Last Comment Field for Jira — Data Security and Privacy Statement

Last updated: 29 July 2026.

The short version

Last Comment Field is an Atlassian Forge app. Its manifest declares no external.fetch permissions, so the app cannot open a network connection to any server outside Atlassian — your data never leaves Atlassian's infrastructure. The app has no backend of its own, no database, and no user accounts.

What data the app accesses

• read:jira-work — to read issues and their comments, so the app can find the most recent comment on an issue.
• read:jira-user — to resolve the display name of the comment's author, which is shown alongside the comment excerpt.
• write:app-data:jira — to write the app's own read-only Last Comment custom field value. This scope only permits the app to set data it owns; it does not allow the app to edit issue fields, comments or any other Jira content.

In practice the app touches: the text of the newest comment on an issue, its creation date, and the author's display name. It does not read email addresses, attachments, or any Jira administration data.

Where data is stored and processed

The app does not request the storage:app scope and does not use Forge Storage. There is no app-side database at all.

The only value the app persists is the Last Comment field value itself, and that is written into your own Jira site through the app custom field value REST API (PUT /rest/api/2/app/field/{fieldId}/value). In other words, the data stays inside Jira, next to the issue it describes, and inherits your site's own residency, encryption and access controls. That value is a single line containing an excerpt of the latest comment (capped at 254 characters) plus the author's display name and the date.

Processing happens in Forge's Atlassian-hosted runtime when a comment or issue event fires, or when the issue glance panel is opened. Nothing is buffered between invocations beyond a short-lived in-memory lookup of the field's own numeric id.

What the app does not do

• It does not sell, share or transfer any data to third parties.
• It has no analytics, telemetry or tracking of any kind — technically impossible here, as no outbound network calls are permitted.
• It does not modify issue content: it never edits or deletes comments, and it only writes its own read-only field.
• It does not copy your data to servers operated by us. We operate no servers for this app.

Data retention and deletion

We retain nothing, because the app stores nothing outside your Jira site. The Last Comment field value is overwritten each time a newer comment arrives, so only the latest excerpt is ever held. When you uninstall the app, its custom field is removed from your site along with the values it held; your comments themselves are untouched, since the field only ever contained a copy of text that already lived in Jira.

Contact

Questions about this statement or about a specific installation: info@kyc-checks.nl.