Privacy

Introduction

Welcome to Fibo, a multiplayer poker planning application. This privacy policy explains how we collect, use, and protect your information when you use our service.

Information We Collect

Information You Provide

• Your chosen username for poker planning sessions
• Session names you create or join
• Voting data during estimation sessions
• Submitted workshop content, ballots, outcomes, risk owners and mitigations
• If you create an account: your name, email address and a salted password hash
• Account-linked session history, including dated occurrences, revealed estimates, published retro cards, outcomes and action completion

Automatically Collected Information

• Usage analytics to understand user behavior and improve our service
• Technical information such as IP addresses, browser type, and session duration
• Server performance data to help us scale our infrastructure

Analytics Provider

We use PostHog for analytics to understand how users interact with our service and to improve user experience. PostHog collects:

• Page views and user interactions within the application
• Session duration and user flow patterns
• Feature usage statistics (anonymized)
• Technical performance metrics
• An anonymous visitor identifier saved in local storage, used to connect page views and feature usage across visits
• Referrer domains and campaign tags that explain where visits came from
• Error types and stack locations that help us diagnose failures

Data Location: Our PostHog integration uses the European ingestion host (eu.i.posthog.com). We measure anonymous visitor IDs without creating personal profiles or attaching participant names.

We do not record session replays or automatically capture page text. Analytics excludes participant names, session names, topics, voting notes, private retrospective content, Hot Takes text and Pre-mortem causes. Session URLs are represented by route patterns rather than their names. Development and automated browser tests are excluded from analytics.

How We Use Your Information

• To provide and maintain our poker planning service
• To understand usage patterns and improve user experience
• To scale our servers based on user demand
• To troubleshoot technical issues and provide support

Data Storage and Security

• All application data is hosted on servers located in the European Union
• Analytics data is processed and stored by PostHog on EU servers (eu.i.posthog.com)
• We use Cloudflare for content delivery, Turnstile security checks, and transactional account verification and password reset emails. Email delivery shares your email address and the account link with Cloudflare; it does not include your review or workshop content
• Live rooms expire after inactivity. Account-linked results and review decks are stored separately and have no automatic expiry
• We implement appropriate technical and organizational measures to protect your data
• PostHog complies with GDPR and European data protection standards

Data Sharing

Hot Takes content has no stored author names or participant IDs. We retain separate private participation counters to enforce limits, and only reveal content after at least three participants contribute. The server observes the submitting connection; writing style or context can still identify someone. Other participants receive aggregate results and only their own ballots. Share-card images are generated only when explicitly enabled and downloaded; Fibo does not post them to social networks.

We do not sell your data. We do not share your personal information with third parties except:

• With other participants in your poker planning sessions (usernames and votes)
• When required by law or to protect our legal rights
• With service providers who help us operate our service (under strict confidentiality agreements)

Data Retention

• Active session data is stored temporarily while sessions are in use
• Live Planning Poker, Retro and Hot Takes rooms are automatically deleted after 1 hour of inactivity
• When a signed-in participant joins, public session results are saved to their account. Linked participants can read that dated history after the live room expires. Private browser drafts, unrevealed votes, resume credentials and individual workshop ballots are excluded
• Reusing a session name creates separate history records for fresh rooms or facilitator restarts. Stored history supports comparisons of estimates, recurring retrospective words and action completion
• Pre-mortem rooms and risk registers are retained for 90 days after their last activity, so teams can return for a check-in
• Private workshop drafts are stored in your browser until acknowledged submission; clearing browser data removes unsent drafts
• Usage analytics are retained for service improvement purposes
• You can request deletion of your data by contacting us

Your Rights

Under applicable data protection laws, you have the right to:

• Access your personal data
• Correct inaccurate personal data
• Request deletion of your personal data
• Object to processing of your personal data
• Data portability

Cookies and Tracking

We use local storage to remember your username and last session for convenience, and to remember an anonymous analytics visitor identifier. We use analytics to track usage patterns but do not use advertising cookies or sell data to advertisers.

Changes to This Policy

We may update this privacy policy from time to time. We will notify users of significant changes by updating the "Last updated" date at the top of this policy.

Contact Us

If you have any questions about this privacy policy or our data practices, please contact us at: