Simple rooms deserve clear boundaries.

Privacy

Reusable room data, no accounts, and no behavioral advertising.

Refinement Pointer has no sponsor placement today and does not use AdSense, ad networks, advertising pixels, behavioral targeting, or promotional pop-ups. Any future direct sponsorship would be static, clearly disclosed, and kept outside the active-room working surface.

Use a display name or initials. Do not enter passwords, secrets, regulated information, or confidential work details that are not needed for estimation.

What a room stores

• A random room code, round and reveal state, the shared reveal/reset setting, and activity timestamps.
• Participant display names, Organizer and Co-Organizer roles, join timestamps, and a one-way hash of each member credential.
• Only each membership's latest successful room communication time, to show current Connected / Not Connected status. Later communication replaces it; leaving, removal, or room deletion removes it. There is no attendance history or last-seen display, and presence is not sent to analytics or application logs.
• The selected estimation scale, current round's Fibonacci points or T-shirt sizes, any selected uncertain-card presentation, and readiness state. Reset deletes individual estimates.
• Session titles, start/end timestamps, and the most recent 100 revealed rounds' anonymous counts for each estimate, lowest and highest estimates, participant counts, votes cast, and Uncertain counts, together with a recorded Alignment Score or its unavailability reason and calculation version. The score describes how close the initial estimates were on the selected card scale; Uncertain and missing responses are excluded. These summaries contain no participant names, individual vote history, or agreed estimate. First Reveal freezes these counts and recorded results; later changes do not rewrite them. Resetting an unrevealed round saves no summary.

Who can see it

A room link is an invitation capability, not account-based access control. Anyone with the link can view the selected scale, participant names, readiness, and estimates after reveal. Before reveal, other participants, including the Organizer, cannot see your estimate. The roster identifies the Organizer and any Co-Organizers. Joined participants can reveal or reset while shared controls are enabled, which is the default. The Organizer and Co-Organizers can always reveal and reset.

Only currently joined participants in the same room can see Connected / Not Connected status and the connected-membership count, which includes themselves. A room link alone does not grant presence access. Connected means successful authenticated room communication less than 30 seconds ago, not attention or proof that someone is watching. Tabs sharing one membership share its status; another browser profile or device is a separate membership, even with the same name. Presence works between Sessions and does not change votes, roles, readiness, summaries, or Session behavior. Failed room updates keep the last-known status with a notice that it may be out of date.

Only currently joined participants can view retained round summaries, including participants who join later. A room link alone does not grant summary access. The current round's baseline appears after its first Reveal and remains unchanged when votes or membership change. History groups these baselines by Session and Round. Older history beyond the Room-wide 100-round limit is removed; retained history may not represent the Room's complete lifetime. Summaries describe the votes cast, including missing or Uncertain votes. Histograms combine all Uncertain choices into one count. A matching set of votes does not establish team agreement.

Only the Organizer can grant or revoke Co-Organizer status. The Organizer and Co-Organizers can change the shared-controls setting and remove another participant and their current vote, including another Co-Organizer, but cannot remove the Organizer. The Organizer can choose whether to show Make Co-Organizer buttons on ordinary members' cards; the preference is hidden by default, stored with the Room until it is deleted, and changes visibility only. It never grants role authority, which remains with the Organizer. A removed participant can explicitly rejoin, but their old vote and role are not restored. When the Organizer leaves without choosing a successor, the setting is preserved if a Co-Organizer remains and otherwise returns to shared controls; nobody is automatically appointed Organizer. Refreshing or briefly disconnecting preserves a role while the member cookie remains valid. Clearing that cookie or switching browsers does not recover authority; a room link or matching display name creates a new ordinary membership.

Organizers and Co-Organizers can start and end a Session. End Session preserves the Room, memberships, roles, and revealed baselines. Its confirmation warns that unrevealed choices are discarded without revealing them. Between Sessions, voting waits for a facilitator to start another Session. Only the current Organizer can use Delete Room. Confirming immediately deletes the live room, participants, current votes, Sessions, and summaries for everyone. Review any results you need before deleting; they are no longer available through this Room afterward. Current members can export retained anonymous results and current Room and Session labels as PDF, CSV, or both in one matching ZIP, including between Sessions. PDF dates use the exporter's local timezone with numeric offsets; CSV dates use UTC. Downloaded copies can be shared and remain after Room deletion or membership loss. Each new export requires current authorization; the application keeps no export archive.

An Organizer may choose another current member as successor before leaving. Nobody gains that role automatically. Existing Rooms require one explicit facilitator transition: their link, memberships, roles, and settings remain, while legacy summaries and current votes are removed before a fresh Session starts at Round 1. Until confirmation, those data remain and voting waits for the transition.

Browser storage

The browser uses one strictly necessary, room-scoped member cookie so you can remain joined. It is never used for analytics or advertising, JavaScript cannot read it, and the server stores only its one-way hash. The cookie has a maximum age of 400 days and is renewed when that authenticated browser returns to the room; browsers and users can clear it sooner. The current tab stores your display name and an estimate waiting to synchronize so a reload can recover them. A theme preference is stored only after you intentionally choose one. Round summaries are not saved in browser storage. Presence is not saved in browser storage.

Retention and hosting

A room link does not expire because of elapsed time or inactivity. The room remains available until its current authenticated Organizer explicitly confirms Delete Room or the private owner-removal procedure deletes it. Leaving removes that participant's live record and estimate. Leaving or Organizer removal does not rewrite earlier aggregate summaries. Summaries are deleted with the room; older summaries are also discarded beyond the 100-round limit. After explicit confirmation, Delete Room immediately deletes the live room data.

Restricted recovery backups may retain an earlier copy for up to 7 days after live deletion. They are not available to room participants. A recovery can restore an earlier copy, so the operator must reconcile explicit room removals before application traffic resumes.

Hosted service data is processed in East US 2.

Logs, analytics, and deletion limits

Optional homepage analytics is disabled. The app loads no analytics script, sends no browser analytics request, and creates no analytics cookie or analytics-choice record.

After a new participant successfully joins, the server emits one session.joined operational event with no event-specific fields. Once hosted collection is configured, this makes successful joins countable. Its standard envelope contains only the timestamp, level, event name, version, deployment, environment, component, and outcome. It has no room code, URL, request ID, display name, member identifier, story, scale, estimate, network address, browser, or device detail. The app does not intentionally link this signal to browser analytics, and they carry no shared identifier; only aggregate trends should be compared. Neither signal is an audit trail or proof that a visitor is human.

Other application logs are designed not to record IP addresses, room codes, concrete room URLs, names, story labels, estimates, cookies, headers, or request bodies. Hosting infrastructure still processes network and request data to deliver and protect the service. Automated-traffic filtering is imperfect, so traffic and join counts remain indicators of likely use rather than identity verification. Ending a room adds no room, participant, vote, or summary data to analytics or application logs.

Sanitized application events and enabled platform operational log streams are retained for up to 30 days. Access is restricted to the operator and used for reliability, abuse, and security response.

There are no accounts, so the operator cannot find a room from a person's name or email address. A live room can be removed when the exact room code is provided through the configured private support channel. If managed backups are enabled, earlier copies cannot be selectively edited and instead age out with the configured recovery window.

Acceptable Use

Use the room with the same care as the team conversation.

• Share room links only with people authorized to see the work being discussed.
• Do not enter secrets, regulated data, or unnecessary confidential details.
• Do not impersonate, harass, disrupt, automate abusive traffic, or attempt unauthorized access.
• Do not test against another team's room or use the service for unlawful activity.

Refinement Pointer is a temporary collaboration aid, not a system of record or a guaranteed service. Keep authoritative backlog information in the team's normal work system. The operator may remove rooms, limit traffic, or temporarily disable the service to address abuse, security, cost, or reliability problems.

Accessibility

Designed toward WCAG 2.2 Level AA.

The interface uses semantic controls, visible keyboard focus, text alongside status colors, reduced-motion support, and light, dark, and high-contrast themes. Formal conformance is not claimed while automated, keyboard, zoom, screen-reader, forced-colors, and real-device verification remains incomplete.

To report a barrier, include the page or action, browser, device, and assistive technology when relevant. Do not include a room link or room content. Barriers that prevent creating, joining, voting, revealing, resetting, or leaving a room receive the highest priority.

Contact

Support, privacy, accessibility, and room removal.

Email contact@refinementpointer.com. The mailbox provider processes the address and message so the operator can respond.

For early room removal, include only the room code in the private message body. Do not place it in the subject, and do not include participant names, the story label, estimates, cookies, screenshots, or database details. The operator cannot verify a room through an account because the service has no accounts.

Security reporting

Report vulnerabilities privately and with minimal data.

Send security or abuse reports to security@refinementpointer.com. Include the minimum reproduction detail and do not include room content belonging to another person or team.

This reporting guidance does not grant permission to access another user's room, retain room data, degrade the service, automate high-volume testing, or bypass access controls. Reports are handled on a reasonable-effort basis without a published SLA.