What ChatHerald holds, and what it sends on.

Who we are

ChatHerald is operated by Notified Limited, New Zealand. This policy covers the ChatHerald Forge app and the website at chatherald.com.

This website

chatherald.com is a static site. It has no accounts, no forms, and no analytics. A theme choice (light or dark) is saved in your browser’s local storage under the key chatherald-theme. That value is not sent to us. The site does not set cookies.

Where the app runs

The app is hosted on Atlassian Forge. Its code runs on Atlassian’s infrastructure, and its data is kept in Forge storage for each installation. Notified Limited does not run a server for the app and does not receive issue or page content through it. The only network call to a host outside Atlassian is to https://chat.googleapis.com, the incoming webhook an admin saved.

Data residency is handled by Atlassian. Forge storage is kept in the same location as the host Jira or Confluence site, and Atlassian encrypts it at rest. Messages posted to Google Chat are stored by Google in the customer’s Google Workspace, under Google’s terms.

What is stored

Per installation, in Forge key-value storage:

• Rule configuration: name, enabled flag, event types, project, issue type, priority, label, optional status and field filters, optional JQL, delivery mode, and the webhook id. Rules do not contain issue text.
• Webhook URLs, stored in Forge storage as secrets. The admin screen shows a masked URL. The token is not written to the delivery log.
• A label and created time for each webhook, the site origin used to build links, and whether messages are text or text plus a card.
• A digest queue and a retry queue of timestamps, rule id, issue key, event kind, and attempt counters. Summaries and comment text are not stored in those queues.
• Short-lived dedupe markers, kept for two days, holding only a timestamp.
• A delivery log of four fields only: timestamp, rule id, issue key, and HTTP status code. Each row is stored with a seven-day expiry. The screen also hides rows older than seven days and shows at most 100. Status 0 means no HTTP status came back. Confluence pages are recorded as page: plus the page id. A test is recorded as issue key TEST.

The app does not store issue descriptions, attachments, or page bodies.

What is sent to Google Chat

When a rule matches, the app reads the fields it needs and posts them to the saved webhook. A message can include the event kind, issue key, summary, project, issue type, priority, status change, a comment excerpt of at most 280 characters, a page title, a space key, and a link to the issue or page. A digest can include up to 20 keys and summaries, a count of any further items, and one link. Those fields are used to build the post and are then discarded. If a retry or a digest needs them later, they are read again from Jira or Confluence.

The customer chooses the Google Chat space. Google’s handling of the posted message is covered by Google’s terms, not this policy. People in that space can see the message.

Scopes

The app requests read:jira-work, read:jira-user, storage:app, read:confluence-content.summary, and read:page:confluence. read:jira-user is reserved for a possible later feature that would map people for personal messages. The current code does not read user profiles. Justifications for each scope are on the docs page.

No sale of data

Notified Limited does not sell personal information. The app does not send installation data to an advertising network, a data broker, or a server run by Notified Limited. Google Chat is the only third party that receives data from the app.

Retention, uninstall, and deletion

Delivery-log rows expire after seven days. Digest and retry queues are removed as they are sent or abandoned. An admin can delete a rule. Deleting a rule does not delete the webhook secret. An inactive licence stops delivery and locks editing. It does not delete rules, queues, or webhook URLs.

When the app is uninstalled: ChatHerald does not run its own clean-up step. Everything it stores (rules, webhook URLs, queues, dedupe markers, and the delivery log) lives in Atlassian’s Forge storage, and Atlassian deletes that storage for the site when the app is uninstalled. Atlassian first soft-deletes it and keeps it for up to 28 days, so it can be re-linked if you reinstall and ask within 21 days, then disposes of it under Atlassian’s data retention policy. See Atlassian’s data lifecycle for Forge-hosted storage. Messages already posted to Google Chat stay in that space until someone deletes them there.

To ask for deletion of something you emailed us, or to ask what we hold, write to [email protected]. Support mail is received by Notified Limited, and the mailbox is monitored on New Zealand business days (weekdays, excluding New Zealand public holidays).

Access and correction

Admins can see rules, masked webhook URLs, and the delivery log inside the app. Issue text is not kept there. If a field in a stored rule is wrong, an admin can edit by deleting the rule and adding it again while the licence allows editing. For anything else, contact support.