Privacy Policy

Last updated: 23 March 2026

1. Who We Are

Questimate is operated by Industrial Assets Ltd, a company registered in England and Wales. When this policy refers to “we”, “us”, or “our”, it means Industrial Assets Ltd.

2. What Data We Collect

Account data

When you sign in as a session host, we collect your email address. This is used solely for authentication via magic link. We do not collect passwords.

Guest data

Guest players can join sessions without creating an account. We store a randomly generated token in a browser cookie to maintain your session. We also store the display name and temporary character data you provide. This data is not linked to any personal identity.

Session data

When you participate in an estimation session, we store session codes, encounter titles and descriptions, votes, and results. This data is necessary to operate the real-time estimation experience.

Character data

If you create a persistent account, we store your character name, class, avatar selection, XP, level, inventory items, and achievements.

Third-party integration data

If you connect your Atlassian Jira account, we store encrypted OAuth 2.0 access and refresh tokens. We also temporarily process Jira issue data (titles, descriptions, story points) during your estimation session. We do not permanently store Jira issue content.

Analytics data

We use Google Analytics to collect anonymised usage data such as page views, session duration, and feature usage. This data is aggregated and cannot be used to identify individual users. You can opt out by using a browser extension that blocks Google Analytics.

3. What We Do Not Collect

  • We do not collect payment or financial information (the service is free)
  • We do not collect location data beyond what is available in standard HTTP headers
  • We do not collect data from your Jira instance beyond what is needed for the current estimation session
  • We do not use tracking pixels or share data with advertising networks

4. How We Use Your Data

We use your data only for the purposes described above:

  • To authenticate you and maintain your session
  • To operate the real-time estimation experience
  • To persist your character progression across sessions
  • To read from and write to your Jira instance when you explicitly request it
  • To understand how the product is used so we can improve it

5. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes.

We may share data with the following categories of service providers, solely to operate the Service:

• Hosting and infrastructure providers (to serve the application) • Atlassian (when you connect Jira, via their OAuth 2.0 API) • Google Analytics (anonymised usage data)

We may also disclose data if required by law or to protect our legal rights.

6. Data Storage and Security

Your data is stored on servers hosted in the United States. All data is transmitted over HTTPS. Jira OAuth tokens are encrypted at rest. Session data is retained for the lifetime of the session and may be deleted after a period of inactivity.

While we implement reasonable security measures, no system is perfectly secure. We encourage you to disconnect your Jira account when not actively using the integration.

7. Cookies

We use the following cookies:

• qst_session — A signed, HTTP-only cookie that identifies your authenticated session. Expires when you sign out or after the session timeout. • qst_guest — An HTTP-only cookie containing a random UUID that identifies guest players. Expires after 30 days.

We do not use third-party advertising or tracking cookies.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you • Request correction of inaccurate data • Request deletion of your data • Object to or restrict processing of your data • Receive your data in a portable format

To exercise any of these rights, contact us at industrialassets.ltd/support. We will respond within 30 days.

9. Jira Integration

When you connect your Jira account, you grant Questimate permission to read issue data and optionally write story point estimates. You can revoke this access at any time by disconnecting Jira from your Questimate session. Disconnecting immediately deletes your stored OAuth tokens.

We access only the Jira data necessary for the current estimation session. We do not crawl, index, or store your Jira data beyond what is displayed during the session.

10. Children

Questimate is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Service. Your continued use of Questimate after changes are posted constitutes acceptance of the updated policy.

12. Contact

For privacy-related questions or requests, contact us at industrialassets.ltd/support.