Privacy Policy

1. Information you provide and how we use it

We process account information such as your email address and name; team names, memberships and invitations; and the content you bring to a session, including ticket identifiers, titles, descriptions, estimates and messages. Guests can participate using a display name and a browser session identifier.

We use this information to operate accounts and workspaces, run collaborative sessions, save tickets and results, manage plan access, send account emails, respond to support requests and protect the service against abuse. Information you share in a room is available to other people who have access to that room. Workspace permissions determine who can manage team information and view saved results.

The service also processes technical information needed to handle requests and diagnose problems, such as IP addresses, request details and error information. Cookies keep you signed in and identify your session. Browser storage remembers your guest name, recently visited rooms and interface preferences. You can clear this storage through your browser; doing so may sign you out or remove remembered preferences.

2. Authentication

Google

If you sign in with Google, we receive your Google account identifier, email address and profile name to create or link your BacklogDeck account. Google handles your Google password; BacklogDeck does not receive it. Google sign-in is used for authentication, not to access your Gmail messages or Google Drive files.

Email and magic links

If you sign in by email, we use your email address to send a time-limited sign-in or confirmation link. We store authentication records to validate those links and maintain sessions. If you set a BacklogDeck password, we store a password hash, not the plaintext password.

3. Third-party integrations: Jira

What we access

Connecting Jira is optional. When you authorize BacklogDeck through Atlassian, we access the Jira Cloud sites made available by your authorization and read issues using your Jira permissions. Searches use the project, filter, issue key or query you supply. We use issue identifiers, keys, summaries and descriptions to preview and import tickets for estimation. Jira may return additional issue fields when an individual issue is retrieved; these are not saved as imported ticket fields.

Our OAuth integration requests read access to Jira work and permission to refresh its authorization while you are offline. The integration is read-only: it does not create, edit or delete Jira issues, or write estimates back to Jira.

What we store

We store the connected site's identifier, name and URL, granted permissions, token expiry and connection status, linked to your BacklogDeck account and workspace. OAuth access and refresh tokens are encrypted before being stored on our server. Refresh tokens let us renew access without asking you to authorize every import. Temporary site-selection data is also encrypted and has a time-limited validity.

If you use an API-token connection, we store the Jira site URL, email address and encrypted API token you supply. Imported tickets store the issue key, external identifier, title and description. Titles and descriptions can also be included in saved estimation results. Those fields may contain personal information entered in Jira.

Sharing and disconnecting

Imported content becomes part of your BacklogDeck room and can be viewed by people with access to that room, including guests. BacklogDeck room access is separate from Jira permissions. Only import content you are authorized to share with those participants.

You can disconnect Jira in your team's integration settings. This removes that saved connection and its credentials from BacklogDeck. We also attempt to revoke OAuth access with Atlassian; you can revoke access directly in your Atlassian account's connected-app settings. Disconnecting does not delete tickets or results you already imported. Contact us to request deletion of those copies.

4. Service providers and disclosures

Fly.io hosts the BacklogDeck application and processes the application data needed to run the service. Cloudflare provides domain and proxy services, processing website traffic that passes through its network, including IP addresses and request information.

We also use database infrastructure to store account, workspace and session data, and Resend to deliver account emails, including their recipients and contents. Google processes sign-in requests when you choose Google authentication, and Atlassian processes authorization and API requests when you connect Jira.

We may disclose information when required by law or when necessary to investigate abuse and protect the service or its users. Providers may process information in countries other than your own. Contact us for information about the providers and processing locations relevant to your use of BacklogDeck.

5. Data retention and deletion

Account, workspace, ticket and saved-result data is retained to provide the service and your session history. Ending a session, signing out or disconnecting an integration does not by itself delete that history. Authentication credentials have validity periods appropriate to their purpose; expiry prevents their use but does not necessarily mean their records are immediately erased.

To request deletion of your account, imported Jira content or other personal information, email [email protected]. We may need to verify your identity and coordinate with your workspace administrator where a request affects shared records. Some information may need to be retained to meet legal obligations, address security incidents or resolve disputes. Any copies in backups may remain until those backups are replaced or expire.

6. Security

BacklogDeck uses access controls for accounts and workspaces, password hashing and encryption for stored integration credentials. These measures help protect information, but no system can guarantee absolute security. Keep your sign-in links, passwords and room access details private, and contact us if you suspect unauthorized access.

7. Your choices and rights

You can update your account details in account settings, choose whether to connect integrations and clear your browser's stored data. Depending on the law that applies to you, you may have rights to access, correct, delete or receive a copy of your personal information, restrict or object to its processing, or withdraw consent where processing relies on it. You may also have a right to complain to a data protection authority.

Send requests to [email protected]. If your team supplied the information, we may direct the request to or work with its administrator. Revoking access at Google or Atlassian stops the authorization there; request deletion separately for information already held by BacklogDeck.

8. Changes and contact

We may update this policy as the service or its data practices change. The date above identifies the latest revision. For privacy questions, provider information or data requests, contact BacklogDeck at [email protected]. Our Terms of Service explain the rules for using BacklogDeck.