Epic Totals for Jira runs entirely on Atlassian Forge. It has no remote back end and makes no calls outside your Jira site.
The app calls two Jira endpoints as the signed-in user. POST /rest/api/3/search/jql finds child work items and reads their status, parent, time tracking and story point fields. GET /rest/api/3/field lists fields so the app can find your story points field. Because every call runs as you, the totals only include work items you can already see.
Data stays in Forge app storage on Atlassian's platform.
| Record | Contents | Kept for |
|---|---|---|
| Totals cache | Finished totals, which are counts, sums, status names, and for the gadget the parent keys, summaries (cut to 120 characters) and statuses | 60 seconds |
| Field list cache | Ids and names of number fields and the detected story points field ids | 1 hour |
| Panel options | Levels, story points level and story points field | 30 days |
Each record's key is a SHA-256 hash that includes your Atlassian account ID, so one person's cached totals are never shown to another person. The account ID itself isn't stored as a value. No names, email addresses, avatars or comments are stored.
It has no scope that writes to Jira. It doesn't send data to the developer or to any third party, and it doesn't use analytics or tracking.
Uninstalling the app removes its Forge storage. Cached records also expire on their own after the times above.