Your data, and the works council
This page explains in plain terms how Call It A Five, a live planning-poker estimation tool, handles data, so you can review and approve it with your works council (Betriebsrat) as part of your normal co-determination process. It is written to answer the questions a works council usually asks, including the use of AI and the question of performance monitoring. For your company's approval, further down you will find a traffic-light self-check and the usual documents.
The short answer for the works council
- It is an estimation aid, not a monitoring system. It does not measure, score or track the performance or behaviour of individual employees. There are no accounts and no profiles.
- The only personal data is a display name. A free-text name you type to join. No email, no sign-up, no account. Nothing else about you is asked for or stored by the app.
- Anonymous by default. Every new room starts anonymous: the result shows card values only, in card order, with names and ids stripped. Before the reveal, each device gets back only the vote it cast itself; the server never hands one person’s vote to anyone else, not even to someone who picks that person’s name in the team list. Names can only be switched on when a room is created; the host can switch any room to anonymous later (never back), and everyone in a room with names sees a “Names visible” badge.
- No individual vote outlives its round. When the next round starts, each person’s vote is deleted and only the round’s aggregate is kept (median, mode, minimum, maximum, agreement, number of votes). An open round left untouched is closed automatically after 8 hours.
- Quick rounds are deleted after 8 hours. A quick round has an 8-hour lifetime, after which the server storage for that session is removed. Quick rounds created before version 3.6 had no deletion timer; they are removed by a one-off cleanup when this version goes live. An opt-in team room persists so a team can reuse one room across refinements: it is deleted automatically 90 days after its last activity, and the host can delete it at any time.
- There is no AI. AI: none Zero AI or large-language-model calls anywhere. Every figure is plain arithmetic.
- EU data residency. Session data is held in a European region (Frankfurt or Dublin) on Cloudflare, which acts as a processor under a data processing agreement.
What this tool is, and is not
Call It A Five is live planning poker. One person creates a session, gets a single link, and shares it with the team. Everyone picks an estimate card (Fibonacci, T-shirt sizes or powers of two). The cards stay hidden until the facilitator reveals them, and then the tool shows the spread of votes, the median, the level of agreement and any outliers, so the team can discuss and re-vote.
It is not a sign-up product, not a central database of people, and not a tool for evaluating individuals. It does not create accounts, profiles, rankings or manager dashboards about named employees, and it does not export anything into HR systems.
What data it handles, and where it goes
The data inventory below is the complete list. There is nothing else.
| Data | What it is | Where it lives |
|---|---|---|
| Display name | A free-text name you type to join, up to 80 characters. You may use a nickname. No email or account is involved. | On the session server, deleted after 8 hours (quick rounds) or 90 days after the last activity (team rooms). |
| Your vote | The estimate card you pick for the current item. Kept hidden from others until the round is revealed; before that it is returned only to the device you voted from (see device key). | On the session server only while its round is open. Deleted when the next round starts, at the latest 8 hours after the round’s last activity (team rooms) or with the quick round after 8 hours. Shown without a name in anonymous mode, which is the default. |
| Round results | Aggregate figures for a closed round: median, mode, minimum, maximum, agreement percentage, the number of votes, the card nearest the median and how many "?" and coffee cards were played, plus the hour the round took place. No names, no ids, no individual votes, no outlier list. | On the session server as aggregates only, for the life of the room. Round history keeps no individual votes. |
| Device key | A random code (158 bits) issued to your device when you join or pick your name, so the server returns your own vote to you and to nobody else. It contains nothing about you. | Your browser storage, sent only to the session server of that room. The server keeps only a one-way hash of it, deleted with the room. |
| Round label | An optional label the host gives a round in a team room, up to 32 characters, meant for a ticket key. The input asks for no names. | On the session server with the team room, deleted with it. |
| Resume note | A small entry on your own device holding the last room code and the name you used, so you can rejoin after closing the tab. | Your device only (browser storage), for up to 8 hours. For team rooms, the rejoin note and the host link stay on the device until you remove them. Never sent anywhere. |
There is no email, no account, no password, no phone number, and the application does not store your IP address. To protect rooms against address guessing, joins, failed lookups and lookups of older name-based room addresses are counted per IP address in a Cloudflare rate-limit counter that expires after 60 seconds; the application never stores or logs the address. The display name is the only directly identifying field, and only because you typed it.
Where the data lives, and how clients sync
A team room’s address contains a random 13-character code (65 bits), so it cannot be guessed from the room name; the member list and the projector view can only be opened with that full address, and repeated failed lookups from one network address are rate-limited (polls by projector screens, hosts and members of a room with a secure address are not limited; joining a room is counted per network address, as are lookups of rooms that do not exist or have moved). Team rooms created before version 3.6 keep their older, name-based address until the host moves them to a secure address with one click; the moved room is anonymous unless the host explicitly keeps names, the host access key is renewed, and the old address stops working. For 30 days the old address answers only with a notice that the room has moved, naming the member who moved it and the date, so a teammate holding the old link knows whom to ask; after that it disappears.
Each session runs in its own isolated store on the server (a Cloudflare Durable Object). Every device in the session keeps in step by asking the server for the latest state about every 2.8 seconds. Devices never talk to each other directly. There is no peer-to-peer connection.
The small resume note on your own device holds only the last room code and the name you used, so the tool can offer to rejoin a session that is still running. It stays on the device, is never uploaded, and you can clear it by clearing your browser data.
No AI, no large language model AI: none
Call It A Five contains no AI. There are zero calls to any AI service or large language model anywhere in the product.
Every figure the tool shows, the median, mode, minimum, maximum, agreement percentage and outliers, is plain arithmetic computed on the server from the votes in the current round. There is no model, no inference, no third-party AI provider, and therefore nothing to train a model on and no AI vendor to share data with.
No individual-level monitoring, no performance tracking
This is the question most relevant to co-determination. Estimation in this tool is a collaborative team activity, not a measure of any one person. It is, in our view, not designed or suited to monitor the conduct or performance of employees within the meaning of BetrVG Section 87 (1) no. 6. Your works council makes its own assessment, and this page is meant to support that.
- There are no accounts and no profiles, so there is no record that follows a person across sessions.
- Rooms are anonymous by default. The revealed result shows card values only, ordered by value, with names and participant ids removed, and no device ever receives another person’s vote, so the tool itself never links an estimate to a named person. Switching names on is an explicit host choice made when the room is created. The host can switch an existing room to anonymous at any time (one way, it cannot be switched back), a room moved to a secure address becomes anonymous unless the host explicitly keeps names, and every participant sees a “Names visible” badge while names apply.
- Round history keeps aggregate figures only (median, mode, minimum, maximum, agreement, number of votes). The individual votes behind it are deleted when the round ends; no per-person vote is kept.
- Outliers (the highest and lowest card) are marked per person only in a room with names visible, and only while the round is open. Anonymous rooms and the round history carry no outlier markers.
- There is no ranking of people, no individual scoring over time, and nothing is exported into any HR or performance system.
- The tool also supports the principle of fair, transparent treatment of employees (BetrVG Section 75). Anonymous mode is the default; whether a team switches names on is a choice the team and the works council can agree on.
One honest caveat: if the host switches names on, the revealed view shows each name next to its card while that round is open (the open way many teams play, so they can talk through a difference). Everyone in the room can see this from the “Names visible” badge. When the round ends, the per-person votes are deleted and only the aggregate remains; nothing is aggregated into any profile. If your works council prefers, it can agree that names stay off. Two limits apply in every mode: everyone sees who has already voted (not what), and in a round with only one or two votes the result itself can show what a person voted. That is arithmetic on the screen, not a stored record.
Hosting and EU data residency
The session server runs on Cloudflare. The per-session store that holds names, votes and results is pinned to a European jurisdiction, so it is placed in a European region (Frankfurt or Dublin). This gives EU data residency for the session data.
Cloudflare acts as a processor (Auftragsverarbeiter) for the operator, under a data processing agreement (Auftragsverarbeitungsvertrag, Art. 28 GDPR). The operator does not pass session data to any other third party for their own purposes.
No third-party requests
The typeface (Plus Jakarta Sans) is embedded directly in the page (self-hosted), so opening any of these pages makes no request to Google Fonts or any other third party. No external service receives the visitor's IP address.
No names, votes or session content are ever sent anywhere outside this domain. These pages load entirely from callitafive.com.
No cookies, no tracking, no analytics
The tool sets no cookies, runs no advertising or analytics scripts, and uses no tracking pixels. The only data kept on your device is functional: the resume note described above, which stays local, and the device key, which goes only to the session server of its room. No request from these pages reaches any third party; the typeface is embedded in the page itself.
Purpose and retention
The data is used only to run the live estimation session: to show who has joined, to keep votes hidden until the reveal, and to compute the round result for the team to discuss. It is not used for any other purpose.
Each quick round has an 8-hour lifetime. After that, the server storage for that session is deleted, and the names, votes and results in it are gone. The resume note on a device also stops being offered after 8 hours. Nothing is held centrally beyond the life of a session.
Team rooms (opt-in) work differently: they exist so a team can keep one room across recurring refinements. A team room, including its member list and round history, is kept for 90 days after its last activity and then deleted automatically; every visit extends this window. The host can delete the whole room at any time using the room's delete control. Past rounds survive only as aggregate results (median, spread, agreement); each person’s vote is deleted when the round ends, and an open round left untouched is closed automatically after 8 hours. Team rooms created before version 3.6 that are not opened again still held the individual votes of closed rounds; the one-off cleanup when this version goes live reduces them to aggregates.
Roles, legal basis and your rights
Controller (Verantwortlicher)
Frederik Metz, Ridlerstrasse 9, 80339 Munich, Germany. Contact: the operator.
Processor (Auftragsverarbeiter)
Cloudflare, for hosting the session server in an EU region, under an Art. 28 GDPR data processing agreement.
Legal basis
Where you join a team session, the basis is the legitimate interest in running the estimation session (Art. 6 (1) (f) GDPR) and, where applicable, your consent in joining by typing a name (Art. 6 (1) (a)). In an employment context your employer confirms the precise basis under GDPR and BetrVG.
Your rights
The usual data-subject rights apply (access, rectification, erasure, restriction, objection, complaint to a supervisory authority). Because data is deleted after 8 hours and there are no accounts, the practical route is to leave the session or wait for the automatic deletion; for anything else, contact the controller above. In a team room, the host can additionally delete the whole room at any time.
If your organisation introduces this tool for staff, your employer may be the controller for that use, with the operator and Cloudflare as processors. Your data protection office can confirm the current arrangement and whether a data protection impact assessment is needed.
Traffic-light self-check
Many companies sort a new tool into three levels before approving it. The highest level that any criterion meets is the one that counts. For Call It A Five we think that is the middle level: the tool handles a display name, and whoever creates a room with visible names sees who picked which card while a round is open. No criterion of the in-depth level applies. Your company makes the binding call.
| Criterion | Applies? | Why |
|---|---|---|
| Personal data of employees | Yes, minimal | Only a freely chosen display name; a nickname is fine. No email, no account, no staff number. |
| Performance or behaviour monitoring possible | Limited | Not intended. Rooms are anonymous by default. Only when the host turns names on do names sit next to cards, and only while the round is open. No individual vote is stored. |
| Log files or usage data | No | There is no log-in and no log-out. In team rooms the server keeps only the time a name was first added to the team list; it is never sent to anyone. The application logs no names, votes or IP addresses. To stop room addresses being guessed, Cloudflare counts requests per IP address for 60 seconds, then the counter expires. |
| Reports or analyses about employees | No | Only round results without names (example below). No ranking, no per-person history. The host can download the room's round results (and, in a room with names, the team's names) as a file, and load that file into a new room. The file holds no individual votes. Nothing is exported into any HR, ticketing or performance system. |
| Tracking or monitoring | No | No cookies, no analytics, no tracking pixels. |
| AI-based analysis or scoring | No | No AI, no language model. Every number is plain arithmetic. |
| Interfaces to other systems | No | No single sign-on, no connection to HR, ticketing or calendar systems. |
Documents for the checklist
The documents works councils usually ask for, and where to find them on this page.
| Document | Where |
|---|---|
| Project description | What this tool is, and is not |
| Data protection | Data inventory and privacy notice. Your data protection office gives the approval. |
| IT security | IT security at a glance. Your IT security team gives the approval. |
| Roles and permissions | Roles and permissions |
| Deletion concept | Deletion concept |
| Reports containing personal data | None. The only result carries no names, see What the tool evaluates. |
| Interfaces | Interfaces (none) |
| Analyses of groups of up to 5 people | Small teams |
| Language | German and English, switchable at the top right. |
| Training concept | Rollout and training |
| AI review | Not applicable, the tool contains no AI. |
Roles and permissions
| Role | Can | Cannot |
|---|---|---|
| Host | Create a room, start and reveal rounds, label rounds, manage the team list (including adding other people's names), hide names, delete a team room. | See anyone's vote before the reveal. Turn names back on in an anonymous room. |
| Participants | Join with a name, vote, see their own vote, see who has voted (not what). | See anyone else's vote before the reveal. In team rooms: take host actions. |
| Board view | Show the room read-only, for example on a meeting-room screen. | Vote. |
In quick rounds anyone with the room link can drive the round (reveal, next round). In team rooms the server checks every host action against a secret host key that never appears in any response to other devices. Whoever holds the host link holds host rights. There is no manager view, and nobody can see room contents across rooms. The operator has only a maintenance route that can tidy or delete rooms and returns counts only.
Interfaces
None. The tool has no connection to HR, ticketing, calendar or directory systems and no single sign-on. The host can download the room's round results (and, in a room with names, the team's names) as a file, and load that file into a new room. The file holds no individual votes. Nothing is exported into any HR, ticketing or performance system. There is no API intended for other systems; the app's own interface works only per room and only with that room's address, and there is no list of all rooms.
What the tool evaluates
The only evaluation is the result of a round. This is how a finished round looks in a team room's history:
- Median
- 5
- Mode
- 5
- Range
- 3–8
- Agreement
- 67%
- Votes
- 6
The tool also stores the card nearest the median and how many "?" and coffee cards were played. Nothing more: no names, no individual votes, no outliers. There is no analysis across rounds or people.
Small teams. Many teams estimate in groups of three to five, so a round result is, arithmetically, an analysis of a group of at most 5 people. Its only purpose is the team's discussion about the size of a ticket, not judging the people involved. The tool has no feature to link results to people, compare them across rounds or pass them to managers. With one or two votes, the result can show how someone voted. That is arithmetic on screen, not a stored link.
Deletion concept
| Data | Deleted |
|---|---|
| Individual vote | As soon as the next round starts, at the latest 8 hours after the round's last activity. |
| Quick round (everything) | 8 hours after creation, automatically. |
| Team room (everything) | 90 days after the last activity automatically, or immediately by the host. Every visit counts as activity, including a board view left open. |
| Round results | With the team room. |
| Data on your own device | By clearing your browser data. A quick round's resume note is no longer offered after 8 hours. |
Deletion runs on the server through a timer per room, even if nobody opens the room again.
IT security at a glance
- No accounts and no passwords. Access comes from the links alone: the room link lets you take part, the host link gives host rights. Treat both like a key.
- Team rooms created since version 3.6 have an address with a random part (65 bits). After 200 requests per minute from one network, further ones are blocked.
- Host rights depend on a secret key the server checks on every action.
- Each device gets a random device key (158 bits). The server stores only a one-way hash of it.
- Each room lives in its own isolated storage. Encrypted connection (HTTPS), room data stored in the EU.
- No third-party content: font and scripts all come from callitafive.com.
Rollout and training
No separate training is needed. The tool explains itself on one screen, and a round takes about a minute. To introduce it to a team, a short demo in the first refinement is enough, about five minutes:
- Create a room and share the link.
- Show that rooms are anonymous by default and that nobody sees a vote before the reveal.
- Agree whether names should be visible. Our advice: keep them hidden unless the works council agrees otherwise.
- Show how the host deletes a team room.
For the works council
This page is offered for transparency and to support your review. Please assess and approve the tool together with your works council as part of your normal co-determination process. If the data handling, the AI position, the hosting region, or the web-font arrangement changes materially, this page is updated and the change is brought back to you for review.
Questions about data protection can go to the controller above, or to your organisation's data protection office.