fibb privacy policy

Version:: 0.1
In force from:: 2026-07-30
Last updated:: 2026-07-30

1. In short

fibb is a planning poker tool — team estimation of work items. It collects as little data as it can:

You do not need an account to play. A room code and a nickname are enough, and the nickname can be any alias you like.
We do not track you. There are no analytics or marketing cookies, we build no profile of you, and we pass your data to nobody.
Nothing leaves this server. The page loads no resources from anyone else's servers — no fonts, no scripts, no statistics. The invitation QR code is produced on our own server rather than by somebody else's service.
A room stops being reachable after 7 days. After that nobody can enter it; we keep the record of the session — see section 5.

The rest of this document says all of that in detail, as the General Data Protection Regulation requires.

2. Who is responsible for your data

The controller of your personal data is PB Consulting Piotr Bączyk, ul. Młynarska 42/115, 01-171 Warszawa, Poland, VAT ID: PL7231607384, REGON: 369435597.

For anything to do with personal data, write to contact@fibb.dev.

We have not appointed a data protection officer. Write to the address above for anything concerning your data.

3. What we collect

3.1 If you only join a room, without an account

the nickname you give when joining — it may be an alias and we do not verify it,
the room code and the role you chose (participant, observer, facilitator),
the votes you cast and how the round went,
cookies — described in section 9,
your IP address, recorded in the server logs.

We do not ask you for an email address, a telephone number or your name. The nickname is a free text field and everybody else in the room sees it — so if you would rather not give your name, do not give it.

3.2 If you have an account with us

Accounts exist for running the instance and are not needed in order to play. Registration is off by default — the operator creates accounts.

a display name and an email address,
a password hash (argon2id) — we never store passwords in the clear,
passkey data, if you add one,
an authenticator secret, if you turn on a second factor — held encrypted,
your role in the instance.

3.3 Technical data

Server logs — the IP address, information about the browser, and the time and kind of each request.
Failed sign-in counters — recorded in order to stop password guessing. An email address goes into them only as a cryptographic hash, never in the clear, and an IP address only as a network prefix rather than the full address. The counters expire on their own.
A per-address abuse counter — held in the server's memory alone, and gone on every restart.

4. Why we process data, and on what basis

Purpose: Running the room: voting, revealing the cards, round statistics
Legal basis: Art. 6(1)(b) GDPR — performance of a contract

Purpose: Running an account and authenticating it, second factor included
Legal basis: Art. 6(1)(b) GDPR — performance of a contract

Purpose: Keeping the service safe: logs, countering abuse and password guessing
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest

Purpose: Running the instance: reviewing the list of rooms and supporting the people who use it
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest

5. How long we keep data

Data: Access to a room
Period: 7 days from its creation — after that the room stops being reachable for participants

Data: The record of a session: nickname, votes, how the rounds went
Period: kept after the room expires, for running the instance and for support

Data: An account
Period: until the operator deletes it

Data: Server logs
Period: no longer than 30 days — see the explanation below the table

Data: Failed sign-in counters
Period: they expire on their own

We say this plainly, because the difference misleads people. After 7 days a room stops being reachable — nobody can enter it or see what is in it through the application. That is not the same as deletion: we keep the record of the session, and the operator of the instance can see the list of every room, expired ones included, together with its name, its code, its deck, whoever opened it and when it was created. If you want the record of your session removed sooner, write to the address in section 2.

Thirty days is a ceiling, not a promise. We do not hold server logs for longer than 30 days, but we may remove them sooner — for instance once a log file grows past a set size. So we do not promise that the last thirty days of history are always there. We promise that we do not keep it any longer than that.

6. Who we pass data to

Nobody. We do not sell your data, we do not hand it to brokers, and we use no external service that data would be passed to — the application makes no connection to anyone else's servers, and your browser fetches nothing from them.

The one entity that technically comes into contact with the data is OVH Sp. z o.o., ul. Powstańców Śląskich 9, 53-332 Wrocław, Poland, on whose server the application runs.

We may disclose data to lawful authorities where the law requires it.

We process all data inside the European Union and transfer none of it outside the European Economic Area.

7. Your rights

You have the right to:

access your data and obtain a copy of it,
rectification of data that is inaccurate or incomplete,
erasure of your data, the so-called right to be forgotten,
restriction of processing,
portability of your data to another controller,
object to processing that rests on our legitimate interest,
lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa, Poland.

We honour every one of these rights by hand, on a message sent to the address in section 2 — and we answer within a month. The application has no self-service deletion of an account or a room today; when that changes, we will update this section.

To act on a request about a session you took part in without an account, we need the room code and the nickname you used — otherwise we have no way to pick out your data from everybody else's.

8. How we protect data

the connection is always encrypted — HTTPS and nothing else — with encryption enforced at the domain level,
the cookies the service needs in order to work are unreachable from scripts in your browser, limited to our own site, and sent only over an encrypted connection; the two preference cookies — the theme and the language — are written by the page itself, so your browser has to be able to read them back, and they hold nothing beyond the theme and the language you chose,
the room-access cookie and the session cookie are cryptographically signed, and we verify the signature in a way that resists timing attacks,
a strict content security policy (CSP) that limits which scripts may run,
passwords only ever as argon2id hashes; passkeys and second-factor authentication available,
access to a room and to the facilitator controls is decided on the server, and denied by default,
attempts are limited per IP address, against the guessing of room codes and passwords,
data minimisation built into the product: a participant creates no account and gives no email address.

9. Cookies

We use only the cookies the service needs in order to work and the ones that remember your preferences. None of them is used for tracking, and no third party sets cookies on our site.

Necessary cookies. They hold what the service cannot work without: the link between your browser and the rooms you have access to and the role you hold; the signed-in state of somebody who has an account; a single passkey operation; and a check of whether your browser accepts cookies at all. Their lifetimes differ — from a single visit and a single operation, through a day of being signed in (or 30 days if you pick "remember me"), to the moment the room expires. No third party is involved in any of them. You can block them in your browser's settings, but then the service will stop working properly.

Preference cookies. They remember the theme and the language you chose, so the page looks the way you left it. They hold nothing beyond those two preferences, they live for a year, and no third party is involved in them. You can delete them in your browser's settings at any time — the service works without them.

We use no analytics or marketing cookies. That is why we show no consent banner — there is nothing to ask for.

10. No profiling, no advertising

We do not profile our users, and we take no automated decisions about you that produce legal effects or otherwise significantly affect you.

There is no advertising on this service.

11. Children

The service is not aimed at anybody under 16, and we do not knowingly collect their data.

12. Changes to this policy

We may update this policy, for example when we add a new feature. Every version carries the date it came into force, and we retain earlier versions. If you need an earlier version, write to contact@fibb.dev and we will send it to you.

The rule we bind ourselves with: this policy describes the features that exist, not the ones we are planning. A new feature that processes data appears in this document together with itself rather than ahead of itself.

13. Contact

For anything to do with personal data, write to contact@fibb.dev.

Postal address: PB Consulting Piotr Bączyk, ul. Młynarska 42/115, 01-171 Warszawa, Poland.