No data leaves Atlassian. The app has no servers of its own. It sends nothing over the network, and it uses no analytics, no cookies, no CDNs and no third parties.
What the app processes
Macro content. The app processes the Markdown or Mermaid text you type into a macro, plus the macro's options (theme, maximum height, show-source).
Rendering context. From the context Confluence gives every Forge app, the app reads only three things. These are the module key (which of the two macros this is), the macro's saved configuration (extension.config, which holds the text and the options above), and the license status (to show a notice when the license is inactive). It does not read the user, page, space, locale or theme. This information is only used to render the macro.
Where the data lives
Confluence itself stores macro content and options as macro parameters on the page. They stay in your Confluence Cloud site, under your site's data residency and retention settings.
The app has no storage of its own. It does not use Forge storage, a database or a remote backend.
Where processing happens
Rendering runs entirely in the reader's browser, inside the Forge Custom UI iframe that Atlassian hosts. All code ships with the app as static resources.
The app declares no external permissions (permissions.external is empty) and no API scopes. The Forge platform therefore blocks any network request to other origins.
External images referenced in Markdown or in diagram labels are not loaded. Markdown images are shown as links. Video and audio elements are removed. CSS in diagrams (classDef, style, theme settings) cannot load images or stylesheets. So readers' browsers do not contact third-party servers when a page opens.
When a reader clicks a link, Confluence opens it in a new tab through the Forge router. That is ordinary navigation by the reader.
What we collect
Nothing. We receive no personal data, page content, usage data or telemetry.
Data subject requests
The vendor holds no data, so there is nothing to export or delete. To remove content, edit or delete the macro or page in Confluence.
Security
HTML is sanitized with DOMPurify.
Mermaid runs with securityLevel: 'strict', and its SVG output is sanitized again.
Scripts may only load from the app's own bundle.
Contact
Use the support link on the app's Atlassian Marketplace listing. The listing names the vendor and its support contact.
