Privacy Policy

Planning Poker is a browser extension that helps software teams estimate work collaboratively in real time. This policy explains what data is handled and how.

Data we do NOT collect

• We do not ask for or verify your real identity (no email, phone, or real name required) — the display name is a self-chosen alias.
• We do not use analytics, tracking pixels, or third-party trackers.
• We do not sell or share any data with third parties.
• We do not require account registration.

Data stored locally on your device

The extension stores the following in chrome.storage.local, which is private to your browser profile and never sent to any server:

• Session identity: a display name you choose, a random user ID, and the room code. This is automatically deleted after 8 hours.
• Vote history: a local log of past estimation rounds for rooms you participated in. You can clear this at any time.

Real-time synchronisation (Supabase)

When you join or create a room, the extension connects to Supabase Realtime to synchronise votes and room state with other participants. The only data transmitted is:

• Your chosen display name and random user ID (a self-chosen alias, not verified and not linked to any real identity).
• Your vote value, broadcast to room members only during a session.
• Room history (recent round results — aliases, votes, and the current ticket title), stored in Supabase keyed by the room code and readable by anyone who has that code. History is capped to the latest rounds and is overwritten as you play; the host can clear it at any time from the extension.

Supabase processes this data in accordance with their Privacy Policy.

Jira integration (optional)

If — and only if — you choose to connect Jira, the extension uses Jira Cloud's official OAuth 2.0 flow:

• You sign in on Atlassian's own consent screen; we never see or store your Jira password.
• The token exchange runs through a server-side function so the OAuth secret is never shipped in the extension; the resulting access/refresh tokens are stored only in chrome.storage on your device.
• Tokens are used solely to read your sprint/backlog issues and to write back the agreed story points, only when you trigger those actions. Disconnecting Jira removes the stored tokens.

Permissions

The extension requests the following permissions:

• sidePanel: to display the extension in the Chrome side panel.
• storage: to save your session and Jira connection locally between browser restarts.
• identity: to run the Jira OAuth sign-in flow (only when you connect Jira).
• Host access to Atlassian domains (*.atlassian.net, auth.atlassian.com, api.atlassian.com): to authenticate and call the Jira Cloud API on your behalf.

Changes to this policy

If this policy changes materially, the updated version will be published at this URL with a new date.

Contact

Questions? Reach out at support@nomorefixes.com.