Privacy policy

Who processes the data

Planning Poher (planningpoher.ru) is a tool for estimating work with the planning poker method. It is run by Vladimir Abdullaev, who is also the data controller.

Questions about your data, requests to see it or delete it: write to support@planningpoher.ru.

By using the service you agree to this policy. If you do not agree, please do not use it: seating you at a shared table without processing what is listed below is not technically possible.

What is collected

Exactly as much as the table needs to work. No phone number, no postal address, no payment details: there is nothing to pay for here.

• Guest access: the name you gave yourself at the table. A guest leaves neither an email address nor a password.
• Email sign-up: your email address, name and password. The password itself is never stored — the database holds a one-way transformation of it that the original cannot be recovered from.
• Google or Yandex sign-in: your email address, display name and the identifier of your account with that provider. Your password never reaches us, and we keep no access tokens to your account there.
• Preferences: the interface language and colour theme you picked.
• A count of the cards you have played — the number the profile statistics are built from.
• Room content: the room name, the items and their tags, chat messages, played cards, round history, the list of members and of anyone banned.
• Sessions: how long a session lives and a one-way transformation of the refresh token. The token itself is not in the database, and nothing in it can be used to sign in.
• Visit statistics: the page address, where you came from, browser and device type, language, approximate region from your IP address and what you did on the page. This is collected by Yandex Metrica — see the section on sharing below.

Why it is needed

There are no ads and no ad networks on the site. Data is not sold and is not handed to anyone for purposes of their own.

• To let you in and recognise you next time.
• To show the others who is at the table.
• To run the session itself: deal the cards, reveal them at once, keep the result of the round.
• To keep you signed in between visits and to let you sign out.
• To remember the language and theme you picked so they meet you in another browser too.
• To understand what people use and what breaks: without anonymous statistics a failure is visible only to whoever ran into it.

On what grounds

Processing is based on your consent, given when you start using the service, and on what is necessary to perform the terms of service between you and the operator.

You can withdraw consent at any time by writing to support@planningpoher.ru. Withdrawal means the account is deleted: there is no way to keep you at the table without processing what is listed above.

Who the data is shared with

The list is closed and short.

Beyond that, data may be disclosed where the operator is legally required to do so.

• Google and Yandex — only if you chose to sign in through them. The provider tells us your email address, name and identifier; whatever happens on their side follows their own rules.
• Yandex Metrica (counter 112326731) — anonymous visit statistics. Webvisor is enabled: it records what happened on the page — mouse movement, clicks and scrolling — so that confusing parts of the interface can be found.
• GitHub — only if you sent a bug report yourself. Your text, the page address, your name and your email address end up in a public issue in the project repository, where anyone can read them. Do not put anything into that form that should not become public.

Cookies and browser storage

There are no third-party advertising cookies on the site.

• A cookie holding the refresh token. Set when you sign in, lives up to 30 days and is not readable by page scripts. Without it a sign-in would not survive a reload.
• Browser storage: the language and theme you picked, your name and account identifier, a note that you have signed in before, the room you last opened and small interface details. The access key is not kept there — it lives only in the memory of the tab and disappears with it.
• Yandex Metrica cookies. You can refuse them through browser settings or a blocker; the service will keep working.

How long data is kept

• A guest account is deleted automatically 30 days after the last visit, together with the name you played under.
• Refresh tokens live no longer than 30 days and are revoked when you sign out.
• A room and its history live until the owner deletes the room. Chat and the list of rounds are capped in length: the oldest entries are pushed out by new ones.
• An account with an email address is kept until you ask for it to be deleted.
• Retention inside Yandex Metrica is decided by Yandex.

How the data is protected

The site is served over HTTPS only. Passwords and refresh tokens are stored as one-way transformations. Access to the server and the database belongs to the operator and to nobody else.

The data sits on a rented virtual server in a hosting provider’s data centre.

Nobody has complete protection, and promising it would be a lie. Hence the short rule: a room is not the place for trade secrets or other people’s personal data. Everyone you let into the room sees the item titles.

Your rights

Requests are answered within 30 days. So that we can tell which account is meant, write from the address it is registered to.

• Ask what data about you exists — by email.
• Correct your name, email address, password, language and theme — yourself, in the profile.
• Sign out of your account — with the button in the profile.
• Delete your account and everything attached to it — by writing to support@planningpoher.ru.
• Complain to a supervisory authority if you believe your data was handled wrongly.

Children

The service is not meant for children under 14 and does not knowingly collect their data. If such an account is found, or a parent reports one, it will be deleted.

Changes to this policy

A new version is published on this same page, and the date at the top shows when it took effect. By continuing to use the service after it appears, you accept the new version.