Privacy Policy

Velocity Chart for Jira · Last updated: October 12, 2026

1. Introduction

This Privacy Policy explains how Velocity Chart for Jira ("the App"), developed by Janek Behrens ("we", "us", "our"), handles data when installed on your Atlassian Jira Cloud instance. The App is a read-only reporting tool: it reads agile data to draw a sprint velocity chart and never modifies your issues.

2. Data We Access

The App reads the following Jira data, on demand, solely to compute the velocity chart:

• Boards & board configuration: Scrum board names, project, the board's estimation field, column-to-status mapping and the statuses of the board's project — used to list boards, provide sensible defaults and name statuses.
• Sprints: Closed sprint names, start and complete dates — used to define the chart's time axis.
• Issue data of sprint members: Issue ID and key, status, issue type, creation time and the chosen estimation field value (Story Points or a numeric custom field) — used to compute committed and completed work per sprint.
• Sprint, status and estimate change history: The Jira changelog of the Sprint field, the status and the estimation field for those issues — used to reconstruct which issues were in the sprint at its start ("committed"), which were done when it closed ("completed") and which estimates they had at the start and at the close.
• Your permissions: On every load the App asks Jira which of these issues you may browse (the project permission and the issue's security level). Only those issues are counted and listed for you. The answer is used for that load only and never stored. To tell you when issues are hidden from the App by an issue security level, the App also runs a Jira search over the sprints shown as you and, if needed, as the App (issue IDs and issue type only); it keeps only the resulting number for that load and shows it to you. Nothing of it is stored.
• Issue titles (sprint details, Pro): When you open the details of a sprint, the App reads the key and title of its issues as you, so Jira returns only issues you can open, and shows them in the list. Titles are never stored.

The App does not read or use assignee, reporter, or any other user/personal fields. Velocity is reported only at the team/board level — never per individual.

3. Data We Store

The App stores only the following, using Atlassian Forge Storage (KVS), which is hosted and managed by Atlassian within your cloud instance:

• Sprint data cache: Per board and configuration, for each sprint shown its ID, name, start and completion dates, and for each issue of the sprint its ID, key and estimates at the start and at the close, whether it was in the sprint at the start, whether it was already done when it joined and whether it was done when the sprint closed, and the IDs and names of its status at the close and now. No titles and no people. Used for 5 minutes (1 minute if the sprint history could not be read completely) to reduce API calls, then recomputed on demand. Before anything is shown, it is filtered by the permissions of the person viewing the chart.
• Board-to-project map: The ID of each Scrum board's project, used for the permission check. Refreshed after 10 minutes.
• Discovery cache: The numeric fields that can serve as estimation fields (IDs and names) and the IDs of the Story Points and Sprint fields, to render the configuration form. Refreshed after 24 hours.
• First chart: The date the first chart with data was drawn on your site.
• Anonymous daily usage counters: Per day, how often features were used (for example "a chart was loaded"). No IDs, names or content.

We do not store issue titles, descriptions, comments, attachments, user names, emails, account IDs, or any other free-text content. Stored data consists of numbers (estimates, dates, counts), issue IDs and keys, sprint, board, project, field and status identifiers, sprint names, and the names of statuses and numeric fields. Sprint and status names are kept as your team wrote them.

Gadget configuration (selected board(s), number of sprints, estimation mode, Definition of Done, label style) is stored by Jira as standard dashboard-gadget configuration.

4. Data We Do NOT Collect

• We do not run any servers. There is no developer-operated backend or database.
• We do not collect personally identifiable information (PII). The App does not read assignee or user fields.
• We do not use cookies, tracking pixels, analytics platforms, or advertising networks.
• We do not send any data to external services. The App makes no network calls outside the Atlassian platform.

Technical logs and usage counts: Like most Forge apps, the App writes technical log lines (for example "a chart was loaded" or "Jira did not answer") and, once a day, the anonymous usage counters to Atlassian's app logging, which Atlassian makes available to us as the app vendor. Log lines may contain numeric board IDs from your site, as well as counts, modes, HTTP statuses and error codes, but never board, sprint or issue names, names of people, email addresses, account IDs or JQL. We use them only to find errors and to see which features are used.

5. Data Processing Location and Data Residency

All processing occurs within the Atlassian Forge runtime environment under the Runs on Atlassian program. No data is transmitted to servers operated by us or any third party outside the Atlassian platform.

Everything listed in section 3 is stored in Forge hosted storage, which supports Atlassian's data residency: it is held in the same location as your Jira site and moves with it when an admin moves the site's data to another location. Not in scope: Jira data the App reads without storing it, the gadget and widget settings (stored by Jira under Jira's own data residency), and the technical logs in section 4, which are handled by Atlassian's app logging.

6. Data Retention

• The caches live in Forge Storage and are replaced when they are computed again (the sprint data after 5 minutes, the board map after 10 minutes, the discovery cache after 24 hours). Each sprint data entry also expires one hour after it was written; Forge deletes expired entries within 48 hours. Result caches written by versions up to October 2026 (sprint totals) are deleted by the App automatically.
• The usage counter records expire after eight days. The date of the first chart is kept while the App is installed.
• After you uninstall the App, Atlassian keeps the App's storage for 28 days and then deletes it (Forge documentation: data recovery for apps with hosted storage). During that time the App cannot read it. Within 21 days of the uninstall, you can ask us to have Atlassian restore it to a new installation of the App.
• Gadget configuration is removed when the gadget is removed or the App is uninstalled.

7. GDPR Compliance

The App does not collect or store personal data. It does not read assignee or user information. Stored data is limited to numbers, identifiers (including issue IDs and keys), and the sprint, status and field names listed in section 3. GDPR data-subject requests relating to data held by Jira itself should be directed to Atlassian. For App-specific concerns, contact us below. After you uninstall the App, Atlassian deletes all App-related data from Forge Storage after 28 days (section 6).

8. Security

• Runs in a sandboxed Forge environment with no egress to external networks outside the Atlassian platform.
• Uses minimal, read-only Jira API scopes (boards, sprints, issues, fields, changelog) plus app storage.
• Shows each person only the issues they can open in Jira: their permission is checked issue by issue on every load and never stored.
• Stores no credentials, tokens, or secrets — there are none.

See our Security Policy for full details.

9. Children's Privacy

The App is a business productivity tool and is not directed at children under 16. We do not knowingly collect data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected in the "Last updated" date above. Continued use of the App after changes constitutes acceptance of the updated policy.