Privacy policy

StoryPoints is a product by Intello Tecnologia (Brazilian company registry 64.567.838/0001-44). This policy explains what data we process when you use StoryPoints, under Brazil's General Data Protection Law (LGPD).

Summary

• You don't need an account to use StoryPoints.
• We don't use third-party cookies, tracking pixels, ad networks or external analytics tools.
• The room shows banners for wapichat, a partner product. They are plain links: they load nothing from other sites and collect no data. If you click, you land on the wapichat site with utm_source=storypoints in the address.
• Rooms without an account are deleted after 30 idle days.

Data we process

Without an account

Data	Purpose	Retention
Name you type in the room	Show you at the table to your teammates	While the room exists
Votes and stories	Running the estimation and exporting results	While the room exists
A random identifier stored in your browser	Recognize you when you reload the page	In your browser, until you clear site data
IP address	Security and abuse rate limiting	Technical logs for up to 30 days

The legal basis is our legitimate interest in providing the service you asked for and keeping it secure.

With an account

In addition to the above, we store your email, your name and, if you sign in with Google, your profile picture and Google account identifier. We use them to keep your rooms, session history and saved decks. The legal basis is performing the service you signed up for. This data is kept until you delete your account.

Usage metrics

We record events without personal data, such as "room created" or "round revealed", to understand how the product is used. Individual events are deleted after 90 days and only daily totals are kept.

Cookies and local storage

We only use the sid session cookie, when you sign in, and your browser's local storage to remember theme, language, your name and access to rooms you joined. None of them is shared with third parties, which is why we don't show a cookie banner.

Sharing

We don't sell or share data with advertisers. We use providers to host the service (Amazon Web Services, in the United States) and to send sign-in emails. They process data only to provide that service, under contracts with data protection clauses.

People in a room see other participants' names and, after the reveal, their votes. The facilitator can export the room results as CSV, including names and votes.

Your rights

You can request access to, correction or deletion of your data. Account holders can do this directly on the Account page, including deletion. For anything else, write to [email protected].

Changes

If this policy changes in a meaningful way, we will announce it in StoryPoints in advance.