Last updated 2026-11-05
No data leaves Atlassian. The app has no servers of its own and no external permissions. It uses no analytics, cookies, CDNs or third parties, and everything runs on Atlassian's Forge platform.
The app reads Confluence data as you, with your own permissions. That covers page IDs, titles, ancestors, labels, the space you're in and the operations Confluence says you may perform there. It also reads the status of copy and archive tasks it started for you. Pages you can't see never come back to the app.
Forge gives the app your Atlassian account ID, the space key and the license state, like it does for every app.
Storage is Forge app storage (KVS), which Atlassian hosts with your site's data.
| Data | Contents | Retention |
|---|---|---|
| Job record | Space key, your account ID, the operation and its settings (target page ID, labels, title prefix), counts, status, and up to 100 failures (page ID, title up to 80 characters, Confluence's error message up to 200 characters) | 30 days |
| Job page list | Page IDs and titles (up to 80 characters) of the pages the job processes | 30 days |
| Undo log (label jobs) | For each label, the IDs of the pages the job changed | 30 days |
| Recent jobs list and space lock | Job IDs for the space | 30 days, and the lock is removed when the job ends |
| Step markers | Job ID and step number, so a repeated event doesn't run twice | 1 hour |
Space admins, as confirmed by Confluence, see each job's operation, status and counts. Other users see only their own jobs. Page titles, the target page's title and failure details are shown only to the person who started the job.
The account ID of the person who started a job is personal data. It stays in Forge storage hosted by Atlassian and expires with the job record. Once a week the app reports the account IDs it holds to Atlassian with the Forge personal data reporting API. When Atlassian says an account is closed, the app removes that account ID from its job records (a record that would expire within a minute is deleted). The app stores no names, emails or other profile data, so nothing else needs updating.
Nothing. The vendor gets no personal data, page content, usage data or telemetry. The app writes standard Forge function logs with error names and codes, without page content.
The vendor holds no data. Every record expires on its own after 30 days at most, and account IDs of closed accounts are removed within about a week of the weekly report. Uninstalling the app removes its access to your site.
asUser(). The app never calls Confluence as itself.