Privacy Policy: App Usage Audit for Jira Cloud
Last updated: 15 August 2026
Every statement in this policy is verifiable against the app's manifest.yml
and its source code. An automated test fails the build if the manifest gains a scope or
an egress entry that this document does not name, so the policy cannot quietly fall out
of date.
1. Nothing leaves Atlassian
The app declares no external permissions. It cannot make a network request to any host outside Atlassian's own APIs. The platform blocks it, not merely our policy.
- No vendor servers. We operate no infrastructure that touches your data.
- No third-party processors, analytics, error reporting, or telemetry.
- No sub-processors, because there is nothing to sub-process.
This is certified by Atlassian, not asserted by us. The app carries the Runs on Atlassian designation, which requires zero data egress and hosting entirely on Atlassian infrastructure.
Your data stays inside your own Atlassian tenancy, and data residency follows whatever your Atlassian organisation is already configured for.
2. What the app reads, and why
The app is read-only. It declares no write, update, or delete scope of any kind. These are the complete permissions from the manifest:
| Scope | What it reads | Why |
|---|---|---|
read:field:jira |
The list of fields defined in your Jira, via /rest/api/3/field/search |
To see which custom fields exist and which app provides each one |
read:workflow:jira |
Workflow transition rules, via /rest/api/3/workflow/rule/config |
To see which post functions, validators and conditions are provided by apps, and which transitions would break |
read:jira-work |
Issue counts only, via /rest/api/3/search/jql |
To count how many issues have a given field filled in |
storage:app |
Nothing in Jira. Grants access to the app's own Forge storage | To remember the names you give apps, and the installed-app list you paste |
Those are the only three Jira endpoints the app calls;
storage:app touches nothing in Jira.
3. The app does not read your issue content
This distinction matters, so it is stated plainly rather than buried.
To decide whether a custom field is actually used, the app needs to know
how many issues have it filled in, not what is in it. It asks Jira for
a count (maxResults=0), so no issue data is returned at all.
Where a field type cannot be counted that way, the app falls back to sampling. It requests that one field from recent issues and counts how many are non-empty. In that fallback the field's value passes through the app's own Forge function in order to be tested for emptiness. It is never stored, never logged, and never leaves Atlassian. Nothing else about the issue is requested: not the summary, description, comments, attachments, reporter, or assignee.
The app does not read user profiles, project content, attachments, comments, or audit logs.
4. What is stored, where, and for how long
Two things are stored, both in Forge storage, which is Atlassian-hosted and inside your tenancy:
-
Labels you type. The app can only see opaque provider keys such as
io.tempo.jira. If you type a readable name against one, that name is stored so the report stays readable next time. - The installed-app list you paste, if you use that feature. The plain text as you pasted it.
Both are configuration you entered yourself. Neither contains Jira issue data or personal data, unless you type such data into them.
Retention and deletion. Both are kept until you change or clear them, or until the app is uninstalled. Uninstalling removes the app's Forge storage. To clear them while keeping the app, empty a label field to delete it, and clear the paste box and save.
5. Personal data
The app collects no personal data. It does not request user profiles, it does not record who ran a scan, and it stores nothing about individuals.
The one caveat, stated because it is true rather than because it is required: the labels and the pasted list are free-text boxes. If you type a person's name into one, that text is stored as you typed it. Nothing in the app asks you to.
6. Your rights
Because the app stores no personal data and operates no infrastructure, there is normally nothing to request access to, export, or erase. Anything stored is in your own Atlassian tenancy, under your control, and removed when the app is uninstalled.
If you believe personal data has nonetheless been entered into the app's stored configuration and you want it removed, or you have any question about this policy, contact us and we will respond within 30 days.
Contact: contact@veillejuste.fr
Data controller: you remain the controller of the data in your Jira instance. We are not a processor of it, because we never receive it.
7. Changes
Material changes to what the app reads or stores will be reflected here before they ship. This is enforced by the automated test named at the top of this document, which fails the build if the manifest and this policy disagree.