Paperlatch
Privacy Policy
Page Approval & Document Sign-off for Confluence · Last updated 21 October 2026
The short version. The app runs on Atlassian Forge and stores its data in Atlassian's own app storage, inside your Atlassian cloud site. We operate no server, so no data about you or your users is transmitted to us or to any third party.
What the app stores
For each approval decision, one record:
| Data | Why |
|---|---|
| The approver's Atlassian account ID and display name at the moment of deciding | To show who decided |
| The decision (approved or rejected) and, for a rejection, the comment the approver wrote | A rejection must say why |
| The date and time, in UTC, from the server | To show when |
| The page ID, the version number, and a SHA-256 hash of that version's title and body | To bind the decision to exactly what was approved |
| Whether the approver was the author of that version | So that a self-approval is visible |
| The approvers and the rule (everyone / one is enough) in force at that moment | So the decision can be read later in its context |
| Salted hashes of the approver's identity, a hash of the decision, and the hash of the one before it on the same page | So that a removed or altered decision is detectable |
The app also stores, for each page, every setting of its approvers: the approvers' account IDs, the rule, and the account ID and display name of the person who set them, with the time. Settings are added, never overwritten.
The app does not store the content of your pages. It stores a hash of the decided version — a fingerprint from which the text cannot be recovered. It stores no email addresses, no IP addresses and no usage analytics.
What the app reads but does not store
When a page with the macro is opened, the app asks Confluence whether the viewer may read that page, and reads the page's current version to show its approval status. When approvers are chosen, it asks Confluence whether each of them can read the page. It reads display names and page titles to make the screens readable. None of this is written to storage.
Where the data lives
In Atlassian Forge app storage, within your own Atlassian cloud site and subject to the data residency that applies to that site. It is never transmitted to us or to any third party, and we have no facility to read it or connect to it. It leaves Atlassian only when one of your users exports it — the CSV downloads save approver names, account IDs, decisions and comments to that person's computer.
Permissions the app requests
storage:app— to store approvers, approval decisions and the audit trailreport:personal-data— to tell Atlassian once every reporting cycle which accounts the app holds data for, so that the identity of a closed account is erasedread:content.permission:confluence— to ask Confluence whether you are allowed to see a page before the app shows you anything about it, and whether an approver can read the page they are asked to approveread:user:confluence— to show display namesread:confluence-user— to identify the person approvingread:page:confluence— to bind each decision to the exact page version and its content
The app holds no write permission to Confluence. It never creates, edits, restricts or deletes a page. Atlassian's description of the user permission mentions email addresses; the app does not read or store them.
Retention and deletion
Decisions and approver settings are kept for as long as the app is installed. The app has no function that deletes a decision: an approval that could be quietly removed would not be evidence.
When the app is uninstalled, Atlassian retains the app's storage for 28 days. Reinstalling the app does not restore it automatically. If you reinstall and need the earlier records, email us within 21 days of uninstalling: with your consent, we ask Atlassian to re-link the previous installation's data to the new one. After that window the data is gone, so if your records must be kept, export them before uninstalling. These periods are Atlassian's retention schedule for Forge storage (Forge storage reference), not ours.
Your users' rights
The stored personal data is a display name, an Atlassian account ID, timestamps and any rejection comment, attached to the decisions a person made and the approver settings they changed. As the operator of your Confluence site you are the controller of that data.
Closed Atlassian accounts. Once every reporting cycle (7 days, or the period Atlassian sets; a failed report is retried the next day) the app reports the account IDs it holds data for to Atlassian, using Atlassian's personal data reporting. When Atlassian answers that an account has been closed, the app erases that person's identity from every decision — account ID and name — and replaces their account ID in every list of approvers, and as the person who set approvers, with an anonymous “closed account” marker. The decisions themselves stay: what was decided, when, and on which version. Each decision binds to a salted hash of the identity rather than the identity itself, so erasing it does not break the record, and the hash cannot be traced back to the person. A page whose current approvers include a closed account cannot be approved under “everyone must approve” until someone who can edit it changes the approvers; the page says so. If your procedures need the approvers' names after an account is closed, export the record before the account is closed.
Updated profiles. When Atlassian answers that a person's profile has changed, the app erases its stored copy of their name as the person who set approvers; the screens show names live from Atlassian. The name inside a decision is not changed: it is part of the record of who decided, and is erased only when the account is closed. If the person's name has changed since, their current name is shown beside it, marked “now:”. It is read from Atlassian each time it is shown, and never stored by the app.
For any other erasure request about an active account, there is no in-app way to remove one person's decisions — that would remove evidence other people rely on — and we cannot act on such a request on your behalf, because we have no access to the data.
The Marketplace listing page
The app's listing page on the Atlassian Marketplace is operated by Atlassian, not by us. Atlassian permits partners to attach a Google Analytics measurement ID to their listing page, and we may do so in order to see how many people view the listing. That measurement applies only to the listing page on Atlassian's site. There is no analytics of any kind inside the app.
Changes
If this policy changes in a way that affects what is stored or who can reach it, the change will be described here with a new date above, and material changes will be noted in the app's release notes on the Marketplace.
Contact
support@paperlatch.com. For a suspected vulnerability, see our security policy.