Privacy policy
Permission Review for Jira
Last updated 4 August 2026
Every claim on this page is meant to be checkable against the app's manifest and its behaviour, not taken on trust. Where the app cannot prove something, it says so.
What the app reads
From the Jira REST API, as the app, with the scopes read:jira-work, read:jira-user and
storage:app:
| Data | Where from | Why |
|---|---|---|
| Permission schemes and their grants | permissionscheme |
The report itself |
| Projects, and which scheme each uses | project/search, project/{key}/permissionscheme |
To know what each grant governs |
| Display name, account ID, active or inactive of users holding administrative permissions | user/permission/search |
To say who can administer a project, not just which group |
| Display name, account ID, active or inactive of every user in the directory | users/search |
To find deactivated accounts still sitting in groups that were granted power |
| Group names a user belongs to | user/groups |
To say why a person has a permission |
| Whether the app has Jira administration rights | mypermissions |
To declare the report's own coverage |
Outside the API, the page reads one thing from the Forge context: the address of your site, printed at the top of exported files so an auditor knows which Jira they are holding. It is not stored.
Not read: email addresses, avatars, issue content, comments, attachments, worklogs, or anything outside permission configuration. The app never writes to Jira — it holds no write scope at all.
What the app stores
No personal data. Not a display name, not an account ID, not a hash of one.
The report you read is assembled in memory, sent to your browser, and forgotten. Reopening the page reads Jira again. Earlier versions cached the report for an hour; that cache is gone, and the app deletes it on sight when upgrading from one.
One key is written, in Forge storage, which lives inside Atlassian's own infrastructure — no server of ours is involved:
| Key | Contents | Kept for |
|---|---|---|
baseline |
What was signed off at the last «Mark as reviewed»: the hand-made grants (whose holders are groups, roles and licence types — configuration, not people), and, for each project and permission, how many people held it | Until replaced by the next review, or deleted |
People are remembered as a number, never as a name. So the app can tell you that four people could administer a project when you signed and five can today — and name today's five from Jira, live. What it cannot do is name the one who left, and it says so rather than implying otherwise.
The exported CSV and Excel files do contain names. They are built in your browser, from the report on screen, and saved by you. They never pass through storage or through any server of ours.
Where it is stored
In your site's own region. The app stores everything in persistent Forge hosted storage and nowhere else, and Atlassian's platform pins that storage wherever your Jira site is pinned — Australia, Canada, the EU, Germany, India, Japan, Singapore, South Korea, Switzerland, the UK, the USA, or any region Atlassian adds later. If you migrate your site to another region, the app's data migrates with it. This needs nothing from us and nothing from you: it follows from having no server of our own.
What the app sends anywhere else
Nothing. The app's manifest declares no external permissions, so the Forge platform blocks any outbound request. There is no vendor server, no analytics, no third-party processor. The app is eligible for Atlassian's Runs on Atlassian programme, which is the platform's own verification of exactly this.
Because nothing about a person is retained, the personal data reporting duties Atlassian places on apps that do retain it do not arise here. That is the reason the design is this way, and not only a nice thing to be able to say.
How to delete it
- «Forget stored data» on the app page deletes the baseline immediately, plus anything an older version of the app left behind. The next report is read from Jira, as every report is.
- Uninstalling the app removes its Forge storage entirely.
- Nothing survives either action, because there is nowhere else for it to be.
Who can see the report
The app page is a Jira admin page: only Jira administrators reach it. What it shows is configuration those administrators can already read in Jira, one scheme and one project at a time — the app assembles it, it does not widen access to it.
Contact
Questions about this policy, or a request about data: support@softyways.com.