Privacy Policy

• Display name. The name shown to other participants. If you sign in with Jira we use your Atlassian display name automatically; otherwise you type one, which is stored in your browser (localStorage). You can change it at any time.
• Room activity. While a session is active we hold the room's participants, their votes, the current item being estimated, and the round history. This is transient game state, not a durable profile.
• Jira connection. If you connect Jira, we store the OAuth access and refresh tokens and the list of Jira sites you granted, server-side, so you can search issues. Your Jira display name and avatar are fetched live from Atlassian each time they're shown and are never stored by us.

Connecting Jira uses Atlassian OAuth 2.0 (3LO). We request only the scopes needed to do the job:

• read:jira-work: read issues and projects so you can search and pick an item to estimate.
• write:jira-work: write the agreed estimate back to the issue's Story Points field, only when you explicitly choose to.
• read:jira-user: resolve "my issues" searches and read your basic Jira profile (display name and avatar) to label your seat automatically.
• offline_access: refresh the access token so you don't have to reconnect constantly.

Issue data is fetched from Atlassian on demand and shown to participants in your room. Only the selected item's key, summary, description, type, and status are kept in the room's transient state while you estimate it. We do not build a copy of your Jira project or mine it for anything else.

• Rooms are ephemeral and automatically expire (typically within ~12 hours of inactivity).
• Jira OAuth tokens are stored server-side and referenced by a secure, httpOnly session cookie. Tokens are never exposed to your browser or to other users, and session records expire after roughly 30 days.
• All traffic is served over HTTPS. Requests to Jira go only to Atlassian's official API hosts.

We use a small number of functional cookies: a session cookie to associate your browser with your Jira connection, and short-lived cookies used only during the OAuth sign-in handshake. We do not use advertising or cross-site tracking cookies.

We do not sell your data or share it with advertisers. Data flows only between your browser, our servers, and the services required to run the app: Atlassian (for Jira), our hosting provider, and an ephemeral data store for room and session state.

• Disconnect Jira from the account menu to delete the stored tokens and end the connection. You can also revoke access from your Atlassian account settings.
• Leave a room at any time; your presence and votes are removed.
• Clear your browser storage to remove your saved display name.

The app is intended for workplace use and is not directed to children under 13.

We may update this policy as the app evolves. Material changes will be reflected by the "last updated" date above.

Questions about this policy or your data? Email privacy@aspyn.dev.