PlanningJoy

Legal

Privacy policy

Deutsch·English

This is a courtesy translation. The German version is legally binding. The same policy is published at deari.de/en/planning-joy/datenschutz/.

This privacy policy applies to the web application PlanningJoy (collaborative story point estimation with planning poker) by Deari Software. Our company website is covered by the website privacy policy. Provider details are in the imprint.

1. Controller

Deari Software
Festim Deari
Friedrich-Ebert-Straße 55
42103 Wuppertal
Germany
Email: kontakt@deari.de

2. Principles

PlanningJoy contains no advertising, no analytics or tracking tools (no Google Analytics, no Facebook pixel, no third-party crash tracking) and no profiling for advertising. We do not sell your data and do not share it for advertising purposes.

3. Hosting and server log files

The web application is hosted by Netlify. Access generates technically necessary server log files transmitted by your browser, in particular:

  • IP address of the requesting device
  • date and time of access
  • page or file accessed
  • browser type and version and operating system
  • referrer URL (previously visited page)

Processing is based on Art. 6(1)(f) GDPR (legitimate interest in secure, stable operation). Log files are deleted after a short period once they are no longer needed for security and troubleshooting. A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.

4. Account and sign-in

Creating and joining rooms requires an account. Sign-in is passwordless: you receive a one-time sign-in link and a six-digit code by email. We process:

  • your email address and the one-time sign-in link or code
  • a technical user identifier (UUID)
  • optional profile details (display name, profile image URL if provided)
  • timestamps of account creation, sign-in and last changes
  • your virtual coin balance used to open sessions (see section 7)

The purpose is to provide your account and the application. The legal basis is Art. 6(1)(b) GDPR (performance of the usage agreement). Sign-in emails are sent through our processor Lettermint (see section 9).

5. Data in planning rooms

When you use PlanningJoy we store the content you and your team create:

  • Rooms: name, optional description, chosen deck, settings, current story, the paid access window and the facilitator identifier
  • Participation: display name, user identifier, spectator status, whether a card has been played in the current round, and join/activity timestamps
  • Estimates: the card you played in each round. Before the reveal your card is technically visible only to you; after the reveal it is visible to everyone in the room — that is the purpose of the application
  • Logged estimates: story title, agreed estimate, optional notes, the anonymised distribution of the cards played, and the name and identifier of the person who logged it
  • Chat: message text, display name, identifier and timestamp

The legal basis is Art. 6(1)(b) GDPR. Content of a room is visible to invited participants.

6. Real-time collaboration

So that everyone can play cards, watch progress and reveal together, we use realtime channels. Display names or initials and the online status of people in the room are visible to other participants. Online status is not stored permanently.

7. Coins and payments

Facilitators open a room for twelve hours with one virtual coin. The balance is stored on your profile. New accounts receive a starting balance.

Paid coin packs can be bought with PayPal. Checkout happens on PayPal’s servers. We receive a payment confirmation (PayPal order id, amount, package, and your account id) so we can credit coins. We do not collect or store card numbers or bank details. We send an invoice by email for every purchase (§ 312f BGB). The legal basis is Art. 6(1)(b) GDPR (performance of the purchase contract) and Art. 6(1)(c) GDPR (commercial and tax retention duties). PayPal acts as an independent controller for the payment itself; see PayPal’s privacy statement for that processing.

8. Cookies and local storage

We only use technically necessary storage:

  • Sign-in session (cookie or browser local storage) so you stay signed in
  • Theme preference (light/dark) in your browser’s local storage
  • briefly the email address and destination page after sending the sign-in link, so sign-in can be completed
  • a session flag recording whether the welcome animation has already played in this tab

There is no tracking cookie and no marketing-cookie banner because we do not use such cookies. The legal basis for necessary storage is Art. 6(1)(b) and (f) GDPR and § 25(2) TDDDG.

9. Recipients and processors

  • Supabase, Inc. — database, authentication and realtime. Your data is stored in the EU: the server location is Ireland (AWS region eu-west-1). A data processing agreement pursuant to Art. 28 GDPR is in place with Supabase. Where, exceptionally, support or maintenance access originates in the USA, we rely on the EU standard contractual clauses (Art. 46 GDPR).
  • Netlify — hosting and delivery of the interface, including the log files described in section 3.
  • Lettermint — delivery of sign-in and invoice emails. The service is operated in the EU; it processes your email address and the content of the message concerned.
  • PayPal (Europe) S.à r.l. et Cie, S.C.A. — payment processing when you buy coins. PayPal receives the data needed to complete checkout and is an independent controller for that processing. We store the PayPal order id, package and amount so we can credit your coin balance once and prevent duplicate credits.

Fonts are served by us and are not loaded by the browser from Google or another font CDN.

10. Retention and deletion

Account data is kept for as long as your account exists. Rooms, estimates and chat messages remain until the facilitator deletes the room in the application or you request deletion of your account. Cards played in a round become void when a new round starts. After account deletion we remove your profile; associated content still needed by others in a room may continue in anonymised form until the room itself is deleted. Purchase records and invoices are kept for the periods required by commercial and tax law (generally ten years, § 147 AO).

You can have your account and data deleted at any time by emailing kontakt@deari.de. We will confirm once deletion is complete.

11. SSL/TLS encryption

Transmission is encrypted (HTTPS). You can recognise an encrypted connection by the “https://” prefix in the address bar.

12. Your rights

As a data subject, you have the following rights:

  • access (Art. 15 GDPR)
  • rectification (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • objection (Art. 21 GDPR, see section 13)
  • withdrawal of consent with effect for the future (Art. 7(3) GDPR)
  • lodging a complaint with a supervisory authority (Art. 77 GDPR)

To exercise these rights, write to kontakt@deari.de.

13. Right to object (Art. 21 GDPR)

Insofar as we process personal data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you have the right to object at any time, on grounds relating to your particular situation, to such processing. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds which override your interests, or the processing serves to assert, exercise or defend legal claims.

14. Children

PlanningJoy is intended for adults in professional teams and does not knowingly collect data from children under 16.

15. Changes to this privacy policy

Last updated: September 2026. We will update this policy as soon as the functionality or the data processing changes. The current version is available at this address and at deari.de/en/planning-joy/datenschutz/.