not delete what we already hold.

Analytics, error reports and logs

• Cloudflare Web Analytics counts visits, pages and referring sites without cookies and without building a profile of you.
• Our own funnel counts. A few steps (for example “room created” or “first vote”) send our server an event name and where the visit came from (a campaign tag, the referring website’s domain, or “direct”). The server only adds one to that week’s totals. No id, IP address, address of the page or time is kept with it. We count “active rooms” the same way, as weekly totals.
• Error reports go to Sentry when something breaks: the error, the browser and operating system, the room code and page address, and your random browser id. Before anything leaves the browser or the server, email addresses, sign-in tokens and secrets in addresses are masked, and chat text, notes and images are removed. We don’t put names into error reports.
• Server logs record what the server did with ids (browser, account, room), never names, email addresses or chat text, and go through the same scrubbing. Our web server also keeps standard access logs (IP address, page, time, browser) for 14 days, for security. The Google sign-in pages on keystimate.com (under /__/auth/) are not logged, because Google sends the sign-in result back in their address.
• Abuse protection counts requests per account, browser and IP address in memory to stop floods and guessing of room codes, and how many sign-in codes each email address was sent (at most 3 in 10 minutes and 10 a day), under a hash of the address. These counters are not stored.
• Cloudflare Turnstile loads in the sign-in dialog and, when you ask for a code, checks that a person is asking, so nobody can use us to fill someone’s inbox. Cloudflare sees your IP address and details of your browser for that check, and our server then confirms the result with Cloudflare (sending your IP address along when it is an IPv4 one). Usually you see nothing; sometimes it asks for a click. Cloudflare handles that data under its Turnstile Privacy Addendum.

Cookies and browser storage

Keystimate sets no tracking or advertising cookies, so there is no cookie banner. To work, the app keeps a few things in your browser’s storage:

• your browser id and its private key, and your name and avatar, so you are recognised in rooms;
• the room you are in, so a refresh puts you back in your seat, and per-room layout choices;
• your sign-in (kept by Firebase). Sign-in codes are typed in, so nothing about them is kept in the browser; only an address asked for an older-style sign-in link before codes, if any, stays until that link is used;
• your theme, recently used emoji reactions and skin tone, dashboard and layout preferences, prompts you dismissed, and a cache of emoji images;
• where your visit came from, for the funnel counts above, until you close the tab;
• your Jira connection, if you set one up (see below).

All of these exist only to provide what you asked for, which is why the law does not require consent for them. Signing in with Google opens Google’s own sign-in window, where Google’s cookies and privacy policy apply, and the Turnstile check in the sign-in dialog runs in a Cloudflare frame, under Cloudflare’s.

GIFs and Jira

These only happen when you use them:

• GIPHY. When you open the GIF picker in the chat, your browser asks GIPHY directly for trending GIFs and for what you type in the search box, so GIPHY sees your IP address and those searches. The GIF you send is shown to the room from GIPHY’s servers.
• Jira. To import issues or write estimates back, you give the app your Jira site, email and API token. They are kept in your browser: for the open tab only, or on this device if you tick “Remember on this device”. Each Jira request passes them through our server to your Jira site, because browsers can’t call Jira directly; the server uses them for that one request and never stores or logs them. Issues you import become tasks in the room and are stored with the session like any other task.

Why we use your data

• To provide the service you asked for (contract): running rooms, signing you in, keeping your history, organizations and saved rooms, and, once paid plans can be bought, your plan.
• Legitimate interests: keeping the service secure and stopping abuse, fixing errors, and understanding in aggregate which parts of the product people use.
• Legal obligations, such as keeping billing records once paid plans exist.

Who processes data for us

We do not sell personal data or share it for advertising. These providers process it on our behalf:

• Google (Firebase Authentication and Cloud Firestore): sign-in accounts and our database.
• netcup GmbH (Nuremberg, Germany): the server that runs live rooms and the API at api.keystimate.com.
• Cloudflare: delivers and protects keystimate.com (the API at api.keystimate.com doesn’t go through it), Web Analytics, and the check that stops bots from sending sign-in emails (Turnstile, under the Turnstile Privacy Addendum).
• Sentry (Functional Software, Inc.): error reports, as described above.
• Resend: sends the sign-in emails, so it sees your email address and the email itself (the code and the sign-in link).
• Paddle (planned): when paid plans can be bought, Paddle.com will sell them as our reseller and merchant of record. It handles checkout, payment details, invoices and tax as a controller in its own right, under its own privacy notice. We will only learn what we need to apply your plan (such as the customer, plan and subscription status).
• GIPHY and Atlassian (Jira): only when you use them, as described above.

Other people in your rooms and organizations see what the room or organization shows them: names, avatars, votes and the shared history. We may disclose data when the law requires it.

International transfers

Some of these providers are based in the United States or use staff and servers outside the European Economic Area (Google, Cloudflare, Sentry, Resend, GIPHY, Atlassian, and Paddle once used). Where data leaves the EEA, the transfer relies on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses in the provider’s data processing terms.

How long we keep it

• Live rooms, chat, notes and attachments: until the room closes (see above).
• Guest rooms nobody signed in to: in memory until the next Monday at 00:00 UTC.
• Your sign-in account, profile, organizations and saved rooms: until you delete them or your account. You can delete a saved room or an organization you own from the dashboard.
• Session history: as long as the service runs, because it is also the history of everyone else who was there. When you delete your account, your seat in it is made anonymous (see below).
• Error reports: 30 days, then Sentry deletes them.
• A pending sign-in code: until it is used, tried wrongly 5 times or replaced, and at most about an hour after it stops working (10 minutes after it was sent). Sign-in emails themselves: Resend keeps a record of each email it sent for 30 days.
• A guest’s seat in a session with a signed-in participant (name, avatar, browser id): as long as that session’s history, like the rest of it.
• The hashed key of each browser that has used Keystimate: with no time limit, since it holds nothing but a random id. Deleting an account removes those of its browser.
• Funnel and activity counts: kept as totals, which contain no personal data.

Your rights

You have the right to access, correct, delete and take a copy of your data, to object to or restrict how we use it, and to complain to a data protection authority. Signed in, you can do most of it yourself:

• Access and portability: Dashboard → Account → Export downloads a JSON file with everything we store about your account: your sign-in details, profile, organizations, saved rooms and the sessions you took part in (up to 2,000), including older ones your plan doesn’t show.
• Correction: change your name and avatar in your profile at any time. Past sessions keep the name you had at the time; ask us if you need one changed.
• Erasure: Dashboard → Account → Delete account. It deletes your profile, your sign-in account, a sign-in code still waiting for your address, your saved rooms, and the stored keys of your browser. Organizations you own pass to the longest-standing other admin (or member); if you are the only member, the organization is deleted. You leave the others. In the history of every session you were in, and in live rooms and this week’s guest rooms, your seat becomes “Deleted user” without a name, avatar or link to you, so the other participants keep their estimates. The tasks and their results stay part of their history. Your sign-in stops working at once, on every device.

As a guest we cannot tell which data is yours: guest-only rooms are wiped within a week, but your name stays in the history of sessions where someone was signed in. Write to us with the room and the name you used if you need it removed. For any request, or to complain, write to [email protected]. You can also complain to the data protection authority where you live or work, or to ours: Lithuania’s State Data Protection Inspectorate (vdai.lrv.lt).

Security

Everything travels encrypted (HTTPS and secure WebSockets). Sign-in tokens are checked by the server on every connection and stop working when an account is deleted, browser keys and sign-in codes are stored only as hashes, a code works once and for 10 minutes, the one-click link signs in only after a click on our page (so mail scanners that open links can’t use it), and requests are rate-limited. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authority as the law requires.

Children

Keystimate is a tool for work teams and is not meant for anyone under 16. We don’t knowingly collect data from children; if you believe a child has given us data, write to us and we will delete it.

Changes to this policy

When we change how we handle data, we update this page and the date at the top. If a change matters to how your account is used, we will also tell you in the app or by email before it takes effect.