1. What this policy covers
This page explains the cookies, browser local storage, and similar technologies used by ScrumMastr on the web (scrummastr.cloud) and inside the iOS and Android apps. The mobile apps embed the same web app inside a native WebView, so the same storage rules apply, with the exception of third-party Google services (AdSense and Analytics) which are not loaded on mobile.
2. First-party cookies
ScrumMastr does not set any first-party cookies. All functional state we need to remember (your identity, room sessions, theme, authentication when signed in) is stored in browser local storage, described in the next section.
3. Browser local storage
ScrumMastr leans on browser local storage rather than cookies for functional state. Local storage stays on your device, is never sent in HTTP requests, and is cleared when you clear browser data. We list it here for transparency even though it is not a cookie and, being strictly necessary, does not require consent under the GDPR.
| Key | Purpose | Duration |
|---|---|---|
| scrummastr:identity | Anonymous device identity (a UUID + display name) so your votes stay yours across rooms on this device. | Until you clear browser storage |
| scrummastr:participant_id:<roomCode> | Links you to your participant record inside a specific room so you can rejoin without losing your seat. | Until you clear browser storage |
| scrummastr:host_token:<roomCode> | Proves you are the host of a room you created so you can reveal votes and start new rounds. | Until you clear browser storage |
| scrummastr:default_deck:<roomCode> | Remembers the deck you last picked for a given room. | Until you clear browser storage |
| scrummastr:recent_rooms | Local index of rooms you recently visited so we can show your history. | Until you clear browser storage |
| sb-<project-ref>-auth-token (Supabase, when signed in) | Keeps your host account signed in. Only set after you sign in for Pro features. | Until you sign out or clear browser storage |
| theme | Remembers your light or dark mode preference. | Until you clear browser storage |
| scrummastr:cookie_consent | Records your choice in our cookie banner, which controls whether Google Analytics 4 loads. Advertising consent is handled separately by Google’s own prompt. | Until you change it or clear browser storage |
4. Privacy-friendly analytics (Umami, web only)
We use Umami, a privacy-first analytics tool running on our own analytics.bliqo.app domain, to understand aggregate website usage (which pages get traffic, roughly where visitors come from). Umami is loaded only on the web; it is not loaded inside the iOS or Android apps.
Umami is cookieless: it sets no cookies and reads nothing from your device. It does not collect personal data, build advertising profiles, or track you across other websites. Because of this it does not require consent under the GDPR, so it runs whatever choice you make in our cookie banner. If you would still rather not be counted, enabling “Do Not Track” in your browser stops Umami from recording your visit.
5. Advertising cookies (Google AdSense, web only)
ScrumMastr is free for everyone. To fund the free tier we serve a small ad to participants in rooms hosted on the free plan, via Google AdSense. AdSense is loaded only on the web; it is not loaded inside the iOS or Android apps.
Advertising consent is handled by Google’s own certified Consent Management Platform (CMP), not by our cookie banner. For visitors in the EEA, UK, and Switzerland, Google shows its own prompt asking whether you accept personalised advertising, and that choice governs which advertising cookies are set. We load the AdSense script only after you have responded to our cookie banner, so Google’s prompt does not appear on top of ours.
AdSense sets its own cookies to deliver, measure, and limit the frequency of ads. The exact set varies by region and consent state and may include cookies such as __gads, __gpi, NID, and IDE. Google's up-to-date list lives at business.safety.google/adscookies.
Pro hosts have ads disabled for everyone in their rooms, so AdSense cookies are not loaded for their participants either.
6. Analytics cookies (Google Analytics 4, web only)
We use Google Analytics 4 to understand how visitors find and use ScrumMastr (which pages get traffic, which marketing channels work, which features are used). GA4 is loaded only on the web; it is not loaded inside the iOS or Android apps.
GA4 is loaded only after you click “Accept all” in our first-party cookie banner. Until you accept, no GA4 script runs and no analytics cookies or events are sent. This banner choice controls Google Analytics 4 only; advertising is handled separately by Google’s own consent prompt described above.
When consent is granted, GA4 sets cookies such as _ga, _ga_GWWTJ30845, and _gcl_au. These are first-party cookies set by ScrumMastr's domain but read by Google to attribute visits to a single (anonymous) visitor across pages. Typical retention is 13 to 24 months. Google's up-to-date list lives at support.google.com/analytics/answer/11397207.
We do not use Google Analytics for advertising remarketing and we have not enabled Google Signals or cross-device tracking.
7. What we do not use
- No third-party analytics other than Google Analytics 4. Our Umami analytics is cookieless and runs on our own domain.
- No cookies, pixels, or tags for retargeting outside ScrumMastr.
- No cookies set by ScrumMastr itself for ads, tracking, or fingerprinting.
8. Managing your choices
For Google Analytics 4: change the choice you made in our cookie banner here.
For advertising: your ad choices are managed through Google’s own consent prompt. In the EEA, UK, and Switzerland you can reopen it from the privacy or cookie settings link Google shows alongside its ads.
For everything else: clear or block cookies and local storage in your browser settings. Doing so will sign you out and reset your room history. Useful links:
9. Changes
If we add or remove cookies we will update this page and the "Last updated" date above. For broader privacy questions, see our Privacy Policy.