Planning Poker for Jira

Privacy Policy

Last updated: 5 May 2026

1. Scope of this policy

This Privacy Policy describes how the Planning Poker for Jira Forge app ("the App"), distributed on the Atlassian Marketplace by Kee Ling Xuan ("Vendor", "we", "us"), handles data. The App consists of two surfaces in the same Forge package: an issue panel where teams vote on a single Jira issue, and a project settings page where a project administrator configures the Story Points field and the issue types that should display the panel.

This policy covers the Forge app only. The standalone companion web app available at online-poker-game.web.app is a separate product with a different data model and is not covered by this policy or installed by the Marketplace listing.

2. Data we collect

2.1 Data from Atlassian

When a user opens the panel or the settings page, the App reads:

The user's Atlassian accountId and displayName (to identify hosts and voters).
The current Jira issue's key, issue type id and name, and the value of the configured Story Points custom field (read once before write-back, and on each panel load to gate by issue type).
On the settings page only: the list of custom fields available on the site (id, name, schema type) returned by /rest/api/3/field, used to populate the field-picker.
On the settings page only: the caller's Jira permissions, returned by /rest/api/3/mypermissions, used to gate writes to project administrators.

2.2 Data from end users

Vote values selected during a round (Fibonacci cards: 1, 2, 3, 5, 8, 13, 21, ☕).
Host selections, including the optional "Set as project default" checkbox state.
On the settings page: the project admin's choice of Story Points field and optional Original Story Points field, the issue-type allowlist, and a setup-acknowledgement timestamp.

2.3 What we do not collect

The App does not collect email addresses, passwords, Atlassian OAuth tokens, payment information, location data, biometric data, or analytics events. It does not include any third-party tracking scripts.

3. Lawful basis

Processing is based on the legitimate interest of the customer organisation in providing Story-Point estimation tooling to its team members. For data protection purposes, the customer organisation is the controller and the Vendor (Kee Ling Xuan) acts as a processor.

4. Sub-processors and third parties

Atlassian Forge runtime — hosts the App, executes its resolver functions, and provides Forge Storage. The App's data resides in the Atlassian site's region; data residency is inherited from the customer's Atlassian site configuration.

We use no other sub-processors. There are no analytics, tracking, advertising or marketing services integrated into the App.

5. Where data is stored and how long it is kept

All data the App stores is held in Forge Storage on the Atlassian Forge runtime:

Data	Storage key	Retention
Active voting session (votes, state)	`session:<issueKey>`	Auto-deleted 8 hours after last activity, or immediately on End session.
Per-issue host assignment	`host:issue:<issueKey>`	Retained until changed by a user.
Per-project default host	`host:project:<projectKey>`	Retained until changed by a user.
Per-project field mapping	`project:<projectKey>:fields`	Retained until changed by a project admin.
Per-project issue-type allowlist	`project:<projectKey>:issueTypes`	Retained until changed by a project admin.
Per-project setup acknowledgement	`project:<projectKey>:setup`	Retained until cleared by a project admin.
Custom-field list cache	`fields:list`	24 hours.

When the App is uninstalled, the Atlassian Forge runtime automatically purges all storage:app data per Forge platform policy. The Vendor keeps no copy of customer data outside the Forge runtime.

6. Who can see what

Any user on the Jira site with read:jira-work can open the panel and cast a vote; values stay hidden until the host clicks Reveal.
All users on the same Jira site share the same Forge Storage namespace and therefore see the same panel state for a given issue.
Story Points write-back is performed via api.asUser(), so it respects the host's own Jira edit permissions.

7. Your rights

You may request access, export, correction, or deletion of personal data the App holds about you by contacting keemn116@gmail.com. We will respond within a reasonable time and will route the request to the customer organisation (the controller) when required.

8. Security

The App runs entirely inside the Atlassian Forge runtime sandbox.
The App stores no OAuth secrets or service-account credentials, on the client or server side.
All Jira API calls use api.asUser(); the App never elevates permissions.

9. Children

The App is a workplace tool and is not directed at children under 13 (or under 16 in jurisdictions where that is the relevant threshold). We do not knowingly collect data from children.

10. Changes to this policy

We may update this policy from time to time. The current version is always published at this URL with a "Last updated" date at the top. Material changes will be reflected by updating that date.

11. Contact

Kee Ling Xuan
Email: keemn116@gmail.com