Privacy

PointQuest runs your team's pointing ceremony on top of your Linear issues — a Quest through a list of them, staged as an old-school RPG. To do that it copies some of those issues into its own database and keeps them. This page says exactly what it holds, who else can see it, and how to have yours destroyed.

Last updated 18 September 2026.

The big one: PointQuest stores your issue titles and descriptions

When an issue is pulled into a Quest, PointQuest copies a snapshot of it — the identifier, the title and description, its state, labels, estimate and assignee — into its own Postgres database. That is what lets a Quest keep working when Linear is slow, and what lets a Recap read the same a year later as it did on the day.

Those snapshots are kept indefinitely. Nothing expires on a timer and there is no inactivity sweep: a Quest and its Recap stay until somebody deletes them, or until a whole workspace is erased on request. If your issue descriptions are sensitive, this is the sentence to weigh — it is a bigger thing to hand over than a name and an avatar, and it is the reason this page leads with it.

What else it holds

• You: your Linear user id, name, email and avatar, copied from Linear each time you sign in, and which Linear workspace you signed in to. PointQuest calls that a Player in a Workspace, and the same person in two Linear workspaces is two Players with no link between them.
• Your Linear credential: the access and refresh tokens Linear issues, encrypted at rest. They are destroyed the moment you press Disconnect from Linear — or the moment they stop working.
• What happened in a Quest: every Round, every Card you voted, who was in the Party, and the estimates that were assigned. Votes are hidden from everyone else until the Reveal, and shown attributed to you afterwards — that is what a Round is, and what a Recap is for.
• Your session: a cookie that keeps you signed in.

What it writes back to Linear

Every read and every write runs under your own Linear account — never a service account or a bot — so Linear's own history attributes it to whoever pressed the button. When a Leader assigns an estimate, PointQuest writes that estimate to the issue, along with anything that Quest's Automations were set up to do: add or remove labels, change the workflow state, or put the issue in a cycle.

It never creates, deletes or closes an issue, never posts a comment, and never removes a label it did not add.

Who else sees any of it

Two companies, and no others. Adding a third is a decision, not a dependency bump.

• Fly.io hosts the application and its database. Everything above lives on their infrastructure.
• Sentry receives crash reports so that bugs can be fixed.

Error reports carry no issue content. A crash report is scrubbed to an exception, a stack trace and opaque identifiers before it leaves the server. Issue titles, descriptions and identifiers are removed by an allowlist — fields have to be named to be included, so a new one is excluded by default. An error from Linear's API is reported as its class and HTTP status, never with the request or response body. Server logs are held to the same rule, and are short-lived.

There is no analytics, no tracking script, no advertising and no third-party embed of any kind. The only cookie is the one that keeps you signed in. Nothing is sold, and nothing is shared with anyone else.

Images in an issue description load in your browser straight from wherever they are hosted — usually Linear — so that host sees the request, as it would if you opened the issue there. PointQuest sends it no referrer.

Having your data destroyed

Write to privacy@pointquest.party. There is deliberately no button: the people most likely to want this are the ones who have already handed their Linear credential back, and a button would be reachable only by someone who can still sign in.

Erasing a Player destroys:

• their Player record — name, email, avatar and Linear user id;
• their stored Linear credential, revoked with Linear on the way out;
• their sessions; and
• any Quest they were still preparing, which nobody else could see anyway.

It does not delete their Votes, because other people were in those Rounds and a chronicle rewritten around somebody's absence stops being true. What happens instead is that the Votes stop being attributed: an erased Player appears in every Recap as A Nameless Adventurer, keeping their place and their crown, with nothing left to say who they were. Signing in again afterwards creates a brand-new Player; the old Votes stay Nameless forever.

A whole Workspace can be erased by the same route, at the request of a workspace admin. That destroys everything: every Quest, every Recap, every Player in it.

Nothing about an erasure is recorded in the application afterwards — a log of who asked to be forgotten is the one row that should not survive them.

Anything else

PointQuest is a small tool run by one person. If this page does not answer your question, privacy@pointquest.party is the same address for that too.