Privacy policy

StoryPoints is a product by Intello Tecnologia (Brazilian company registry 64.567.838/0001-44). This policy explains what data we process when you use StoryPoints, under Brazil's General Data Protection Law (LGPD).

Summary

• You don't need an account to use StoryPoints.
• We use Google Analytics 4 and Microsoft Clarity to measure usage and improve the product, only after you accept in the cookie banner. We don't use ad networks.
• The room shows banners for wapichat, a partner product. They are plain links: they load nothing from other sites and collect no data. If you click, you land on the wapichat site with utm_source=storypoints in the address.
• Rooms without an account are deleted after 30 idle days.

Data we process

Without an account

Data	Purpose	Retention
Name you type in the room	Show you at the table to your teammates	While the room exists
Votes and stories	Running the estimation and exporting results	While the room exists
A random identifier stored in your browser	Recognize you when you reload the page	In your browser, until you clear site data
IP address	Security and abuse rate limiting	Technical logs for up to 30 days

The legal basis is our legitimate interest in providing the service you asked for and keeping it secure.

With an account

In addition to the above, we store your email, your name and, if you sign in with Google, your profile picture and Google account identifier. We use them to keep your rooms, session history and saved decks. The legal basis is performing the service you signed up for. This data is kept until you delete your account.

Usage metrics

We record events without personal data, such as "room created" or "round revealed", to understand how the product is used. Individual events are deleted after 90 days and only daily totals are kept.

Cookies and local storage

The cookie banner shows up on your first visit and your choice lasts 12 months. To change it, use Cookie preferences in the footer.

Category	What it is	When
Necessary	The sid session cookie (when you sign in), cookie_consent (your banner choice) and your browser's local storage for theme, language, your name and access to rooms	Always
Statistics	_ga and _ga_*, from Google Analytics 4 (via Google Tag Manager): visits, source and screen usage, such as creating and joining a room	Only with your consent
Experience	_clck and _clsk, from Microsoft Clarity: heatmaps and recordings of how pages are used, with text and fields masked	Only with your consent

We don't send your name, email, votes or stories to Google or Microsoft.

Sharing

We don't sell or share data with advertisers. We use providers to host the service (Amazon Web Services, in the United States) and to send sign-in emails. They process data only to provide that service, under contracts with data protection clauses. With your consent in the banner, Google (Google Analytics and Google Tag Manager) and Microsoft (Clarity) also receive browsing data for measurement.

People in a room see other participants' names and, after the reveal, their votes. The facilitator can export the room results as CSV, including names and votes.

Your rights

You can request access to, correction or deletion of your data. Account holders can do this directly on the Account page, including deletion. For anything else, write to [email protected].

Changes

If this policy changes in a meaningful way, we will announce it in StoryPoints in advance.