Paperlatch
Privacy Policy
Confirm & Chase for Confluence · Last updated 20 October 2026
The short version. The app runs on Atlassian Forge and stores its data in Atlassian's own app storage, inside your Atlassian cloud site. We operate no server, so no data about you or your users is transmitted to us or to any third party.
What the app stores
For each page where the macro is used, the app stores:
| Data | Why |
|---|---|
| Atlassian account ID of the person who confirmed | To record who confirmed |
| The date and time of the confirmation, in UTC | To record when |
| The page ID and the policy version at that moment | To tie the confirmation to what was confirmed |
| The confirmation text chosen by the page author | To display the prompt |
| The ID and name of the Confluence group chosen as the audience | To work out who has not confirmed |
Nothing else is stored. In particular the app does not store the content of your pages, email addresses, IP addresses, or any usage analytics.
What the app reads but does not store
To render the report, the app reads page titles, the public display names of users, and the membership of the group you select as the audience. These are read at the moment the report is opened and are not written to storage.
Where the data lives
In Atlassian Forge app storage, within your own Atlassian cloud site and subject to the data residency that applies to that site. The data never leaves Atlassian's infrastructure. We have no facility to read it, export it, or connect to it.
Permissions the app requests
read:confluence-user— to identify the person confirmingstorage:app— to store the confirmations described aboveread:page:confluence— to show page titles in the reportread:user:confluence— to show display namesread:group:confluence— to determine the audienceread:content.permission:confluence— to ask Confluence whether you are allowed to see a page before the app tells you anything about itreport:personal-data— to tell Atlassian once every reporting cycle which accounts the app holds confirmations for, so that confirmations of closed accounts are erased
Five of those are read-only. storage:app is the one write capability, and it
reaches only the app's own storage described above. report:personal-data lets the
app send Atlassian the account IDs it holds, and nothing else. The app has
no permission to write to your Confluence content, does not act on behalf
of any user, and never reads or stores email addresses. The user-read permission it does
hold covers profile information that includes an email address; the app does not read that
field, and no email address is written to storage.
Retention and deletion
Confirmations are kept for as long as the app is installed, because their purpose is to serve as a durable record.
When the app is uninstalled, Atlassian retains the app's storage for 28 days before it stops being available to the app, and within 21 days of uninstalling a site administrator can ask Atlassian Support to recover it. Reinstalling the app does not restore data from a previous installation. We cannot shorten or extend that window: it is Atlassian's retention schedule for Forge storage, not ours.
Your users' rights
The stored personal data is an Atlassian account ID and a timestamp. As the operator of your Confluence site you are the controller of that data.
Closed Atlassian accounts. Once every reporting cycle (7 days, or the period Atlassian sets; a failed report is retried the next day) the app reports the account IDs it holds confirmations for to Atlassian, using Atlassian's personal data reporting. When Atlassian answers that an account has been closed, the app deletes every confirmation by that account, on every page and in every round. From then on the report shows that person as not having confirmed. If you need those confirmations as evidence, export the CSV before the account is closed.
For any other erasure request, a site administrator can uninstall the app — subject to the 28-day retention window above. There is no in-app way to erase one active person's records, and we cannot act on such a request on your behalf, because we have no access to the data.
We would rather say that plainly than imply a capability that does not exist.
The Marketplace listing page
The app's listing page on the Atlassian Marketplace is operated by Atlassian, not by us. Atlassian permits partners to attach a Google Analytics measurement ID to their listing page, and we do so in order to see how many people view the listing. That measurement applies only to the Marketplace listing page — it is not present in the app itself and collects nothing from inside your Confluence site.
Changes
If this policy changes materially, the listing will be updated and the date at the top of this page will change.