Privacy policy

Who processes the data

Planning Poher (planningpoher.ru) is a tool for estimating work with the planning poker method. It is run by Vladimir Abdullaev, who is also the data controller.

For questions about your data or requests to see or delete it, write to support@planningpoher.ru.

By using the service you agree to this policy. If you do not agree, please do not use the service: it cannot work without processing the data listed below.

What is collected

Only what the service needs to work. It does not ask for a phone number, postal address or payment details, since there is nothing to pay for.

• Guest access: the name you entered. A guest does not provide an email address or a password.
• Email sign-up: your email address, name and password. The password itself is not stored. The database only holds its hash, which cannot be turned back into the password.
• Google or Yandex sign-in: your email address, display name and account identifier with that provider. Your password never reaches us, and we do not store access tokens to your account there.
• Preferences: interface language and colour theme.
• A count of the cards you have played, used for the statistics in your profile.
• Room content: the room name, items and their tags, chat messages, played cards, round history, the list of members and banned users.
• Sessions: session expiry and a hash of the refresh token. The token itself is not in the database, and its contents cannot be used to sign in.
• Visit statistics: the page address, where you came from, browser and device type, language, approximate region from your IP address and your actions on the page. This is collected by Yandex Metrica, described below.

Why it is needed

There are no ads or ad networks on the site. Data is not sold and is not shared with third parties for their own purposes.

• To let you in and recognise you next time.
• To show other participants who is at the table.
• To run the session: deal the cards, reveal them and save the round result.
• To keep you signed in between visits and let you sign out.
• To remember your language and theme, so they carry over to another browser.
• To understand which features are used and what breaks. Without anonymous statistics, only the person who hit a bug knows about it.

On what grounds

Processing is based on your consent, given when you start using the service, and on what is necessary to perform the terms of service between you and the operator.

You can withdraw consent at any time by writing to support@planningpoher.ru. Withdrawing consent means your account will be deleted, because the service cannot work without processing this data.

Who the data is shared with

There are no other recipients.

In addition, data may be disclosed where the operator is legally required to do so.

• Google and Yandex, if you chose to sign in through them. The provider sends us your email address, name and identifier. What happens on their side is governed by their own rules.
• Yandex Metrica (counter 112326731): anonymous visit statistics. Webvisor is enabled. It records actions on the page (mouse movement, clicks, scrolling) so we can see where the interface is confusing.
• GitHub, if you sent a bug report yourself. Your text, the page address, your name and your email address go into a public issue in the project repository, where anyone can read them. Do not put anything into that form that should not become public.

Cookies and browser storage

There are no third-party advertising cookies on the site.

• A cookie with the refresh token. It is set when you sign in, lasts up to 30 days and cannot be read by page scripts. Without it, you would be signed out on every reload.
• Browser storage: your language and theme, name and account identifier, a note that you have signed in before, the room you last opened and interface settings. The access key is not stored there: it is kept only in the tab’s memory and disappears when the tab is closed.
• Yandex Metrica cookies. You can block them in your browser settings or with a blocker, and the service will keep working.

How long data is kept

• A guest account is deleted automatically 30 days after the last visit, together with the name you played under.
• Refresh tokens last no longer than 30 days and are revoked when you sign out.
• A room and its history are kept until the owner deletes the room. Chat and round history have a length limit, and old entries are removed as new ones arrive.
• An account with an email address is kept until you ask for it to be deleted.
• Retention in Yandex Metrica is determined by Yandex.

How the data is protected

The site works over HTTPS only. Passwords and refresh tokens are stored as hashes. Only the operator has access to the server and the database.

The data is stored on a rented virtual server in a hosting provider’s data centre.

No protection is absolute, and we will not promise otherwise. So do not keep trade secrets or other people’s personal data in rooms. Everyone let into a room can see the item titles.

Your rights

We reply within 30 days. Please write from the address your account is registered to, so we know which account you mean.

• Find out what data about you is stored. To do this, write to us.
• Change your name, email address, password, language and theme in your account.
• Sign out with the button in your account.
• Delete your account and all data linked to it. To do this, write to support@planningpoher.ru.
• Complain to a supervisory authority if you believe your data was handled wrongly.

Children

The service is not meant for children under 14 and does not knowingly collect their data. If such an account is found, or a parent reports one, it will be deleted.

Changes to this policy

A new version is published on this same page, and the date at the top shows when it took effect. By continuing to use the service after it appears, you accept the new version.