Planning poker and GDPR: where your session data goes
The question rarely comes from the agile team. It comes from the DPO, six months later, during an audit or an insurance renewal. Here is what is actually at stake, and how to check it before someone asks.
What a planning poker tool processes, even when it says it collects nothing
An estimation session looks harmless. It nonetheless produces several categories of data the GDPR treats as personal, without anyone intending it:
- Participant nicknames. In practice people type their first name, often their full name. That is direct identification.
- User story titles. They routinely name a client, a partner or a project under a confidentiality agreement.
- IP addresses. Every server processes them, and European case law treats them as personal data whenever cross-referencing is possible.
- The votes themselves. Tied to a nickname and retained, they amount to an individual assessment. A named estimation history is employee evaluation data, with the prior-information duties that follow.
So the right question is not "does this tool collect data". It is how long it keeps it, where, and who else sees it.
The three things a DPO flags
- No data processing agreement. Article 28 of the GDPR requires a contract as soon as a vendor processes data on the company's behalf. A free tool adopted by one team without going through procurement generally has none.
- Transfers outside the European Union. A tool hosted in the United States, or one that loads American analytics scripts, raises the transfer safeguards question. It is not unsolvable, it is simply rarely documented.
- Retention periods. "We keep your data as long as necessary" is not a period. A record of processing activities needs a number.
Check it yourself, in two minutes
None of these checks needs any particular skill, and they work on any tool, including this one.
- Open the browser developer tools (F12), Network tab, and reload the page. Every listed domain that is not the site itself is a third party watching your visit.
- Application tab, Cookies then Local storage. Anything written there outlives closing the tab.
- Close the session, reopen its URL the next day. If the content is still there, it is stored somewhere, and that retention period belongs in a privacy policy.
Where CleanPoker stands
| Question | Answer |
|---|---|
| User account | None. No email, no password, no profile. |
| Cookies | Two, both technical: language and theme. No advertising cookie, no measurement cookie. |
| Third-party scripts | None. No analytics, no remote fonts, no external CDN. |
| Session retention | In memory only, never written to disk. Deleted 24 hours after the last activity. |
| Hosting | Real-time server in France (Paris) and nowhere else, pages served by a renewable-powered delivery network. |
| Audience measurement | None, neither in the browser nor per page view. The server keeps three aggregate counters (sessions created, participants, active sessions) that identify neither a room nor a person, and reset to zero on every restart. |
| Verifiable | The source is public under the MIT licence. The three checks above apply to this page too. |
This does not make the GDPR go away: a typed nickname is still data, and a server still sees an IP address. It shrinks the surface to what the vote strictly requires, and makes the answer to the DPO short and checkable. The detail lives in the legal notice.
What privacy does not replace
A tool that collects nothing but fails at its job is worthless. The job of a planning poker tool fits in one line: keep votes invisible until the reveal, so the first number said out loud does not anchor the whole team. Everything else, including this page, follows from that.