PULSE PULSE privacy policy
Applies to: the PULSE app for Confluence and Jira Cloud (distributed by installation link; see D-029) · Version: 1.0.0 · Effective: 2026-09-21 · Publisher: Jonathan Carreiro ("we")
This policy states what PULSE does with data. It is written from the app's data inventory (docs/privacy.md), which is checked against the code on every build, so what is written here is what the app does — not what it might do.
1. What PULSE is
PULSE adds macros to Confluence pages that show delivery dashboards computed from your Jira Software data: sprint progress, velocity, cycle time, blockers, risks, dependencies, backlog hygiene, retrospective facts, status updates and forecasts. It is built on Atlassian Forge and runs entirely on Atlassian's infrastructure.
2. Data PULSE reads
PULSE reads from Jira, as the person viewing the page, using read-only permissions:
- project key and name, board id and name, sprint id, name, dates and goal;
- issue fields: summary, status, issue type, priority, assignee, created, updated, due date, resolution date, resolution, fix versions, components, labels, issue links, parent, the sprint field, the story point field and the flagged field;
- issue change history, reduced to status and sprint transitions and their times;
- versions (name, dates, released flag); and the site's lists of fields, statuses, priorities, issue types, components and labels, used only to build the configuration screen.
PULSE does not read issue descriptions, comments, attachments, worklogs, watchers, reporters or creators, and it never sees a password, API token or credential: sign-in is handled by Atlassian. Because every request is made as the viewer, PULSE cannot show anyone a Jira issue they could not already open in Jira.
3. Personal data
The only personal data PULSE handles is the assignee's display name (and avatar, for display only) on the issues it reads, shown exactly as Jira shows it to the same viewer, and the viewer's own Atlassian account id, used solely to keep that viewer's cache private to them. PULSE computes no per-person metric, score or ranking; the product forbids it by test.
4. Where data goes
Nowhere outside Atlassian. PULSE declares no external network access (permissions.external is empty in its manifest and the built code is scanned for external hosts). There is no analytics service, error tracker, CDN or third-party processor. We, the publisher, never receive your Jira or Confluence data.
5. What PULSE stores, and for how long
- Macro configuration (project, board, sprint, thresholds and settings you choose) is stored in the Confluence page itself as macro parameters and follows the page's own lifecycle and version history.
- A per-viewer cache of the computed dashboard (the numbers, and the key, summary, status, priority, dates, points, assignee name and link of the issues in it) is stored in Forge app storage on your Confluence site, keyed to that viewer, so that a page reload within the configured refresh window does not re-query Jira. It is kept for the macro's refresh window (15 minutes to daily; "manual" refresh is capped at 1 day) plus up to 48 hours for the platform to delete it — never more than 3 days. An entry older than its window is never shown.
PULSE stores nothing in Jira and nothing outside Atlassian.
6. Data residency
All PULSE storage is on the Confluence side, and Confluence is the app's governing product: storage follows your Confluence site's pinned data residency location. PULSE is eligible for Atlassian's Runs on Atlassian program.
7. Deletion
Uninstalling PULSE from a site removes all of its storage for that site. Deleting a page or removing a macro removes its configuration with the page (subject to Confluence's trash and version retention); cached dashboards expire on their own within the window above. Reinstalling the app clears every cache immediately. There is not yet an in-app purge control for administrators; this is a known gap, stated rather than hidden.
8. Logging
Operational logs contain a correlation id, an HTTP status, an attempt number and a request path — never a response body, a header, an issue field, a person's name or a token. When something fails, the macro shows the correlation id so support can find the event without either side sharing data.
9. Security
PULSE holds no write permission on Jira or Confluence, no asApp access, and no credentials. Its permission set is 28 granular read-only Jira scopes plus app storage, each proven necessary by an automated audit. See the security self-assessment for the evidence.
10. Changes and contact
We update this policy whenever the app's data handling changes; the version above tracks the app version. Questions: joncarreiro@gmail.com · https://pulse-delivery.pages.dev/support.