Privacy

What we collect

• Your email address, so we can sign you in.
• Which organization and teams you belong to, and your role in each.
• Your answers in retros, polls and “did it help?” checks, including votes and comments. In anonymous sessions, answers are not stored with your account. See below.

Guests who join a session with a code don’t need an account. If the facilitator allows it, a guest can enter a display name they choose.

How you sign in

You sign in with a link we send to your email address. There are no passwords.

How anonymity works

Each session is set to anonymous or named when it is created. The setting locks once the first answer arrives and can’t be changed after that. People see whether a session is anonymous before they answer.

In an anonymous session:

• The session gets its own random secret. Your answers and votes are stored against a code made from that secret and your participant key. Your user ID is never stored with them.
• While the session is open, that code lets you edit or delete your own answers, restores your answers if you reconnect, and stops anyone voting twice.
• Managers, admins and everyone else in your organization can never see who wrote an anonymous answer.
• When the session closes, the secret is deleted. From then on, nobody can link an answer back to a person, including us. Editing your own answers ends when the session closes.
• The secret is never written to logs, analytics or separate backups. Database backups made while a session is still open do contain its secret.
• When a session closes we store the number of people who took part, as a plain count.
• Reports don’t show anonymous results for groups of fewer than three people.

Shoutouts are never anonymous.

Contact

Questions about your data or this summary: email [email protected].