Our Privacy Manifesto
We practice strict data minimization by design. We collect only the functional bare minimum required to power your agile ceremonies and keep your team aligned. Hosted in the EU and fully GDPR compliant, we never track your activity or monetize your identity.
1. Data Storage Matrix
Here is exactly what data sprinting.tools accesses, where it goes, and how long it lives:
| Data Category | Storage Location | Retention Policy | Accessibility |
|---|---|---|---|
| Account Profile (Email, display name, color) | Supabase Auth & Database (Zurich, Switzerland) | Until account deletion | Authenticated owner & administrators |
| Guest Preferences (Display name, color, history) | Client Browser (`localStorage`) | Persistent (User cleared) | Strictly local browser |
| Planning Poker / Retro / Kanban States | Supabase Database (Zurich, Switzerland) | Auto-purged after 14 days of room inactivity | Users with valid room code |
| Realtime Signals (Votes, pointer positions) | Server Memory (WS Channels) | Ephemeral (Destroyed on exit) | Active room participants only |
| Analytics & Cookies | None | No cookies generated | N/A |
2. Realtime Transmissions
Our realtime interactions (such as vote submissions, timer ticks, and retro item placements) are brokered through secure WebSocket connections. These payloads are processed in memory and propagated immediately to other squad members in the room. They are never written to permanent disk storage, providing native compliance with temporary records.
3. GDPR & Hosting Compliance
Sprinting.tools is aligned with European data security policies:
- Physical Servers: All client interactions are hosted on secure application servers located in Germany (hosted via IONOS). Databases and realtime presence nodes are hosted on Supabase servers inside the Zurich, Switzerland jurisdiction (fully covered under EU adequacy decisions for equivalent data protections).
- No Third-Party Sales: We do not license, share, or expose data to third-party sales networks, telemetry suites, or AI training engines.
- No Tracking Cookies: sprinting.tools operates without cookie-consent banners because we do not use non-essential tracking cookies, third-party analytics (like Google Analytics), or behavioral advertising pixels.
4. Our Data Processors
To deliver the Service, we partner with reputable cloud infrastructure providers acting as our Data Processors under strict Data Processing Agreements:
- IONOS SE — Cloud infrastructure and application hosting servers in Germany.
- Supabase Inc. — Database infrastructure, user authentication, and realtime presence engines (Servers in Zurich, Switzerland).
- Resend Inc. — Transactional email notifications (such as password reset requests).
5. User Rights & Manual Data Requests
Under the GDPR, you have the following rights regarding your personal data:
- Right to Access: Request a copy of all personal data we hold about you.
- Right to Rectification: Request correction of inaccurate personal data.
- Right to Erasure (Right to be Forgotten): Request that we permanently delete your account and personal records.
- Right to Portability: Request an export of your personal data in a structured, machine-readable format (CSV).
Since our registration system is kept minimal, most data lives in your browser's local storage (which you can clear at any time). For account credentials or room details stored in our database, you can exercise your rights by emailing us at privacy@sprinting.tools. We will verify your ownership and fulfill your request manually within 30 days at zero charge.
6. Security & Encryption
We apply state-of-the-art security patterns to safeguard internal team collaboration: all traffic is piped through HTTPS / TLS 1.3 tunnels, preventing local or network intercept. We utilize Row-Level Security (RLS) policies within our data transport layer to ensure that messages can only be retrieved by clients possessing the active, generated cryptographic room code. Passwords for registered accounts are securely hashed using industry-standard hashing algorithms managed by our auth partner.