Privacy policy
Group & Project Watchers for Jira · Last updated October 22, 2026.
NITROSOFT TECHNOLOGY INC, 2100 S Ocean Dr, Fort Lauderdale, FL 33316, USA, develops this Jira Cloud app. See the support page for app privacy and support information.
What the app does
The app processes project administrator rules and personal project-watching subscriptions to add individual accounts as watchers of matching new Jira issues. An administrator can optionally enable a Jira notification explaining that a watcher rule added the recipient. Notification is off by default. This policy covers these features.
Data we process
| Record or processing | Data and purpose |
|---|---|
| Saved watcher rules | Rule, project, component, issue-type, group and Atlassian account IDs; enabled and notification options. These determine which new issues receive which watchers. |
| Personal subscriptions | Project and account IDs, enabled choice and optional component ID. These apply the user's project-watching preference. |
| Rule capacity | Project ID, retained-record count and version counter. These enforce the project rule limit during concurrent saves. |
| Notification tracking | Issue, project, run and pending-rule IDs; added and eligible account IDs; a SHA-256 hash of the matched rules' ID/boolean configuration; processing status, attempt count and retry-not-before timestamp. These combine recipients, detect changed rules, throttle delivery and prevent duplicate notices. The hash is not an anonymization guarantee. |
| Queued work | Issue IDs and, where needed, issue key, project/component/type references, rule/run IDs, pagination positions and retry timing. Forge processes these to continue bounded work without copying issue content. |
| Live Jira lookups | Issue project/component/type metadata, group membership, watcher account IDs, current user status and permissions. Display names and group/component/type labels are used transiently for selection and display. |
Atlassian account IDs and preferences are user-linked data, not anonymous records. The app does not save issue summaries, descriptions, comments, email addresses, display names or raw Jira response bodies in its application records or queue payloads. Jira API responses can contain additional profile fields; only needed identifiers or display labels are selected for processing. Customer Jira passwords and API tokens are not requested by the app; Forge supplies installation and user authorization.
Notifications and recipients
When a rule explicitly enables notification, the app asks Jira to notify only eligible accounts newly added by that rule-processing run. It sends fixed text: "A project watcher rule added you as a watcher of this issue." The subject is "You were added as an issue watcher". It does not insert issue content, names or email addresses into that body. Jira resolves account IDs and controls delivery and permissions. An accepted request does not prove that email was received. Personal project subscriptions do not send this optional rule notification.
App hosting, access and location
Application processing, saved records and queues use Atlassian Forge and Jira APIs. The current app has no external runtime backend or declared external egress destination, advertising integration or external analytics integration. We do not sell app data or use it for advertising. Atlassian operates the app platform and processes the relevant Jira requests and notifications.
Forge storage is scoped to the installation. Atlassian documents encryption on disk and storage residency with the host Atlassian app. Actual customer pinning and migrations depend on Atlassian settings. This does not promise that all compute, diagnostics or logs remain in one region. See Forge data residency. Nitrosoft®'s security controls and reporting contact are described in the security statement.
Retention and controls
Saved rules, subscription records and quota counters have no application-defined automatic expiry. Archiving a rule disables it and retains its IDs and options. Stopping personal project watching retains a disabled account/project record. Neither action removes accounts from issues they already watch.
Notification tracking has no automatic expiry. A successfully recorded terminal outcome clears its account-ID and pending-rule lists but keeps an issue/project/run marker, plan hash, status, attempt count and retry timestamp to prevent duplicate delivery. Stalled collecting, ready or claimed work can retain account IDs without a time limit until a terminal update or support remediation occurs. A crash or inactive license can prevent that update. There is no scheduled cleanup of these stalled records. Separate notification throttle keys contain a boolean and time slot only; they request a one-day Forge expiry, subject to platform expiry handling.
Uninstallation does not cause immediate physical deletion. Atlassian documents 28-day hosted-storage retention after uninstall. Prior data is not automatically restored on reinstall; recovery requires customer consent and a request within 21 days. See Forge storage and its data lifecycle. These windows do not establish a retention promise for every backup, queue or log.
Privacy requests and operational records
For access, correction or erasure of user-linked app data, use the support form and choose Privacy request. Identify the app and relevant Atlassian site/account only as needed for verification. Handling may require coordination with the site administrator or Atlassian. The support form does not perform an automated data-removal action. The app does not currently include a self-service erasure or automated account-reporting/ erase-refresh workflow. Disabling a preference is not erasure. No response-time commitment is stated here.
Application-authored notification logs use fixed status labels. Forge/Jira diagnostics may include platform invocation or request metadata; they are governed by platform access and retention controls. The current app declares no external log-export destination. Support correspondence is separate from the app's Forge storage and may contain the sender's contact details and supplied context. Do not send passwords, tokens or customer issue content. Support correspondence has no app-enforced retention timer stated by this policy.
This public website
The website uses Microsoft Azure App Service hosting, separately from Atlassian Forge. Microsoft Azure and DNS services process connection/request metadata, such as IP address, requested URL and browser headers, to deliver and protect the pages. This website does not receive records from your Forge installation. Provider operational records and retention depend on the hosting configuration and provider services; no fixed retention period or absence of provider logging is promised.
The website contains no analytics scripts or external fonts. Its support form asks for your name, email, Jira site URL, category and description. Submitting stores these details in the internal Nitrosoft® Jira support project, separately from your installation's Forge records. Nitrosoft® uses them to identify, investigate and triage the request; support records have no automatic retention timer. Do not submit passwords, tokens, customer issue content or unnecessary personal data. The server does not visit the supplied site address or access your Jira installation. It has no email-delivery integration; Jira administrators control Atlassian project notifications separately.
The support page uses a Secure, HttpOnly, SameSite=Strict antiforgery cookie to protect submissions, not to track visits. Form identifiers expire after 30 minutes; hashed network-address limits use windows of up to 10 minutes. These controls live only in worker memory to prevent duplicate submissions and limit abuse. Expired entries are removed on later requests, and all entries clear when the worker restarts. Provider connection/request records remain subject to Azure configuration and retention.
Updates
Changes to app features or data handling may require an updated policy. The date above identifies this version. See the support page for ticket availability and information to prepare about a change affecting your use of the app.