Privacy policy

• We operate no servers. Every AryonForge app runs as Atlassian Forge functions inside Atlassian's own infrastructure. There is no AryonForge server, database, CDN or log aggregator anywhere in the architecture.
• We cannot see your data. App data is held in Atlassian's Forge storage inside your site's tenancy. As the vendor we have no standing access to it, no administrative console that reads it, and no export mechanism.
• No analytics, no tracking, no advertising. The apps contain no analytics SDK, no telemetry endpoint and no third-party script. Customer content is never sold, rented, mined for advertising, or used to build profiles.
• Personal data is minimal and mostly identifiers. Where an app records who did something, it stores the Atlassian account ID — an opaque identifier — not a name, email address or IP address.
• Uninstalling deletes it. Forge storage is removed by Atlassian when an app is uninstalled from a site.

For data processed inside an Atlassian app installation, you — the Atlassian site's organisation — are the data controller. AryonForge acts as a processor, and processes data only as instructed by the app's configured behaviour.

Atlassian is a sub-processor: the app's compute and storage are Atlassian's Forge platform, and data residency follows the region Atlassian hosts your site in. Atlassian's own privacy commitments apply to that infrastructure.

For this website, AryonForge is the controller. See This website below — it collects nothing.

The exact record is published per app, in the Data stored section of that app's page, including the storage key layout and the retention cap. Nothing is stored that is not listed there.

Across the portfolio, the categories are:

• Atlassian account IDs — an opaque identifier such as 5b10a2844c20165700ede21g. Used to record who performed or was affected by an action, and to render the correct user in the interface. It is not a name, email address or username, and it is meaningless outside your Atlassian site.
• Content identifiers and metadata — issue, page, project and space IDs and keys, file names, byte counts, timestamps.
• Configuration you enter — the rules, thresholds and exemptions an administrator sets.
• Audit records — where an app can change access or delete content, it records what it did and why, so the action is reviewable and, where possible, reversible.

Some of these fields are user-controlled text. A file name or a page title could incidentally contain personal information if someone chose to put it there. The apps do not parse, inspect or act on such content beyond the matching each app documents.

• Email addresses, real names, usernames or profile data
• IP addresses
• Passwords, API tokens, OAuth tokens or credentials of any kind — the apps authenticate through Forge's built-in app and user identity and hold no secrets of their own
• Payment or billing details — these are handled entirely by Atlassian and never reach the app
• Behavioural, usage or product analytics
• Anything at all from users who never interact with the app

Entirely within Atlassian Forge storage, in the region Atlassian hosts your site in. The data never leaves Atlassian infrastructure, because there is nowhere else for it to go: the apps declare no external egress in their manifests, which is verifiable in the permissions block published on each app's page.

Where an app does make an outbound call — for example to an Atlassian Organization API, or to a paired Atlassian site's web trigger — it is named explicitly in that app's manifest and explained in the External access section of its page. There are no undeclared destinations.

• Configuration is kept while the app is installed.
• Audit and log records are capped per app and self-pruning: each write deletes the oldest overflow, so old data is discarded automatically rather than accumulating. The exact cap is on each app's page.
• Uninstalling the app removes its Forge storage, per Atlassian's platform lifecycle. AryonForge holds no separate copy to delete, because no copy is ever made.

To delete data sooner, uninstall the app or clear the relevant configuration in the app's own interface.

Because the data lives in your Atlassian site and we hold no copy, requests under the GDPR, UK GDPR, CCPA or comparable law are answered in the first instance by your own Atlassian administrators, who have direct access to it through the app's interface and through Atlassian's own tooling.

If you need help locating or interpreting what an app has stored, email support@aryonforge.com and we will help you find it. We cannot retrieve, export or delete it on your behalf — we have no access path to your site's data.

One, and only one:

• Atlassian Corporation — hosts the Forge runtime and the Forge storage every app uses, and operates the Marketplace through which the apps are distributed and licensed.

There is no hosting provider, no managed database, no error-tracking service, no analytics vendor and no email or CRM platform in the path of any app's data. Where this changes, this page is updated before the change ships.

Encryption in transit and at rest is provided by the Atlassian Forge platform; the apps implement no cryptography of their own and manage no keys or certificates.

Each app's page publishes its authorization model, its injection and evasion resistance, its dependency posture, and the findings from its pre-release review rounds — including the ones that were fixed, with reproduction steps. Findings are published rather than buried.

To report a suspected vulnerability, email aryonforge@outlook.com. We aim to acknowledge within 2 business days and to ship a fix or mitigation within 30 days for a confirmed high-severity issue. Please do not open a public issue before a report has been triaged.

Paid apps are sold through the Atlassian Marketplace. Atlassian handles the transaction end to end: purchasing, invoicing, tax and payment details are collected and processed by Atlassian, not by AryonForge, and no payment information ever reaches an app or this website.

What an app receives from the platform is the licensing state of the site — whether the subscription is active, whether it is a trial, and when it ends. That is what an app uses to decide whether its paid functionality is available. It contains no personal data.

As a Marketplace Partner, AryonForge receives standard transaction reporting from Atlassian, which identifies purchasing organisations and their billing contacts. That is Atlassian's disclosure to us as a seller, and is used only to provide support and meet accounting obligations.

aryonforge.com is a static site served by GitHub Pages. It sets no cookies, embeds no analytics, no tracking pixels and no advertising, and asks for no personal information. There is no account, no form and no newsletter.

It loads web fonts from Google Fonts, which means your browser makes a request to that service when you view a page. Your browser's own theme preference is stored in localStorage on your device and is never transmitted anywhere.

GitHub, as the host, may process request logs including IP addresses for the purpose of serving and protecting the site; that processing is GitHub's, under GitHub's privacy statement, and AryonForge does not receive or read those logs.

The date at the top of this page is the last substantive revision. Material changes — a new sub-processor, a new category of data, a new destination for it — are made here before the change ships in an app, not after.