Privacy and security

This page describes what the software does to protect sessions and accounts – technical enough that you can check it. Legal details are in the privacy policy.

Hidden input stays on the server

In planning poker, before the reveal your browser only knows whether somebody has voted – not what. Each person gets their own view of the room from the server; the value of somebody else's vote is not in it, not even in the network data a browser developer tool shows. Only the server's "reveal" step puts the values into the view.

In the retrospective the same holds: during silent writing other participants do not see your notes before they are revealed. With "anonymous notes" on, the author's name does not leave the server at all – comments and summaries carry no name either.

Connection and sign-in

• The connection to AgileHub is encrypted (HTTPS). Browsers are told by HSTS to connect only encrypted.
• Sign-in runs through Firebase Authentication (email and password, email link or Google). A password goes straight to Firebase – AgileHub neither receives nor stores it. An account with a password only counts once you have confirmed your address with a link.
• After signing in your browser receives its own session cookie: not readable by JavaScript (HttpOnly), only over HTTPS (Secure), only for this website (SameSite).
• Every request that changes something additionally needs a security token (CSRF token) and comes from this website – a foreign page cannot trigger anything in your name.
• Under "Account" you see all devices you are signed in on and can sign out single ones or all.

Protection of the application

• Every input is checked on the server against a schema before anything happens. What does not fit is rejected.
• Notes, story texts and names are shown as text only, never as HTML. Injected code becomes visible text.
• A Content Security Policy allows scripts only with a one-time random value per page load and only from the places the page needs. Further security headers (X-Frame-Options, Referrer-Policy, Permissions-Policy) are set.
• Creating sessions and joining are limited per address, so nobody can try out room codes or create rooms in bulk.
• Whether somebody is a workspace member is decided by the server on every request, based on the role. Anyone who is not a member gets "not found" – not even confirmation that the workspace exists.
• Changes to members, roles, plan and connections of a workspace are recorded in a change log that admins can view.

Connections to other services

• Credentials for Slack, Teams, Jira, Linear, Trello and Confluence are stored encrypted and never returned to the browser – only a note that they exist.
• Outgoing connections only go to public addresses over HTTPS. Internal addresses are blocked, so a connection cannot be abused as a way into an internal network (protection against server-side request forgery).
• Payments run entirely at Stripe. Payment data never reaches AgileHub. The messages Stripe sends to AgileHub have their signature checked and each is processed at most once.

AI features

AI summaries are optional, available only on paid plans and off by default. Nothing goes to an AI provider until an admin of the workspace has explicitly allowed it – and only for sessions of that workspace. Without that approval no retro content leaves AgileHub for a summary.

Translating content: every reader can switch it on themselves. Where the browser can translate on the device, everything stays there; otherwise only the texts the person sees anyway go to the AI provider without names and are cached for at most 7 days. The facilitator can switch translation off for a session, an admin for the whole workspace. Without an account 3 server translations a day are free. Details in the privacy policy.

AI helpers (writing/improving a ticket, making an action SMART, grouping notes, a status report draft from a sprint) exist only with an account and only on click. The result is always a marked suggestion – only what you take over is taken over. For a session's or a workspace's content the same applies as for the summary (plan and approval by an admin); on top there is a daily allowance per plan. Only what you may see anyway is sent, without names.

Data, retention and deletion

• What a session needs is stored. For how long depends on the plan (table under Plans and limits). After that, sessions are deleted automatically.
• Reports contain no rankings of individuals and no individual votes.
• AgileHub sets no analytics or tracking cookies. Which cookies exist and what for is under Cookie settings.
• Deleting sessions: the host, whoever opened the session and the workspace admins can delete a session at any time. With an account, or in a workspace, it goes to the trash first, where it can be brought back for a while (the page says until when for each session); after that – or right away on request – it is removed for good. A session opened without an account is deleted at once and for good, because nobody could bring it back. A deleted workspace takes its sessions to the trash with it and brings them back when restored.
• In the account settings you can download your own data as a file and delete the account together with its sessions. A workspace's owners and admins can export its data as a file (in the workspace settings) – without credentials, join codes and without names on cards and notes.

What this page does not promise

It describes the behaviour of the software. Certifications, data processing agreements and the location of processing depend on the operator and are – where they exist – in the privacy policy and on the data processing page.

Report a vulnerability

Found a problem that affects security? Please write to us through the contact form with the topic "Security" and describe what you saw – without opening or changing other people's data. We confirm receipt and get back to you with the next steps.