Privacy Policy

CodeDoc for Confluence · Last updated: October 12, 2026

1. Introduction

This Privacy Policy explains how CodeDoc for Confluence (formerly CodeDoc; "the App"), developed by Janek Behrens ("we", "us", "our"), handles data when installed on your Atlassian Confluence Cloud instance. We are committed to protecting your privacy and being transparent about our data practices.

2. Your Own Keys, and Atlassian AI

The App works with credentials you provide: access tokens for Git hosting providers (GitHub, GitLab, Bitbucket Cloud, Azure DevOps, or your own GitHub Enterprise or GitLab server) and, if you use AI pages with your own provider, API keys for AI services (Anthropic, OpenAI, or Google AI). The App uses these credentials solely to perform the functions you initiate. We do not have access to your API keys or tokens — they are stored in your Confluence instance's encrypted Forge storage and are never transmitted to us.

For Bitbucket, the App accepts repository, project and workspace access tokens. A Bitbucket connection made before version 8 with a personal API token or app password was entered as email:token or username:password, so its stored token also contains the e-mail address or user name of that account; CodeDoc marks such connections until an admin replaces them with an access token.

In the Advanced edition, AI pages use Atlassian AI unless an own AI key is connected and chosen in Settings: AI models hosted on Atlassian's platform (Forge LLMs). No AI key is needed for this, and no third-party AI account is involved. Your own key stays optional. In the Standard edition, AI pages need your own key.

Atlassian AI is a service of Atlassian, not of us. For an AI page, the App sends the selected files and the writing instructions to it and receives the generated page. How Atlassian processes, protects and retains this data, and which model providers it uses, is governed by Atlassian: see the Atlassian Privacy Policy, Atlassian's AI trust information and the Atlassian Customer Agreement.

3. Data We Access

The App accesses the following data solely to provide its functionality:

• Source code (AI pages): Fetched from your Git repositories by the Atlassian Forge runtime (running on Atlassian's infrastructure) using your access token. The code is loaded into the Forge runtime's memory, processed there, and forwarded to your AI provider. Code is not cached or retained after the job execution completes.
• Files for sync blocks: The file a sync block shows is read from your Git repository in the same way. The App writes the part you chose into that block on the Confluence page. Nothing from sync blocks is sent to an AI provider.
• Confluence data: Space names and page IDs — used to create or update documentation pages in the spaces you select. Group names, for the group picker in Settings.
• Your Atlassian account ID, which Confluence passes with each request, and the Confluence groups and permissions of that account — used to check your CodeDoc role and what you may do on a page. Group memberships and permissions are not stored.
• AI API: Your source code, together with the writing instructions and page settings of the AI page, is sent to your chosen AI provider using your API key, or, with Atlassian AI (Advanced edition), to the AI models hosted on Atlassian's platform, for documentation generation. The response (generated documentation) is published to Confluence.
• Version check (optional): For a sync block where you switch on "Compare with the latest release", the App sends the public name of the image or package named in the file (for example "nginx") to its public registry to read the newest release. No file content, repository, page or user information is sent. Lookups of GitHub releases use the access token of your github.com connection, if there is one, so that GitHub's rate limit for anonymous requests does not apply.

4. Data We Store

The App stores the following data using Atlassian Forge Storage (hosted and managed by Atlassian within your Confluence Cloud instance):

• AI provider configuration (provider type, encrypted API key, selected model)
• Git provider configuration (provider type, encrypted access token, base URL, label, and the user name and display name of the Git account the token belongs to, as your Git provider reports them)
• Repository list (repository URLs, branches, provider references)
• Job configuration of AI pages (name, selected repositories, writing style and writing instructions of up to 2,000 characters, include and exclude patterns, trigger settings, target space and page)
• Writing styles that admins save as templates for AI pages (name and settings)
• Generation history of the last 100 runs (job name, status, timestamp, token usage, repository names, the paths of up to 50 files that were read, target space and page, error message — no source code or generated content)
• File lists of the AI file selection (file paths, sizes and types — no file content)
• Job execution status (ephemeral progress state during active job runs)
• Webhook deduplication data (SHA-256 hashes of webhook delivery IDs and request bodies, kept for up to 7 days to prevent duplicate processing — no payload content)
• Webhook secret (required for push-triggered jobs since version 8.5; used to verify every incoming webhook)
• Sync block records (page and block ID, block settings, a checksum of the last synced content, status and last error — not the file content)
• Atlassian account IDs of people who approved, discarded or undid a run of an AI page, approved a sync block, or dismissed the rating prompt (the ID only, no name or e-mail address)
• Names of the Confluence groups that hold the CodeDoc roles Admin and Job Operator
• Anonymous daily usage counts per feature (for example "a sync block was updated"), without any page, space, repository, file or user information
• Atlassian AI usage per month (Advanced edition): credits, token counts, number of runs and model name — no source code or generated content
• Version check answers: public release numbers and support dates per image or package name, refreshed after 12 hours
• App-level settings (general preferences and configuration flags)

We do not store your source code or the generated documentation content. Source code is read, processed, and discarded within a single job execution. Generated documentation is written directly to Confluence.

5. Data We Do NOT Collect

• We do not receive any personal data. The App stores Atlassian account IDs (see section 4) but no names, e-mail addresses or other personal profile data of Atlassian users; the only exceptions are the name of the Git account behind each Git connection and the e-mail address or user name inside an older Bitbucket personal token (see sections 2 and 4). Source code is never stored.
• We do not send any data to our own servers or to any third-party analytics, tracking, or advertising platforms.
• We do not use cookies, tracking pixels, or any form of user tracking.
• We do not have access to your API keys, access tokens, or source code.
• We do not retain or log the content of your source code or the generated documentation.

Technical logs and usage counts: Like most Forge apps, the App writes technical log lines (for example "a sync run ended with an error") and, once a day, anonymous usage counters to Atlassian's app logging, which Atlassian makes available to us as the app vendor. Log lines may contain IDs of AI pages, jobs, connected repositories, Confluence pages and spaces from your site, as well as counts, statuses, provider and model names and durations, but never names, titles, repository or server addresses, branch names, file contents, account IDs, e-mail addresses or free text (free text is described only by a short hash and its length). We use them only to find errors and to see which features are used.

6. Third-Party Data Transmission

When you run a documentation job, the App transmits data to the following third-party services using your own credentials:

• Your Git provider (GitHub, GitLab, Bitbucket, Azure DevOps, or your own GitHub Enterprise or GitLab server) — to read source code files from your repositories.
• Your AI provider (Anthropic, OpenAI, or Google AI) — to generate documentation from the source code, if you use your own key. With Atlassian AI (Advanced edition) the code is processed on Atlassian's platform instead.
• Public registries (Docker Hub, npm, PyPI, GitHub releases, endoflife.date) — only for sync blocks with the version check, and only the public name of an image or package.

Your own Git servers are reached only after a site admin of your Atlassian site approved their address; Atlassian keeps that approval and shows it in Atlassian Administration (Connected apps).

Blue = Atlassian infrastructure   |   Orange = services you configure with your own credentials

Important: Each third-party provider has its own data handling and retention policies. We have no control over how your Git provider or AI provider processes, stores, or retains data sent to them. You are responsible for reviewing and accepting the terms and privacy policies of the services you connect.

We do not send data to any services beyond those you explicitly configure, and, for sync blocks with the version check, the public registries named above. No data is transmitted to our own servers or any other third party.

7. Data Processing Location and Data Residency

The App's backend logic runs entirely within the Atlassian Forge runtime environment as part of the Atlassian Forge platform. Data is processed on Atlassian's infrastructure. Outbound connections are made only to the Git and AI providers you configure (including own Git servers a site admin approved) and, for sync blocks with the version check, to the public registries named above, using Forge's allowlisted external fetch mechanism. Atlassian AI runs on Atlassian's platform.

The App does not offer data residency options. Everything listed in section 4 is stored in Forge hosted storage on Atlassian's infrastructure, and the App has no servers of its own. Because the App connects to Git and AI services you choose, it does not carry Atlassian's data residency (PINNED) status. Source code and other files the App reads from your Git provider are processed in memory and discarded; the text sent to your AI provider or to Atlassian AI is handled by that service, which decides location and retention. The technical logs are handled by Atlassian's app logging.

8. Data Retention

• Configuration data (providers, jobs, repositories, writing styles, role groups) is retained in Forge Storage as long as the App is installed. Deleting a Git or AI connection deletes its token or key at once.
• Generation history (metadata only — no source code or content) keeps the last 100 runs; older runs drop out, and admins can delete all of it with "Clear history". The account IDs of a run go with it.
• Sync block records and their approvals, with the account ID of the Job Operator who approved them, are kept until a Job Operator removes the block in CodeDoc → Sync Blocks ("Remove", or "Remove detached" once its page is gone). Notes that someone dismissed the rating prompt, file lists of the AI file selection and the anonymous daily usage counts are kept as long as the App is installed.
• When the App deletes data, it is removed from Forge storage at once and the App can no longer read it. Atlassian keeps a soft-deleted copy for recovery from accidental deletion until the end of its retention period.
• Source code is never stored. It is fetched from Git into the Atlassian Forge runtime, processed in memory, forwarded to the AI provider or Atlassian AI, and discarded within the same job execution.
• Version check answers are kept for 12 hours; Atlassian AI usage counts per month as long as the App is installed.
• Generated documentation is stored as standard Confluence pages. These pages persist independently of the App and are not deleted upon uninstallation.
• After you uninstall the App, Atlassian keeps the App's storage for 28 days and then deletes it (Data lifecycle for Forge-hosted storage). During that time the App cannot read it. Within 21 days of the uninstall, you can ask us to have Atlassian restore it to a new installation of the App.

9. GDPR Compliance

As personal data, the App itself stores Atlassian account IDs (section 4), the name of the Git account behind each Git connection, and, in a Bitbucket connection made before version 8 with a personal token, the e-mail address or user name inside that token (section 2); everything else it keeps is configuration and run metadata. All of it stays in Forge Storage for your site. If your source code or generated documentation contains personal data, that data is read by the Atlassian Forge runtime and, for AI pages, sent to the AI provider you connected with your own key, or processed by Atlassian AI (Advanced edition). Transfers to an AI provider outside the EEA are made on your instruction and under the agreement you hold with that provider; for Atlassian AI, Atlassian's agreement applies (see section 2). We have no servers of our own; our only sub-processor is Atlassian, which hosts the App on Forge under Atlassian's Forge Data Processing Addendum (with Standard Contractual Clauses for transfers outside the EEA). Review your provider's data processing terms before you process code that contains personal data.

For a request about the stored account IDs, an admin can clear the run history, remove sync blocks, or contact us; after an uninstall, Atlassian deletes all App data 28 days later (section 8).

If you have any GDPR-related concerns, please contact us at the email address below.

10. Security

The App follows Atlassian Forge security best practices:

• Runs in a sandboxed Forge environment with restricted network access (only the domains listed in the App's manifest and own Git servers a site admin approved).
• API keys and access tokens are stored in Atlassian Forge encrypted storage.
• All external data transfers use TLS encryption.
• No credentials are logged, exposed in error messages, or transmitted to us.
• The App uses only the Confluence scopes it needs: storage:app, read:space:confluence, search:confluence, read:page:confluence, write:page:confluence, delete:page:confluence, read:confluence-user and read:confluence-groups.

For comprehensive details, see our Security Statement.

11. Children's Privacy

The App is a business productivity tool and is not directed at children under 16. We do not knowingly collect data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected in the "Last updated" date above. Continued use of the App after changes constitutes acceptance of the updated policy.