Privacy

What is stored

• From GitHub sign-in: your GitHub account id, name, email and avatar link, and GitHub's sign-in tokens, stored encrypted and not used after sign-in. No password.
• Your sign-in sessions, each with the browser type and IP address it started from, so a session can be recognised. A session ends when you sign out, after a week unused, or when you delete your account.
• The projects, stories, sprints and snapshots you create or upload, and their scores.
• A count of sign-in attempts per IP address, signed in or not, to slow down repeated tries. Counts older than a day are deleted daily, as are ended sessions.
• How many Jira requests, imports and rule changes your account made in the last few minutes, to stop a runaway script. Just the counts, deleted after a day.
• Anonymous usage counts (checks run, imports, reports) with no user id or story text. Whoever runs Sprintwise sees totals, such as how many accounts have created a project, never who.

Visit counts

The live site counts page views with Vercel Web Analytics. It sets no cookies and stores nothing on your device. Vercel tells visits apart with a hash of the request that it discards after 24 hours, so a visit can't be tied to you or followed to other sites.

Before anything is sent, Sprintwise removes project, story and sprint ids, share-link tokens, and everything after a “?” in the address, such as search terms. What's left is the kind of page, the site you came from, your country, and your device and browser type.

Cookies and browser storage

Sprintwise sets cookies only to sign you in, and none for tracking or advertising, so there's no cookie banner. Without them, signing in can't work.

• better-auth.session_token: keeps you signed in. Set when you sign in; ends when you sign out or after a week unused.
• better-auth.session_data: a signed copy of your session that saves a database check on each click. Lasts five minutes.
• better-auth.state: checks that a GitHub sign-in or Jira connection came back to the browser that started it. Lasts five minutes.

On the live site each name starts with __Secure-, and none can be read by page scripts. Your light or dark theme choice is kept in your browser's local storage and never sent anywhere. Visit counts use no cookies (see above).

Jira connection

Connecting Jira is optional. When you connect, Atlassian gives Sprintwise tokens to read issues (read:jira-work), to update them (write:jira-work), and to see which Atlassian account connected (read:me). The tokens are stored encrypted and refreshed automatically. Sprintwise reads only the issues your saved search returns, and writes only when you click Send to Jira: the title, description, acceptance criteria and story points of stories you edited here. The project keeps the Jira site and search you chose. While a sprint built from the backlog is running, Sprintwise also runs that search once a night to record the day's changes; you can turn this off in the project's Settings. Disconnect from your Account page, which deletes the tokens; you can also revoke access from your Atlassian account settings.

From your Atlassian account, Sprintwise keeps only its account ID, to know which tokens are yours; not your name, email or profile. As Atlassian requires, Sprintwise reports the account IDs it keeps to Atlassian once a week, and if Atlassian says an account was closed, Sprintwise deletes its connection.

Share links

Nothing is public unless you share it. A sprint report link shows that one report; a backlog link shows the project's unfinished stories (titles, descriptions, acceptance criteria, scores, statuses and points), never its sprints, settings or other projects. Anyone with a link can view it without an account. Each link carries a long random secret, stays out of search engines, and stops working the moment you turn it off. Pasted into a chat app, a link shows a preview card with the sprint or project name and its headline numbers, which the chat app may keep after the link is turned off.

AI suggestions

AI suggestions are switched off on this site, so no story text is sent to any AI service. Scores never use AI; they come from fixed rules.

The demo

The demo uses invented sample data. Stories you score there are scored in your browser and never sent or saved.

Deleting your data

Deleting a project removes everything in it. Deleting your account on the Account page removes your account and all your data at once, and cancels Sprintwise's access to your GitHub account. To be sure, you can also check GitHub's settings (Applications, then Authorized OAuth Apps) and, if you connected Jira, your Atlassian account's connected apps.

Feedback

Send feedback opens a short form on GitHub. It's posted as a public issue under your GitHub account, so describe things in general terms and leave out story text or anything else from your work.

Reporting a security problem

Please report it privately through GitHub's vulnerability reporting, not in a public issue. The security policy says what's in scope and what to expect.