Private Planning Poker: End-to-End Encrypted, Local-First Estimation
A private room estimates exactly like a regular planning poker room: everyone votes at the same time, the moderator reveals the cards, and the team discusses the spread. The difference is who can read what happens in between: every name, topic, vote and history entry is end-to-end encrypted, so the server only handles ciphertext it cannot read. There is no account and no signup — the invite link itself carries the key.
How private rooms work
Creating a private room generates a random 256-bit secret in your browser, from which the room keys are derived. The invite link looks like /s/<channelId>#k=<secret>: the channel id tells the server which room you mean, while the secret after the # never leaves your browser, because browsers do not send the URL fragment to the server. Everyone opening the full link derives the same keys locally, while anyone with only the path cannot join. You can also make a regular room private from inside the room: members who are online receive the key automatically, and the old room code stops working.
What is encrypted
Everything readable is sealed on your device before it is sent: participant names, the room title, the topic, every vote, and every history entry. Votes use AES-256-GCM with keys derived through HKDF-SHA-256, and each message is authenticated with its channel, kind and sender, so ciphertexts can be neither tampered with nor replayed into another room. Voting keeps its familiar behaviour: the server still tracks who has voted and reveals all votes at once, but every stored vote is a ciphertext it cannot open. An optional passphrase is mixed into the key derivation with PBKDF2-SHA-256 and 600,000 iterations, so the link alone is then not enough.
Where your data is stored
Private rooms are local-first: the room document lives encrypted in each participant's browser storage, not on the server, kept for 180 days and extended on every visit. Your rooms reappear under “Your private rooms” on the start page, where you can also forget them on that device. The tradeoff is honest: if every participant clears their browser data, the room is gone and nobody can recover it.
How participants stay in sync
Participants sync with each other through an encrypted relay: the server only forwards ciphertext it cannot read, and it never stores the room document. There is no direct peer-to-peer connection and nothing to configure. On joining, your browser compares its copy with the members who are online; an up-to-date peer sends you an encrypted snapshot and the copies converge, while small edits such as a new topic travel as tiny encrypted updates. A new device with no copy waits until a member holding the history comes online, then receives it automatically.
Passphrase and safety code
The passphrase is the room's second factor. Set one at creation or when making a room private, and share it through a different channel than the link. It must be at least 12 characters or 4 words, a wrong entry is rejected on your device, and a forgotten passphrase plus cleared browsers means the room cannot be recovered. The safety code is a separate check: when a regular room is converted, both sides show a 4-word code derived from the new key. Matching words mean the handoff arrived untampered; mismatched words mean you should not trust the new room.
What the server can still see
Encryption hides content, not connection facts. The server still sees an opaque channel id, the IP addresses of connected devices, used only for rate limiting and masked in the logs, how many peers are connected, the sizes and timing of messages, who has voted, and whether the round is revealed. It never sees names, topics, votes, history entries or keys. Remember that a participant holding the invite link can read the room like anyone else, so share links only with people you trust.
Private or regular room?
Choose a private room when the estimates are sensitive: work under NDA or unreleased plans that should not pass through a server in readable form. Choose a regular room for quick, low-stakes sessions where a short code is more convenient. Both kinds estimate the same way; only the privacy guarantees differ. If a session turns sensitive halfway through, convert it: the move is one-way, and absent members need the new link.
Frequently asked questions
Do I need an account to use a private room?
No. You open the invite link, enter your name, and type the passphrase if the room has one. There are no accounts, nothing to sign up for, and no password stored on any server.
How do I invite someone to a private room?
Share the invite link, and the passphrase separately if the room has one. The link carries a 256-bit secret in its URL fragment, which browsers never send to the server, so only holders of the full link can derive the room key.
What happens if everyone clears their browser data?
The room is gone and cannot be recovered. It survives only as long as at least one member keeps their copy. If one member still has the room, open the link on the new device while they are online and the history syncs back.
What can the server still see in a private room?
An opaque channel id, IP addresses (rate limiting only, masked in the logs), peer counts, message sizes and timing, who has voted, and whether a round is revealed. It never sees names, topics, votes, history or keys.
What are the passphrase and the safety code for?
An optional passphrase is mixed into the key derivation, so the link alone is useless without it; it must be at least 12 characters or 4 words. The 4-word safety code, shown on both screens when a room is made private, confirms nobody tampered with the key handoff.
When should I use a private room instead of a regular room?
Use a private room for sensitive estimates, such as client work under NDA or unreleased plans. Use a regular room for quick, low-stakes sessions where a short shareable room code is more convenient.