Privacy Policy
Last updated: October 9, 2026 · Version: 2.0
In short
- Pointing Out is run by one person, Darwin Valentin Luque Madrid, who lives in Honduras.
- We collect what we need to run planning-poker Rooms: your account details, what you and other Participants type into Rooms, and technical data that keeps the service working and secure.
- We do not sell your data. We do not show ads. We do not use advertising or analytics trackers.
- We use a short list of service providers, named in section 6. Our hosting and database providers run in the United States.
- You can see, correct, export or delete your data. Email [email protected].
1. Who we are
Pointing Out (“we”, “us”) is operated by Darwin Valentin Luque Madrid, an individual based in Honduras. It is not run by a company. Darwin decides how and why your personal data is used, so he is responsible for it (the “controller”).
- Privacy contact: [email protected]
- Data Protection Officer: we have not appointed one. Brazil’s data protection law lets small-scale processors, including individuals, skip this as long as they give people a way to reach them about their data. The privacy contact above is that channel.
- Person in charge of protecting personal information: Darwin Valentin Luque Madrid, at [email protected]. Quebec’s Law 25 gives this role to the highest-ranking person by default, which here is the person who runs the service.
- EU or UK representative: we have not appointed one. The Service is not offered to residents of the EU/EEA or the UK: Pointing Out is a solo project run from Honduras with no EU/UK office, and paid plans are not offered to EU/UK residents. If you live in the EU/EEA or the UK, you must not create an account or use the Service (see Terms §1). Accounts identified as EU/UK-based may be suspended or deleted. If we ever offer the Service in the EU/UK, we will appoint a representative first.
2. What this policy covers
This policy covers the Pointing Out website and app at https://pointingout.app and its realtime service. It does not cover GitHub, Linear or Jira. When you use those services, their own privacy policies apply.
3. The data we collect
| Type of data | What it includes | Where it comes from |
|---|---|---|
| Account details | Name, email address, password (we store only a scrambled “hash”, never the password itself), and whether your email is verified | You, when you sign up |
| Email verification link | A signed token in the link we email you when you sign up. The link expires after one hour. We don’t store the token on our servers | Created when you sign up |
| GitHub sign-in | Your GitHub account ID, name, email, profile picture, and the sign-in tokens GitHub issues | GitHub, only if you choose “Sign in with GitHub” |
| Sign-in sessions | A session identifier, your IP address, your browser and device type, and when the session starts and ends | Collected automatically when you sign in |
| Room content | Room title, card set and Reveal timer settings. Each Participant’s display name and Scorer type (Dev or QA). Stories (title, description, ticket reference). Votes, and whether a Participant has left | You and the other Participants in a Room |
| Linear and Jira connections | Your Linear or Jira account ID and workspace or site name. Access tokens, which we store encrypted | Linear or Atlassian, when you connect your account |
| Imported issues and published estimates | For issues you import: title, description, issue key, link, and team, project or board. The estimates we write back to the issue | Linear or Jira, when you import issues or publish estimates |
| Usage and error records | Which app features were used, whether they worked, how long they took, error codes, Room and Participant IDs, and realtime connection events | Collected automatically |
| Server logs | IP address, the page or address requested, and the time | Collected automatically by our hosting providers |
| Messages to us | Your email address and what you write | You |
You don’t need an account to join a Room. Guests give only a display name. It doesn’t have to be your real name.
Data about other people. Imported issues and Stories may mention other people, for example a name in an issue description. We receive that data from Linear, Jira, or the person who types it, when a Room member imports or adds it.
What you must give us. To create an account, you must give a name, an email and a password. To join a Room, you must give a display name. Without these, we can’t provide the service. Everything else is optional.
What we don’t collect. We don’t collect payment details or your precise location. We don’t ask for sensitive data such as health, religion or political views. Please don’t put sensitive information in Room titles, Stories or display names.
4. How we use your data, and why we’re allowed to
Privacy laws such as the EU and UK GDPR require a legal reason, called a “legal basis”, for each use. The table lists ours.
| What we do | Data used | Legal basis |
|---|---|---|
| Create your account and sign you in | Account details, GitHub sign-in, sessions | Needed to provide the service you asked for (contract) |
| Verify your email address when you sign up | Email address | Contract |
| Run Rooms: show who is in the Room, keep votes hidden until Reveal, show results, and keep everyone in sync in real time | Room content, browser storage | Contract |
| Connect Linear or Jira, import issues, and publish estimates, only when you ask | Linear and Jira connections, imported issues | Contract |
| Keep the service secure: limit how many requests one address can make, prevent abuse, and investigate misuse | IP address, sessions, server logs | Legitimate interest in protecting the service and its users |
| Keep the service reliable: find and fix errors and slow features | Usage and error records, server logs | Legitimate interest in running a working service |
| Reply to your messages and requests | Messages to us | Contract, or our legal duty when you exercise a privacy right |
| Meet legal duties and defend legal claims | Only what is needed | Legal obligation, or our legitimate interest in defending claims |
Where we rely on legitimate interests, you can object. See section 10.
We don’t use your data for advertising or profiling. We don’t make automated decisions that have legal or similarly significant effects on you.
5. Who can see what inside a Room
- Anyone with a Room’s link can join it.
- Everyone in a Room can see the Participants’ display names and Scorer types, the Stories, and who has voted.
- Votes stay hidden until the Moderator triggers the Reveal. After that, everyone in the Room can see every vote.
- The Moderator controls the Room. If a Room’s estimates are published to Linear or Jira, anyone with access to that Linear workspace or Jira site can see them.
6. Who we share data with
We share data only with the providers below, and only for the purposes in section 4.
Providers that run the service for us. They handle data only on our instructions, under data processing agreements.
| Provider | What they do | Data involved | Location |
|---|---|---|---|
| DigitalOcean | Hosts the website, app and the realtime service that keeps Rooms in sync | All data sent through the app, plus server logs with IP addresses | United States |
| Turso | Hosts our database | All stored data in section 3 | United States |
| EmailJS | Sends the email that verifies your address when you sign up and the policy-change notices in section 14 | Your email address and the text of the message we send you, which for verification includes your verification link | United States |
Services you choose to connect. These companies are responsible for their own handling of data under their own policies.
- GitHub, if you sign in with GitHub. GitHub learns that you signed in to Pointing Out.
- Linear and Atlassian (Jira), if you connect them. We read the issues you import and write estimates to the issues you publish.
Other sharing. We disclose data if the law requires it, or if it’s needed to protect people’s safety or our legal rights. If Pointing Out is sold or transferred, your data would move to the new operator. We would tell you before that happens, and this policy would keep applying to data collected under it.
We do not sell your personal data, and we do not share it for targeted advertising.
7. Data sent to other countries
Pointing Out is run from Honduras, and our providers store data in the United States. Wherever you live, your data is sent to and handled in those countries. Their privacy laws may protect you less than your home country’s laws do.
Transfer safeguards per provider: DigitalOcean — its published data processing agreement relies on its EU–US Data Privacy Framework certification (plus UK Extension), with the EU Standard Contractual Clauses and UK Addendum incorporated as a fallback (digitalocean.com/legal/data-processing-agreement). Turso — data processing agreement available via its trust portal (trust.turso.tech). EmailJS — the service is provided by EmailJS Pte. Ltd., a Singapore company, and its servers are in the United States; its published data processing agreement relies on the EU Standard Contractual Clauses for transfers to the United States (emailjs.com/legal/data-protection-agreement). On our current plans, transfer safeguards rely on each provider’s published terms and apply to the extent available under them. Email us for a copy of the safeguards that apply.
8. How long we keep data
| Data | How long |
|---|---|
| Account details and GitHub sign-in | Until you delete your account. We then delete them within 90 days |
| Sign-in sessions | 90 days after the session ends |
| Room content, imported issues and publication records | Until the data is deleted on request. We don’t delete Rooms automatically yet. Anyone whose data is in a Room can ask us to delete it. |
| Linear and Jira connections | We delete the access tokens when you disconnect. We keep a record of the connection (account ID and workspace name) until you delete your account |
| Usage and error records, and our own logs | 90 days. Our hosting provider doesn’t keep our app’s logs after the running server restarts or is replaced |
| Our hosting providers’ own server logs | DigitalOcean keeps build and deploy logs for 90 days. It doesn’t keep the logs our running app produces, because we don’t forward them to a log service. Other providers: for the period set in their terms |
| Messages to us | 2 years after our last reply, then we delete them |
We may keep data longer only if the law requires it, or to deal with a legal claim.
9. Cookies and browser storage
We use only cookies and browser storage needed to run the service or to remember a choice you made. We don’t use analytics or advertising cookies, so we don’t show a cookie banner.
| Name or purpose | Type | What it does | How long |
|---|---|---|---|
| Sign-in session cookies | Cookie | Keep you signed in | Until you sign out or the session expires |
sidebar:state | Cookie | Remembers whether the sidebar is open | 7 days |
| Room ID, Participant ID and Moderator key | Browser storage | Let you rejoin your Room and, if you’re its Moderator, manage it | Until you leave the Room or clear your browser data |
| Room history | Browser storage | Lists Rooms you visited so you can reopen them | Until you remove them or clear your browser data |
pointing-out-theme | Browser storage | Remembers light or dark mode | Until you clear your browser data |
Do Not Track. We don’t track you across other websites. Our service works the same whether or not your browser sends a “Do Not Track” signal.
10. Your rights
Wherever you live, you can ask us to:
- See the personal data we hold about you and get a copy.
- Correct data that is wrong.
- Delete your data.
- Export data you gave us in a common, machine-readable format.
- Restrict our use of your data while a concern is resolved.
- Object to uses based on our legitimate interests.
- Withdraw consent at any time. This doesn’t affect what we did before you withdrew.
How to ask. Email [email protected]. We’ll reply within one month. If your request is complex, we may take up to two more months, and we’ll tell you why. Requests are free. We may need to confirm who you are. Usually we do this by replying to your account’s email address. If you joined a Room as a guest, tell us the Room link and your display name.
Deleting your account. You can delete your account in the profile dialog, under Security. You can also email us to do it.
If we refuse your request. We’ll explain why. You can ask us to reconsider by replying to our answer.
Complaints. Please contact us first. We’ll confirm we received your complaint within 30 days and then respond as quickly as we can. You can also complain to a data protection authority:
- EU/EEA: your local authority. See the list at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en
- UK: the Information Commissioner’s Office, https://ico.org.uk
- India: the Data Protection Board of India.
- Elsewhere: your local data protection authority, if there is one.
11. If you use Pointing Out for work
Your employer or team lead may organize Rooms you join. When they do, they see only what every Participant sees, including your votes after the Reveal (see section 5). We don’t give your employer access to your account or to any data outside the Rooms you join, and we don’t process Room content on an employer’s instructions. Estimates published to your company’s Linear or Jira become part of that system and follow your company’s rules.
Your employer may have its own duties to you under employment and privacy law. For questions about how your employer uses Pointing Out, ask them.
For all data described in section 3, Pointing Out remains the controller (see section 1). We don’t currently offer organizational accounts or processing on an organization’s behalf, so we don’t offer a data processing agreement. If your organization requires one, contact [email protected] and we’ll tell you whether we can support that use.
12. Children
Pointing Out is a workplace tool and is not meant for anyone under 18. We don’t knowingly collect data from children. If you believe a child has given us data, email us and we’ll delete it.
13. Security
We use reasonable technical and organizational safeguards. For example:
- Passwords are stored only as scrambled hashes.
- Linear and Jira access tokens are encrypted when stored.
- All connections to the app use HTTPS.
Room links and Moderator keys work like keys to the Room. Share them only with people who should be there.
No system is completely secure, so we can’t guarantee the safety of your data. If a breach affects your data, we’ll notify you and the authorities as the law requires.
14. Changes to this policy
When we change this policy, we update the “Last updated” date at the top. For important changes, we’ll email account holders before the changes take effect. If a change would use data we already have in a new way, we’ll ask for your consent first where the law requires it.
15. Contact us
For privacy questions or requests: [email protected]