Privacy Policy
The estimation tool needs no personal data to work. Analytics and advertising only run after you give consent — and you can withdraw it at any time.
Consent-first
No analytics or ad cookies before you agree
Anonymous tool
Random tokens only, no names required to play
7-day deletion
Session data removed automatically
GDPR compliant
Legal basis documented for all processing
01
Data Controller
Zeljko Kvesic
[Street and house number]
[Postcode] [City]
Germany
E-Mail: planningpoker [at] kvesko.de
02
Data We Process
The Planning Poker tool itself is designed to work without any personal data. Here is exactly what gets stored:
Session tokens
A randomly generated anonymous token is stored in your browser's localStorage. It has no connection to your identity and is used solely to maintain your session state. No name, email, or any other personal data is required to use the tool.
Votes and estimates
Card values you submit are stored in our database and associated only with your anonymous token. This data cannot be traced back to you as an individual.
Server logs
Our hosting provider automatically records standard server log data including IP address, browser type, and pages visited. These logs are retained for a short period for security and debugging and are not used to identify individual users. Legal basis: Art. 6(1)(f) GDPR — legitimate interest.
03
Cookies & Consent Management
When you first visit, a consent banner asks whether you allow optional cookies and similar technologies. We distinguish three categories:
- Strictly necessary — required for the site and your session to work (e.g. the anonymous token in
localStorage). These are always active and need no consent. - Analytics — Google Analytics, only after you opt in (see section 04).
- Advertising — Google AdSense, only after you opt in (see section 05).
We implement Google Consent Mode v2. Before any Google service loads, consent for ad_storage, ad_user_data, ad_personalization and analytics_storage defaults to denied. Nothing in those categories runs until you actively grant it.
You can change or withdraw your choice at any time via the “Cookie Settings” link in the footer, which reopens the consent dialog. Legal basis for consent-based processing: Art. 6(1)(a) GDPR; withdrawal is as easy as giving consent and does not affect processing that already took place.
04
Google Analytics
We use Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to understand how the site is used. It runs with IP anonymisation and only after you consent to the Analytics category. With Consent Mode v2, if you decline, Google Analytics is not activated and sets no analytics cookies.
When enabled, Google Analytics may set cookies to distinguish visits and measure page views, referrers, and device type. Data may be transmitted to Google servers, including in the USA, under the EU–US Data Privacy Framework and standard contractual clauses. You can withdraw consent at any time via “Cookie Settings”. Legal basis: Art. 6(1)(a) GDPR (consent).
05
Google AdSense
To keep the tool free, content pages may display ads served by Google AdSense (Google Ireland Limited). AdSense is a third-party vendor that uses cookies and similar technologies to serve and measure ads. It is only loaded after you consent to the Advertising category.
- Personalised ads are shown only if you grant advertising consent, including
ad_personalization. - Without advertising consent, no AdSense cookies are set and, if ads are shown at all, they are non-personalised.
- Ads are never placed inside a live estimation session — only on content and blog pages.
You can review and control ad personalisation in your Google Ad Center and learn more on Google's advertising privacy page. Legal basis: Art. 6(1)(a) GDPR (consent).
06
Legal Basis
Processing of session tokens and votes is necessary to provide the service you requested (Art. 6(1)(b) GDPR). Server logs rely on our legitimate interest in security and stability (Art. 6(1)(f) GDPR). Google Analytics and Google AdSense are based on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
07
Data Retention
Anonymous session and vote data is automatically deleted after 7 days of inactivity. Server logs are retained according to our hosting provider's standard retention policy. Analytics and advertising data are retained according to Google's policies for the duration of your consent.
08
Data Transfers
This website is hosted on Vercel (Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA). Database services are provided by Supabase (Supabase Inc., 970 Toa Payoh North, #07-04, Singapore 318992). Analytics and advertising are provided by Google (Google Ireland Limited, with data transfers to Google LLC in the USA). These providers process data under the EU–US Data Privacy Framework and/or standard contractual clauses (SCCs) approved by the European Commission, ensuring an adequate level of data protection for transfers outside the EEA.
09
Your Rights
Under the GDPR you have the following rights regarding your personal data. To exercise any of them, contact us at planningpoker [at] kvesko.de.
Right of access
Art. 15 GDPR
Request a copy of the data we hold about you.
Right to rectification
Art. 16 GDPR
Request correction of inaccurate data.
Right to erasure
Art. 17 GDPR
Request deletion of your data.
Right to restriction
Art. 18 GDPR
Request that we limit how we process your data.
Right to portability
Art. 20 GDPR
Receive your data in a structured, machine-readable format.
Right to object
Art. 21 GDPR
Object to processing based on legitimate interests.
You also have the right to lodge a complaint with your national data protection authority.
10
Changes to This Policy
We may update this privacy policy from time to time. The current version is always available at this URL. Material changes will be reflected in the “last updated” date in the header above.