Privacy Policy
Last updated 18 September 2026
Retrofys operates retrofys.com. This policy explains what we collect, why, and what we do not do. Short version: we collect the little we need to run a retro, we do not sell anything to anybody, and there are no advertising or analytics trackers on the site.
What we collect
If you sign in as an organizer
- Your name, email address and profile picture from
Google. That is the whole of what we ask Google for — the scopes are
openid,emailandprofile. We never receive your Google password, and we cannot read your Gmail, Drive or Calendar.
If you join a room from a link
- The name you type, or nothing at all if you tick “Stay anonymous”. Anonymous contributors have no name stored against them anywhere — not even for the organizer.
- No account is created, and we do not ask for your email address.
What your team writes
- Retro cards and votes, poker stories and their final estimates, award names, team lists and award results with the reasons given for winners.
- Some things are deliberately never written down: who picked which planning poker card, and who voted for whom in an awards ceremony. Those live only in the server's memory while the round is open, and are discarded when it ends.
- Hidden retro cards are hidden on the server — their text is never sent to anybody but their author until the organizer reveals them.
Technical
- Ordinary server logs (IP address, browser, pages requested, time), kept short term to keep the service running and to stop abuse.
Cookies
Retrofys sets only the cookies it needs to work. There are no advertising or analytics cookies.
retro_session— signs an organizer in. Expires after 12 hours.retro_guest— a contributor's pass for one room, scoped to that room's address. Expires after 30 days.retro_state,retro_next— short-lived, used during Google sign-in to return you to the right page safely.
Your browser may also store small display preferences (such as the column or row layout) on your own device. That never reaches us.
Why we are allowed to hold it
We process this data to provide the service you asked for (performing our contract with you), and, for logs and abuse prevention, because we have a legitimate interest in keeping Retrofys working and secure.
Who else sees it
- People in your room. Anybody with a room's link, up to the seat limit, sees that room's content as described in the app.
- Railway — our hosting provider, which runs the application and its PostgreSQL database.
- Google — only when an organizer signs in.
We do not sell personal data, do not share it for advertising, and do not use your content to train machine-learning models.
How long we keep it
- Boards, sessions and ceremonies stay until they are deleted. Deleting one removes its content — cards, votes, stories and results — from the database.
- Records of usage (for example that a ceremony was run, for billing and limits) are kept after the room is deleted.
- Account details are kept while the account exists. Ask us to delete your account and we will remove it and the rooms you own.
Your rights
You can ask for a copy of your personal data, ask us to correct it, or ask us to delete it. Write to support@retrofys.com and we will respond within 30 days. Depending on where you live you may also have the right to object to processing, or to complain to a data protection authority.
Security
Traffic is encrypted with HTTPS. Sign-in sessions and contributor passes are signed tokens in http-only cookies, so page scripts cannot read them. Content that should be hidden is withheld on the server rather than hidden in the browser. No service is perfectly secure, but we take this seriously, and you can report a problem to the address above.
Where your data is held
Retrofys runs on Railway's infrastructure, which may store data outside your country. By using the service you agree to that transfer.
Children
Retrofys is a workplace tool and is not intended for children under 16.
Changes
If this policy changes, the date at the top changes with it, and significant changes will be highlighted in the app.