Retention Policy for Jira — Privacy Policy

Last updated: 29 July 2026.

The short version

Retention Policy is an Atlassian Forge app. Its manifest declares no external or remotes permissions, so the app cannot make outbound network calls at all: your data never leaves Atlassian's infrastructure. We operate no servers, no database and no logging pipeline of our own.

What data the app accesses

• read:jira-work — to run the JQL filter you configure, so the app can count the matching issues for the live preview and determine which issues a rule will act on. The preview reads only the issue key, summary and status name of up to 25 sample issues, and a match count.
• write:jira-work — to archive the matched issues: either through Jira's native bulk-archive endpoint, or, where that is not available, by transitioning each issue into an “Archived” status in its project workflow.
• storage:app — to store your archiving rules and the audit log in Forge Storage (see below).

The app does not request any user-directory scope. It never reads, stores or transmits Atlassian account identifiers, display names or e-mail addresses.

Where data is stored and processed

All persisted data lives in Forge Storage (the @forge/kvs key-value store), hosted by Atlassian and scoped to your app installation on your Jira site. Two things are stored:

• Archiving rules — rule name, the JQL filter you typed, the schedule (daily or weekly), the next scheduled run time, the creation timestamp and a summary of the last run (issues archived, issues matched, method used, timestamp).
• Audit log — one entry per run, newest first, holding the rule name, its JQL, whether the run was manual or scheduled, how many issues were matched and archived, the method used, a timestamp, and any error messages. Error messages may contain the issue key of an issue that could not be archived.

No issue summaries, descriptions, comments, attachments or reporter/assignee data are copied into app storage. Issue content read during a preview is returned to your browser for display only and is not persisted.

What the app does not do

• No data is sold, shared or transferred to third parties — there is no network path to do so.
• No analytics, tracking, telemetry, advertising or profiling of any kind.
• No copies of your Jira data are kept outside your Jira site.

Data retention and deletion

• Archiving rules are kept until you delete them in the app.
• The audit log is automatically capped at the 100 most recent entries; older entries are overwritten.
• When the app is uninstalled, Atlassian deletes the Forge Storage associated with that installation, including all rules and the audit log. Issues that were already archived stay archived — that change lives in Jira, not in the app.

Contact

GetCompliant (RVDH Interim Management B.V.), the Netherlands — info@kyc-checks.nl