Cookie policy

What are cookies?

Cookies are small text files that a website places on your computer or phone when you visit it. They are widely used to make websites work, and to give the website owner information about how the site is used.

How EstimateIt uses cookies

EstimateIt uses Google Analytics, a web analytics service provided by Google, to count visits and understand how the site is used, so that it can be improved. These cookies are only set if you choose Accept on the cookie banner. Until you do, the Google tag is not loaded and nothing is sent to Google. If you accept, Google Analytics sets the following cookies in your browser:

These cookies are set through the Google tag (measurement ID G-KVQCY0BP40) on each EstimateIt page you visit after choosing Accept. The information they collect, such as the pages you view, your approximate location, and your browser and device type, is sent to Google. We do not add the secret host key or any part of a room link to what is sent: the page address reported to Google has the part after the # removed.

Google may use this information in line with its own privacy policy: How Google uses information from sites or apps that use its services.

Other information stored in your browser

To work, EstimateIt also keeps a few items in your browser's own storage. These are not cookies and are not used for advertising or analytics. They are not sent to Google.

• Your cookie choice (Accept or Decline), so the banner isn't shown again.
• Your Planning Poker room settings (Settings on Your account, or the start screen when you choose Scrum Master).
• The name and role you last entered, so the join form can be filled in for you.
• A random identifier for the browser tab you are using, so the room can tell participants apart.
• For a facilitator, the private host key of a room they started, so they can keep control of it.
• For a facilitator who uses Change room settings, the changes they made, kept in that browser tab only until they return to the room.
• If you use the Business Value scorecard, your unfinished scorecard, so it's still there when you come back. It's linked to your account and removed if you delete your account.
• If you save a draft on the Contact us page, the report type and text you wrote. It stays in this browser only, and is removed when you submit it, discard it, log out or delete your account.

The fonts (Familjen Grotesk, Public Sans and JetBrains Mono) are stored on this site, so showing them doesn't contact Google or anyone else.

If you have an account

When you log in, EstimateIt sets one cookie. It is strictly necessary for logging in, so it is set without asking, and it is never used for analytics or advertising.

For your account we store your email address, a scrambled form of your password (a one-way hash made with Argon2id, which can't be turned back into the password) the date you created it, and whether the administrator has approved it. New accounts can't be used until you've confirmed your email address and the administrator has approved them, and the administrator can delete any account. Unconfirmed accounts are removed after 7 days. We only email you about your account: to confirm your address, to say it's approved, to reset your password, to confirm a new email address, and to tell you when your password or email address changes or your account is deleted, and when two-step login is turned on or off or a backup code is used. We don't share your address with anyone.

If you're logged in when you take part in a Planning Poker room, we keep a copy of that session for you under Past sessions on Your account: when you were there, the role you joined as, and each issue that got an agreed estimate (its title, type, Jira link and the agreed estimates). We don't keep anyone's name or individual vote. You can delete a session at any time, and deleting your account removes them all.

If you use the Cost Estimator, the estimates you save (project name, description, Jira and Confluence links, and the roles, FTE, working days and day rates of each resource row) are kept with your account so you can open them again. Only you can see them. You can delete an estimate at any time, and deleting your account removes them all.

If you turn on two-step login, we also store the secret your authenticator app uses to make codes (encrypted), scrambled forms of your backup codes, and which code you used last, so each code works only once. Turning two-step login off removes them. The QR code is drawn in your browser; the secret isn't sent to any other service.

When you create an account or choose a new password, the first 5 characters of a scrambled form of your password are sent to the Have I Been Pwned service to check whether the password has appeared in a known data breach. Your password itself and your email address are never sent.

You can delete your account at any time from the Your account page. That removes your email address, your password hash and every log-in session straight away, and it can't be undone. Our hosting company's routine backups may keep a copy for a short time until they are replaced.

If you send a report through Contact us

We store the report type, your message, the date you sent it and its status. If you were logged in, the report is linked to your account so you can follow it on Your account, and the administrator sees your email address next to it. If you weren't logged in, we store nothing that identifies you.

If you choose Submit via email, the same report is also emailed to the administrator from hello@estimateit.co.uk. If you were logged in, the email includes your email address so the administrator can reply to you.

Reports are kept until the administrator deletes them. If you delete your account, reports you've already sent stay, but your email address is no longer shown with them.

Your choices

You can change your mind at any time. Use Cookie settings to open the choice again: Decline removes the Google Analytics cookies from this browser. You can also stop analytics cookies in these ways:

• Change your browser settings to block or delete cookies. How to do this depends on your browser, and aboutcookies.org explains how for most of them. Blocking cookies does not stop EstimateIt from working.
• Install the Google Analytics opt-out browser add-on.

Changes to this policy

This policy may be updated from time to time. The date at the top shows when it was last changed.