Planning Poker

Privacy

Updated 30 October 2026

Planning Poker is operated by BisonInc. For privacy questions or requests concerning your data, email bzzup.dev@gmail.com.

Information used for planning

We process your display name, a random guest identifier, room membership, stories, estimates and voting results to provide shared planning sessions. Your browser stores a guest token so you can return as the same participant, including the host. The server stores a hash of that token. This is a guest service; you do not need an account or email address to participate.

Room participants can see names, story titles and revealed estimates. The host can edit stories and control voting rounds. Vote values are hidden from other participants before the host reveals them.

Browser storage and your choices

We store the guest token and your chosen display name in local storage. They remain until you clear the site's browser data. Clearing the token can remove your access as the original host; it does not delete room data on the server.

Your analytics preference is stored separately for up to 180 days, then we ask again. If storage is blocked, your choice applies for this page session only. The offline design demo can also store its story queue locally; shared cloud rooms use the server.

Optional analytics

Analytics is off until you choose Accept analytics. If you accept, Vercel Web Analytics processes page visits and technical information such as browser/device type, referrer and approximate location to help us understand usage. Vercel describes visitor identification as request-derived hashing with a visitor-session lifetime of 24 hours, rather than third-party cookies. Our analytics URLs omit query strings and invitation codes, and rooms are grouped as /room. We do not attach display names, story contents, votes or screenshots to analytics events.

Use Privacy settings in the footer to accept, reject or withdraw your choice. Refusing analytics does not restrict planning. Withdrawal stops future tracking and reloads the page; it does not automatically erase statistics already collected. See Vercel's analytics privacy information.

AI screenshot import

When you choose, paste or drop an image in the import panel, we send it through Vercel AI Gateway to an external AI provider to extract story titles. The configured default model is Google's Gemini 2.5 Flash Lite. Images may contain personal or confidential information, so remove anything your team is not authorised to share before uploading. AI output can be wrong; review it before saving.

The application processes screenshot bytes in memory and does not save them to its database or intentionally include their contents in application logs. This does not mean that upstream providers never retain data: their processing and retention terms also apply. Extracted titles you save become part of the room data. Operational logs include model/usage metadata and error information.

Providers and processing locations

We use Vercel for hosting, optional analytics and the AI gateway, Supabase for the room database and live updates, and an external AI provider for screenshot extraction. Our configured database region is Stockholm, Sweden. Hosting, support, analytics and AI processing may involve locations outside the European Economic Area; a Swedish database region is not a promise that all processing stays in Sweden.

Purposes and legal bases

We process information needed to deliver the service you request, and use legitimate interests to operate and protect the service, including access controls and abuse prevention. Optional analytics uses your consent, which you may withdraw. Your team is responsible for having an appropriate basis to share other people's information in stories and screenshots.

Retention and deletion

Leaving a room ends your active participation but does not delete its stories, membership or results. Room data currently has no automated expiry and remains stored until removed. For deletion or access requests, contact us with the room code and enough information to verify your relationship to the room. Never send your guest token. Provider logs, backups and analytics have their own retention schedules; deletion from active application data need not remove every backup immediately.

Your rights

Depending on the applicable law, you can request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. We may need to verify a request before acting. You can also complain to your data protection authority; in Sweden this is IMY. Contact bzzup.dev@gmail.com to make a request.