Privacy Policy

1. The short version

• We collect the data we need to run SimpleScrumTools: your account, the content your organization creates, and billing data for paid plans.
• We do not sell your personal information.
• We do not put our own tracking cookies in your browser. Our analytics set no cookies.
• Only organizations on the Free plan see ads. No advertising script loads until you click Accept on the consent banner. You can take that consent back at any time.
• Stripe handles card payments. We never see or store your full card number.
• We store the data in the United States.

2. Who we are

SimpleScrumTools (simplescrumtools.com) is a web application for teams that use Scrum. Strategic Move LLC, a Washington limited liability company, operates it. In this policy, “we”, “us” and “our” mean Strategic Move LLC. “You” means a person who visits the website or uses the application.

To contact us about privacy, use the Contact page.

3. What this policy covers

This policy covers the public website, the application, the public demo account and the emails we send. Together, this policy calls them “the Service”. The End User License Agreement (EULA) sets the terms of use.

Our two roles

For your account, for billing and for visits to the website, we decide how and why we use the data. Data-protection law calls this role the controller.

An organization in SimpleScrumTools belongs to a customer. The customer decides what goes into it and who can see it. For that content, which this policy calls workspace content, the customer is the controller. We are the processor. We use workspace content only to give the customer the Service, and on the customer’s instructions. If you are a member of an organization and you have a question about its content, ask the people who manage that organization first. If your organization needs a data processing agreement with us, use the Contact page.

4. The data we collect

Account data

When you create an account, we store:

• your email address and your display name
• your timezone, which we use to show dates and times to you
• whether you verified your email address
• a hash of your password, if you sign in with a password. We never store the password itself.
• the date we created and last changed the account
• the version of the End User License Agreement and this policy that you accepted when you created the account, and when
• the address of your profile picture, if you created the account by signing in with Google

We send a link to your email address to verify it. The link expires after 24 hours. A password-reset link expires after 1 hour.

Sign-in through Google or Microsoft

You can sign in with a Google account or a Microsoft account instead of a password. We ask the provider only for the standard openid email profile scopes. We get your email address, your name, whether the provider verified the address, and an identifier that the provider gives your account. From Google, we also get the address of your profile picture, and we store it when the sign-in creates your account. We get no access to your files, mail, calendar or contacts. We store the provider name and the identifier, so that we can recognize you when you return.

Workspace content

When you use SimpleScrumTools, you and the other members of your organization create workspace content. This includes portfolios, projects, Scrum Teams, backlog items and their descriptions, estimates and assignees, sprints and Sprint Goals, notes from Scrum Events, Retrospective and Sprint Review entries, questions on items, Definition of Done checks, and Increments. It also includes who holds which role.

The Service records who made each change and when. Each backlog item keeps a history of its changes, and each organization keeps a log of activity. Members of the organization can see these records, subject to their roles.

When you import a backlog from a .csv file, we read the file and create the items. We do not keep the file. We keep a record of the import: the file name, the file’s column headings and how they map to fields, the counts, and the reason that each row that did not import failed. A reason can quote the value in the cell that caused it. We keep the same record for a preview that you did not import.

Invitations

When a member invites a person to an organization, we store the invited email address, the roles offered, who sent the invitation, and when. We send the invitation to that address. The invitation expires after 7 days. If you received an invitation and do not want it, you can decline it from the link in the email. The organization keeps the record of the invitation. If you delete your account, we remove your address from every invitation that was sent to it.

Billing data

Paid plans are billed through Stripe. When a person starts a paid plan, we give Stripe the organization’s name, that person’s email address, the organization’s identifier and the number of seats. You enter your card details on Stripe’s own pages. We never receive or store your full card number or its security code.

We store the Stripe customer and subscription identifiers, the subscription status, the end of the current billing period, and whether the subscription ends at that date. We also keep a copy of each event that Stripe sends us about the subscription. An event can include the billing name and email address, amounts, and the brand and last four digits of a card.

Messages you send us

When you write to us through the Contact page, we receive your name, your email address, the topic you choose and your message. The form sends them to our support mailbox by email. The product does not store them in its database. We use them to answer you, and we keep the email only as long as we need it for that.

Technical data

Each time you sign in, we store the session with the IP address and the browser user-agent string that you signed in from, and the time we last used the session. We use these to keep your account secure. We store only a hash of the session token.

Our server writes one log line for each request. The line holds a request identifier, the method, the path without its query string, the status, the duration, your user identifier and, where one applies, the project identifier. Our logs never hold passwords, tokens, cookies, email addresses or workspace content. To limit abuse, the server counts requests for a short time, in memory only: for each IP address, for each signed-in account, and for each email address that someone tries to sign in with.

Our hosting provider can also record standard technical data, such as IP addresses, in its own network and security logs.

5. Cookies and browser storage

The Service stores the items below in your browser. We use none of them to track you across other websites.

The first three cookies are strictly necessary. Without them, you cannot sign in. The public pages set no cookie until you sign in, click a sign-in button or open the demo.

Cookies that others set

• Our advertising partner. After you click Accept on the consent banner, Google can set its own advertising cookies. See Advertising.
• Stripe. Stripe’s checkout and customer portal run on Stripe’s own website and use Stripe’s own cookies.
• Google and Microsoft. If you sign in through one of them, the sign-in takes place on the provider’s website under its own cookie policy.

You can block or delete cookies in your browser settings. If you block the sign-in cookies, you cannot sign in.

6. Analytics

We use Plausible Analytics to count visits to the public website and the steps of the sign-up process. Plausible sets no cookies and stores nothing in your browser. It counts visits without a persistent identifier for you, and it does not follow you to other websites.

The Plausible script loads only on the public pages. It counts only visits to the public pages and to the sign-up and sign-in pages. If you go on from a public page into the application, the script drops every event from there before it sends anything, so nothing inside the application is counted. When you verify your email address, our server tells Plausible that one verification took place. That message holds the page address, your browser’s user-agent string and your IP address, so that Plausible can count the visit. It holds no email address, name or account identifier. Plausible describes how it handles this data at plausible.io/data-policy.

7. Advertising

The Free plan is supported by ads. Our advertising partner is currently Google AdSense. The rules below apply to all ads in the Service:

• Ads appear only for organizations on the Free plan, and only in one place on two screens: the organization overview and the project screen. The public website, the help pages and all other screens in the application show no ads.
• Before an ad can load, a banner asks for your consent. Until you answer, and after you click Decline, the ad space holds a notice from us. No script, cookie or request goes to the advertising partner.
• If your browser sends a Global Privacy Control signal, we treat it as your answer. The banner does not ask, no advertising script loads, and an earlier Accept in that browser no longer applies.
• In the European Economic Area, the United Kingdom and Switzerland, Google also asks for your consent in its own message after you click Accept. That message follows the IAB Transparency and Consent Framework. Google shows personalized ads only if you consent there too.
• After you click Accept, the page loads Google’s advertising script. Google can then set and read cookies, and it can collect data such as your IP address, your browser and device details, and the address of the page. Google can use this data to show ads, to measure them and to personalize them. Google is responsible for its own use of this data. Read How Google uses information from sites or apps that use our services.
• We never give the advertising partner your name, your email address or workspace content.
• Organizations on a paid plan see no ads, no banner and no advertising script.

Take back your consent

A Cookie choices control sits under the ad space after you answer the banner. Click it to remove your answer. The page then loads again without the advertising script, and the banner asks you again. You can also delete the sst_consent cookie in your browser. Your answer applies to one browser. It expires after 180 days, and then the banner asks again. To stop personalized ads from Google on all websites, use Google’s My Ad Center. The Ads and cookies help page shows each step.

8. How we use data, and our legal bases

We use personal data only for the purposes below. If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, the table also gives the legal basis for each purpose.

We do not use workspace content to build advertising profiles. We do not use your data for automated decisions that have legal or similar significant effects on you.

9. Who receives your data

We do not sell your personal information. We share it only as this section describes.

Inside your organization

The members of an organization can see each other’s names and the content that they create, subject to their roles. The people who manage an organization can see its members’ email addresses, roles and activity. They can also remove members.

Service providers

Each provider gets only the data it needs for its task. The providers that process data for us do so under contract and may not use it for their own purposes, except where this policy says otherwise.

Legal requests and business changes

We disclose data if the law requires it, for example in response to a valid court order. We also disclose data where we must to protect the rights, property or safety of our users, the public or Strategic Move LLC. If Strategic Move LLC merges with another company, or sells the Service or its assets, the data can pass to the new owner. The new owner must then respect this policy or tell you about any change.

10. Where we store data

We store data in the United States, on DigitalOcean’s servers. If you use the Service from another country, your data goes to the United States. Some providers, such as Stripe and Google, can process data in other countries too. Where the law requires a safeguard for these transfers, we rely on the European Commission’s Standard Contractual Clauses, the UK’s equivalent, or the provider’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

11. How long we keep data

• Account data: while your account exists. When you delete your account, we delete it or de-identify it at once. See Account deletion.
• Sessions: a session ends 30 days after its last use, and never more than 90 days after you sign in. An hourly job then deletes it, with its IP address and user-agent string. Signing out ends the session at once.
• Verification and password-reset links: an unused link expires after 24 hours or 1 hour, and an hourly job deletes it. We keep a record of a used link as part of the account’s security record.
• Workspace content: while the organization exists. When a member deletes an item, the Service hides it but keeps it, so that the organization’s history stays complete.
• Invitations: while the organization exists, as part of its records. If you delete your account, we remove your address from them.
• Import records: while the project exists.
• Item history and activity records: we never change or delete these records one at a time. They are the organization’s audit record, and we keep them while the organization exists. The one change we make is when a person deletes their account: we replace the copies of their name and email address that the Service wrote into these records, as Account deletion describes.
• Billing records: as long as tax and accounting law requires.
• Request logs: for a limited period that our hosting provider sets.
• Messages you send us: as long as we need them to answer you and to keep a record of the conversation.
• The consent cookie: 180 days in your browser.

When an administrator deletes an organization, its members lose access at once. 30 days later, we delete the organization and all of its workspace content, including its item history and activity records, except where the law requires us to keep a record. Billing records stay for as long as tax and accounting law requires.

12. How we protect data

• All traffic to the Service uses TLS (HTTPS).
• We hash passwords with bcrypt at cost factor 12. We store the tokens in session, verification and invitation links only as hashes.
• Sign-in cookies are httpOnly, so scripts in the page cannot read them. They are also SameSite=Lax and Secure.
• The application checks each permission on the server, on each request. It reads your session on each request, so signing out or resetting your password takes effect at once.
• The application connects to its database over TLS and verifies the database’s certificate against the database’s own certificate authority.
• We limit the rate of requests to sign-in and other sensitive routes.
• Our logs never hold passwords, tokens, cookies or workspace content.

No system is completely secure. If we learn of a breach that affects your personal data, we will tell you and the authorities as the law requires.

13. Your rights and choices

Wherever you live, you can ask us to do these things:

• give you a copy of the personal data we hold about you (access)
• correct data that is wrong (correction)
• delete your personal data (deletion)
• give you your data in a machine-readable format (portability)
• stop a use of your data that relies on our legitimate interests (objection)
• limit how we use your data while we examine a request (restriction)

To make a request, use the Contact page. We answer within 30 days. We can ask you for information to confirm your identity. You can reset your password yourself from the sign-in page.

Account deletion

You can delete your account yourself. Click your name at the top of any screen in the application, then use Delete your account. You can also ask us through the Contact page, and we will do it within 30 days. When your account is deleted:

• we delete your email address, your password hash, your picture, your sign-in links and sessions, and your links to Google or Microsoft
• you leave every organization you belong to
• the name on your account becomes your first name and the initial of your last name. Item history and activity records still show what you did, under that name
• where the Service itself wrote your name into an organization’s records, we replace it with that short name. These are the heading “Question from …” above each question you asked, in the item’s description and in its history, and the activity-log record of you leaving an organization. We do this in every organization you were a member of, including ones you had already left
• where the Service itself wrote your email address into an organization’s records — its invitations and its activity log — we replace it with a placeholder address that identifies nobody. An organization that knew only your address does not learn your name
• the content that you wrote in an organization, such as questions, notes and descriptions, stays with that organization, because the organization controls it. So does content that other people wrote, even when it mentions your name or your email address
• two things keep your name: the heading above a question whose text someone edited after you asked it, and the name of an organization, with the activity-log record of its earlier names. The first organization we create for you is named after you, and it keeps that name if it outlives your account. An administrator of that organization can change it
• billing records stay for as long as tax and accounting law requires

The Service refuses to delete your account while an organization depends on you: if you are its only administrator, the Product Owner of one of its projects, or the only Scrum Master of a team with other members. The account page tells you what to change first.

Consent

Where we rely on your consent, you can take it back at any time. This does not affect what we did before. See Take back your consent.

Requests about workspace content

For workspace content, we act for the customer that owns the organization. We send your request to that customer, and we help the customer answer it.

Emails

We send only emails that the Service needs: email verification, password reset, invitations, notices about questions on your organization’s backlog items, and a notice when someone tries to create a second account with your address. Stripe sends receipts and billing notices for paid plans. We send no marketing email.

14. The EEA, the United Kingdom and Switzerland

If you are in the EEA, the United Kingdom or Switzerland, data-protection law gives you the rights in Your rights and choices. That law is the General Data Protection Regulation (GDPR), the UK GDPR or the Swiss Federal Act on Data Protection. The legal bases are in How we use data. You can also complain to the data-protection authority where you live or work. We ask that you contact us first, so that we can try to solve the problem.

15. California residents

If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), gives you these rights:

• to know what personal information we collect, and how we use and disclose it
• to delete it and to correct it
• to opt out of its sale or sharing
• to limit the use of sensitive personal information
• to use these rights without discrimination

In the last 12 months, we collected these categories of personal information: identifiers (name, email address, IP address, account identifiers), commercial information (plan and subscription records), internet activity (session and request records), and account login credentials (a password hash). We collected them from you, from your organization, and from the sign-in provider you chose. We use them for the purposes in How we use data. We disclose them to the providers in Service providers.

We do not sell personal information. We do not share it for cross-context behavioral advertising, except in one case. If you click Accept on the ad consent banner, Google’s advertising cookies can collect data from your browser. To opt out, click Decline, or click Cookie choices to take back an earlier Accept. We also treat a Global Privacy Control signal from your browser as an opt-out: with it, no ad script loads, and the banner does not ask. We do not use sensitive personal information to infer characteristics about you. We have no actual knowledge that we sell or share the data of anyone under 16.

To use your rights, use the Contact page. An authorized agent can make a request for you with your signed permission. We will confirm your identity before we act.

16. Washington residents

Strategic Move LLC is based in Washington. SimpleScrumTools does not collect consumer health data, as the Washington My Health My Data Act defines that term. Do not enter health information in workspace content. Washington residents have the rights in Your rights and choices, and they can use them through the Contact page.

17. Children

The Service is for work, and it is not for children. You must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 16. If you think that a child gave us personal data, tell us through the Contact page, and we will delete it.

18. The demo account

The public demo lets you look at SimpleScrumTools without an account. All visitors share one demo account. Its contents are fictional, and we reset it on a schedule.

• When you open the demo, the Service sets the same sign-in cookies as a normal sign-in. It records the session with your IP address and user-agent string.
• The demo is read-only. Other visitors can see what the demo shows. Do not enter personal data in the demo.
• Nothing in the demo lasts past the next reset.

19. Changes to this policy

We can change this policy. The date at the top of the page shows when the current version took effect. If a change is material, we will tell account holders by email or in the Service before the change takes effect.

20. Contact us

For questions about this policy, or to use your rights, write to Strategic Move LLC through the Contact page.