Privacy Policy

1.1 Information you provide directly

Account information: name, email address, password (hashed, never stored in plain text), and optional display name.

Session data: room names, story titles, votes, participant display names, and session history. Hosts control which data is entered into a room.

Communications: messages sent via support or email.

1.2 Information collected automatically

Usage data: pages visited, features used, and session duration.

Device and browser data: IP address, browser type, operating system, and referring URL.

Cookies: strictly necessary cookies only. No advertising or third-party tracking cookies.

1.3 Information from third parties

OAuth providers: if you sign in with Google, we receive your name and email from that provider.

We use your information to:

• Operate and provide realtime sprint estimation sessions.
• Authenticate hosts and maintain session state.
• Respond to support requests.
• Comply with legal obligations.
• Detect and prevent fraud, abuse, and security incidents.

We do NOT sell your personal data, use your session content to train AI models, or share voting data with other tenants.

Service providers: Lovable Cloud / Supabase (database, authentication, and realtime infrastructure), Cloudflare (edge network and DDoS protection), and email delivery providers — each bound by data processing agreements.

Session participants: votes and display names are shared within a room only after the host reveals the round.

Legal requirements: when required by law or to protect user safety.

Business transfers: with notice to affected users.

Account data: retained for the life of your account plus 90 days after deletion.

Session data: retained for 90 days after a room is closed or inactive.

Email and support logs: retained for 90 days.

You may request deletion at any time.

• Encryption in transit (TLS 1.2+) and at rest (AES-256).
• Row-level security (RLS) ensuring tenant and room data isolation.
• Regular security reviews and vulnerability scanning.

Report vulnerabilities to security@brightstack.us.

All users: access, correction, deletion, portability, and opt-out of marketing communications.

EU/EEA users (GDPR): legal basis is contract performance, legitimate interests, and consent. Right to object, withdraw consent, and lodge a complaint with your data protection authority.

California residents (CCPA/CPRA): right to know, delete, correct, and opt out of sale or sharing of personal information. We do not sell or share personal information for cross-context behavioral advertising. No discrimination for exercising privacy rights.

To exercise any right: privacy@brightstack.us. Response within 30 days (GDPR) or 45 days (CCPA).

Stacked is not directed to individuals under 16. Contact privacy@brightstack.us if you believe we have collected data from a child.

Servers located in the United States. EU/EEA and UK transfers rely on Standard Contractual Clauses (SCCs).

Material changes are notified by email or in-app notice at least 14 days before taking effect.

Stacked is operated by Brightstack, a division of Michell + Marteen LLC, Houston, Texas.
privacy@brightstack.us · brightstack.us