Planning Poker

Security

Updated 30 October 2026

This page explains the current security model of Planning Poker and its practical limits. To report a security issue privately, email bzzup.dev@gmail.com.

Access to a room

Rooms use invitation links or codes and browser-specific guest tokens. Display names are labels, not verified identities. Anyone who obtains a valid invitation can join. Keep links within your team and avoid putting sensitive information in room names or story titles.

Host permissions and hidden votes

The server checks membership and host permissions. Only the original creator can change the story list, reveal cards, advance stories, restart voting or rename the room. Other participants can change their own name and vote. Before reveal, the room service does not return other participants' vote values. The service processes votes on the server; this is not end-to-end encryption.

Infrastructure and browser storage

Public connections use HTTPS. Room tables are not directly accessible to browser clients; the application uses server-side operations with access checks. The guest token is stored in browser local storage, with its hash used on the server. Do not share the token, and protect access to your browser. Clearing browser storage does not erase the corresponding server data.

Screenshot handling

Import checks supported image formats and upload sizes, applies request quotas and treats image text as untrusted input. Screenshot bytes are processed in memory by the application and sent to external AI processing. These checks do not make every screenshot suitable for sharing. See the Privacy policy for data handling.

Responsible reporting

Describe the issue, affected URL and steps to reproduce using your own test data. Do not send guest tokens, other teams' stories or confidential screenshots. Avoid accessing or modifying other people's data while investigating. We do not currently offer a guaranteed response time or bug-bounty payment.