Privacy Policy – JQL Activity Stream
Effective date: 11 November 2026
This policy explains how Litchfield Software ("we", "us") handles information in connection with JQL Activity Stream (the "App"), a Jira Cloud dashboard gadget sold through the Atlassian Marketplace, and in connection with the support we provide for it.
The short version
- The App runs entirely on Atlassian's Forge platform ("Runs on Atlassian"). It has no servers of our own and makes no calls outside Atlassian (no egress).
- It only reads Jira data, and every read is made as the person viewing the gadget, so it never shows anyone data that Jira would not already show them.
- It does not write to Jira and does not use Forge storage. The only thing it keeps is a short-lived cache in memory (details below).
- Excel and CSV exports are built in your own browser and saved to your device. We never receive them.
- We do not receive, sell or share your Jira content. The only personal information we receive is what Atlassian shares with Marketplace partners for licensing, and what you choose to send us when you ask for support.
1. Information the App processes inside your Jira site
What it reads
When someone views the gadget, the App asks Jira, through Atlassian's Forge API and with that person's own permissions (asUser), for:
- the saved filter or JQL query the gadget is configured with, and the list of saved filters the viewer can see (when configuring the gadget);
- the issues that match that filter or query: key, summary, issue type, status, creator and created/updated times;
- the change history (changelog), comments and work logs of those issues, including the people who made them (as Atlassian account IDs, display names and avatars) and the text of comments, work-log notes and changed field values;
- the site's status list (used for status colours) and JQL validation results.
The App requests only two read scopes: read:jira-work and read:jira-user. It has no write scopes and cannot change your Jira data.
Where it is processed
The App's backend is a Forge function hosted and operated by Atlassian. Jira data passes from Jira to that function and then to the viewer's browser, where the activity feed, statistics, charts and exports are produced. None of it leaves Atlassian's infrastructure and the viewer's browser.
What is kept, and for how long
- Short-lived cache (memory only). To avoid repeating identical requests during a dashboard session, the Forge function keeps two kinds of Jira responses in the memory of a running function instance: the definition of the saved filter being viewed (including its name and JQL) and the site's status list. Each cached entry expires 60 seconds after it was fetched. The cache is separated per Jira site and per viewer, holds at most 100 entries per viewer and at most 200 viewers per function instance (the oldest are dropped first), and disappears entirely whenever Atlassian recycles the function instance. It is never written to Forge storage, a database or disk.
- Gadget settings. The settings you choose in the gadget's configuration screen (title, filter or JQL, activity types, the optional "only show activity by" people, date range, items per page and auto-refresh interval) are saved by Jira on the dashboard item, like any other gadget's settings. They stay in your Jira site and are removed when the gadget or dashboard is deleted.
- Nothing else. Feed data, statistics and exports are not stored by the App.
Exports
Excel (.xlsx) and CSV files are generated in the viewer's browser from data already shown to that viewer and are downloaded directly to their device. We never see them. Once downloaded, an export is under your organisation's control, and your own policies apply to it.
Logs and metrics
Like every Forge app, the App's function writes operational logs to Atlassian's Forge logging service, which we can read for troubleshooting. Our logs record only the name of the operation, how long it took, counts (for example, how many issues and updates were returned) and error codes. They do not contain issue content, comments, work logs, JQL or names. Atlassian also gives us aggregate usage and error metrics for the App. Atlassian controls how long it retains these logs and metrics.
2. Information we receive as a Marketplace partner
When your organisation starts a trial of or buys the App, Atlassian shares licensing information with us under the Atlassian Marketplace terms. This can include the licensed site, organisation name, licence status and dates, and contact details (name and email) for billing and technical contacts. We use it only to manage licences, provide support, and send service or legal notices about the App. We do not use it for unrelated marketing, and we never sell it.
3. Support requests
If you email support@camden-trades.com, we receive your name, email address and whatever you include in your message (for example screenshots, JQL or error messages). Please don't send us more Jira content than is needed. We use it only to answer you and to improve the App, and we keep support correspondence for as long as we need it to help you and for reasonable record-keeping, normally no longer than three years. Support email is processed on our behalf by these sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. (Cloudflare Email Routing) | Receives mail sent to support@camden-trades.com and forwards it | United States and Cloudflare's global network |
| Microsoft Corporation (Microsoft Outlook) | Stores and delivers our support mailbox | United States |
4. Our website
Our documentation pages at https://apps.camden-trades.com/jql-activity-stream are static pages hosted on Cloudflare Pages. They set no cookies and use no analytics or tracking. Cloudflare may process technical data such as IP addresses to deliver and protect the site.
5. Sharing
We do not sell or rent personal information, and we do not share Jira content with anyone, because we never receive it. We share information only:
- with the sub-processors that handle our support email (Cloudflare Email Routing and Microsoft Outlook) and host our website (Cloudflare Pages), to the extent needed to run them;
- if the law requires us to; or
- as part of a sale or transfer of the App, in which case this policy continues to apply to information already collected.
Atlassian's own handling of your data, including the Forge platform that runs the App, is governed by Atlassian's agreements with your organisation and the Atlassian Privacy Policy.
6. Legal bases, roles and international transfers
Where data-protection laws such as the GDPR apply:
- For Jira data used by the App, your organisation decides what data the App reads and who can see it. The App processes that data only on Atlassian's platform, and we do not have access to it.
- For licensing data and support correspondence, we act as a controller and rely on our legitimate interests in providing, licensing and supporting the App, and on performing our contract with you.
We are based in the United States. Support correspondence and licensing information are processed in the United States; Cloudflare may carry email through its global network on the way to our mailbox.
7. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete or object to the processing of personal information we hold about you (for example your support emails or licensing contact details). To make a request, email support@camden-trades.com. We will respond within the time the law requires. You can also complain to your local data-protection authority.
Requests about your Jira content itself should go to your Jira site administrator. We don't hold it.
8. Uninstalling
If you uninstall the App, nothing remains with us: the App keeps no stored data, and any in-memory cache expires within 60 seconds. Gadget settings remain part of your Jira dashboards until you remove the gadgets.
9. Security
The App follows Atlassian's Forge security model: it runs on Atlassian's infrastructure, has no egress, uses read-only scopes and acts only with the viewer's permissions. Exports protect against spreadsheet formula injection. Please report suspected vulnerabilities to support@camden-trades.com. We will acknowledge reports within two business days and fix confirmed issues within the timeframes of Atlassian's security requirements for Marketplace apps.
10. Children
The App is a business tool and is not directed at children.
11. Changes
If we change this policy, we will update the effective date above. If a change is material, we will also notify licensed customers through the contacts Atlassian provides.
12. Contact
Litchfield Software – support@camden-trades.com