Fairlog — Privacy Policy

Last updated: October 2026

This Privacy Policy describes how Fairlog ("the App") handles personal data when installed as a Jira Cloud app via the Atlassian Marketplace. The App is published by the Marketplace Partner listed on the listing page ("we", "us"). Atlassian (the Forge platform) acts as the infrastructure provider for the App's compute and storage.

1. What data the App processes

The App reads worklog entries and issue metadata from your Jira Cloud instance via the Jira REST API to detect suspicious time-logging patterns. The personal data it processes includes:

• Worklog author identifiers — Jira account IDs of users who logged time on issues in the projects you audit.
• Display names — the names Jira associates with those account IDs, shown in the audit table and member filter.
• Worklog content — the start time, creation timestamp, duration, and any comment text attached to a worklog entry.
• Issue keys and statuses — the issues the worklogs belong to and their current status.

The App does not collect or process:

• Passwords or authentication credentials.
• Payment or billing information (handled by Atlassian Marketplace).
• Any data from outside the Jira instance it is installed on.

2. Where data is stored

All data is processed and stored within Atlassian's Forge infrastructure (Key-Value Store and compute). The App makes no calls to any external host — no analytics services, no telemetry, no third-party APIs. Every API call goes to the Jira Cloud instance the App is installed on, via Atlassian's Forge requestJira SDK.

What	Where	How long
Insights cache (author IDs, display names, worklog details)	Forge Key-Value Store, per project + filter	30 minutes (automatic expiry). Self-service views bypass the cache entirely.
Export tokens (account ID + export scope)	Forge Key-Value Store	2 minutes, deleted on first use (one-shot).
Per-project settings (thresholds, hours-per-story-point)	Forge Key-Value Store	Until a project admin clears or erases them. Contains no personal data.

No personal data is stored permanently. Display names and account IDs exist only in the 30-minute cache. The per-project settings contain only numeric thresholds and a story-point ratio — no personal data.

3. How we use the data

The App uses the data exclusively to:

• Display worklog entries in the audit and self-service views.
• Flag entries that match configurable suspicion patterns.
• Generate CSV exports of the current view for auditors.

We do not use the data for advertising, profiling, training models, or any purpose unrelated to the App's functionality.

4. Data sharing

We do not share any data with third parties. The data never leaves Atlassian's infrastructure. There are no sub-processors beyond Atlassian.

5. Your rights (GDPR & similar)

Because no personal data is stored permanently, exercising your right to erasure is straightforward:

• The 30-minute cache expires automatically — your data is gone within 30 minutes of the last time the cache was written for you.
• A project admin can click "Erase all data" on the Fairlog settings page to clear the cache immediately for a project.
• Uninstalling the App schedules all its KVS data for deletion by the Forge platform.

To request erasure, ask a project admin of any project you appear in to use the "Erase all data" action, or uninstall the App.

6. Security

The App runs entirely within Atlassian's Forge sandbox. It has no access to secrets, no ability to make outbound network calls except to the Jira instance it is installed on, and no filesystem. All data in transit uses HTTPS. Access to the audit view is enforced server-side on every API call — not just hidden in the UI.

7. International transfers

The App stores data in Atlassian's Forge infrastructure. Atlassian's data residency and transfer practices are governed by Atlassian's own policies. The App itself makes no transfers — all data stays within the Forge environment.

8. Changes to this policy

If we change how the App processes personal data, we will update this page and the version date above. Material changes will also be reflected in an App update on the Marketplace.

9. Contact

For privacy questions or data requests, contact the support email listed on the App's Marketplace listing page.