NF / Legal / Atlassian

License Radar for Jira — Privacy policy

Scope and product boundary

This policy explains how License Radar for Jira handles information when it is installed in Jira Cloud. The product reviews the Jira site where it is installed; it does not build a cross-site organisation directory or a separate identity-management system.

Information processed

License Radar processes the minimum information needed to provide a read-only access review:

Jira site and Atlassian Forge installation identifiers.
Atlassian account identifiers, display names and email addresses when Jira returns them.
Jira application-role access and observed group membership when exposed by the supported API.
Issue update timestamps associated with assignee, reporter and creator references.
Review thresholds, cost assumptions, decisions, exclusions and aggregate scan status.

Activity evidence is bounded

A License Radar activity date comes from Jira issue updates visible to the installed app. It is not an Atlassian organisation-wide last-login, sign-in or last-active metric. A missing activity record means that the available signal is insufficient; it does not prove that a person never used Jira or that access should be removed.

What we do not collect

License Radar does not ask for or store Atlassian passwords, API keys, personal access tokens, OAuth secrets, issue descriptions, comments, attachments or unrelated Jira content. Issue searches request only the fields needed to calculate the bounded activity signal.

Why we process it

We process this information to identify supported Jira access, calculate an observable activity signal, show review candidates, apply the administrator's cost assumptions, preserve review decisions and generate the reports available in the selected plan. We do not sell customer data or use it for advertising.

Storage, isolation and retention

The production app uses Atlassian Forge Storage inside the installation environment. Data is scoped to the authenticated Jira installation, so one site cannot read another site's configuration, scans or review records. License Radar has no separate external customer-data database or configured analytics endpoint.

Free exposes the latest completed scan and its available review data.
Pro retains a bounded scan history and aggregate trends where the feature is enabled.
Temporary processing data is kept only for the time needed to complete the analysis.
Configuration, decisions and available report data remain until deleted or the app is uninstalled.

Deletion and rights

Administrators can delete available configuration and report data through the product where those controls are provided. When the app is uninstalled, associated Forge Storage is removed according to Atlassian's policies. To ask a question about access, deletion or applicable privacy rights, use the support form or email support@narrowforge.com.

Read-only safety

License Radar reads Jira data and writes only its own analysis records. It does not remove or suspend users, change groups, revoke product access, edit permissions or change billing. Any action outside the product remains the administrator's decision and responsibility.