keelapps/AccessLens for Confluence/Privacy policy
Privacy policy — AccessLens for Confluence
The short version
AccessLens for Confluence (“AccessLens”, “the app”) is published by Keelapps. It is read-only: it declares no write scope of any kind and cannot change a permission, a restriction, a page or a comment. Everything it stores lives in Atlassian-hosted Forge storage inside your own Atlassian site. The app declares no external network permissions, which Atlassian enforces at the platform level, so there is no Keelapps server, no analytics, no telemetry and no third party. Its AI tools are off by default; if your admins turn them on, the answers a listed person asks for go to the AI that person uses.
What the app reads
AccessLens's entire function is to read the permission state of your site and present it back to you. It reads:
- Spaces — id, key, name, type and status.
- Space permissions — which principal (user, group or access class) holds which operation on which space, and, on sites using role-based space permissions, the role assignments that carry the same information.
- Pages — id, title and parent id (and, when the parent is not a page, what kind of content it is, such as a folder), so restricted pages can be named and their inheritance chain walked. Page content is never read. Only pages are listed — not blog posts, folders, whiteboards or databases.
- Page restrictions — which users and groups a page's view or edit is restricted to.
- Groups and their members — group id, group name, and the account ids and display names of members, so a group-level answer can be turned into a person-level one.
What the app stores
All data lives in Atlassian-hosted Forge storage inside your own Atlassian site. The app has no servers of its own and makes no calls to any external service.
| Data | What it contains | Why |
|---|---|---|
| Snapshots | who started the snapshot, and who cancelled it if anyone did (account ids); for each space, its identifiers and its permission grants, including the account ids and display names of users granted access directly; for each restricted page, its id, title, parent id and the users (account id and display name) and groups named in its restrictions; the ids and titles of unrestricted pages hidden under a restricted page; for each group named in a grant or only in a page restriction, its name and the account ids and display names of its members; for a space that could not be scanned, the reason (a request path and status, never a query string); and, where someone used "Confirm coverage", the page counts and that person's display name, with the date | a point-in-time record is what makes an access review evidence rather than an opinion |
| Access reviews | the review's title, the snapshot it is pinned to, the account id of whoever created it, and for each space the decision, any free-text note, the deciding account id and a server-side UTC timestamp, with every decision ever recorded kept; at sign-off, a copy of the review's rows carrying each decision with the decider's display name and account id, and the signer's display name and account id; and, if the review's snapshot is deleted later, the account id of whoever deleted it | a sign-off has to name who signed and when |
| Settings | scan cadence, shard size, page-restriction mode and budget, the snapshot retention limit, the outcome of the last scheduled run, and whether the site's subscription was active the last time the app was opened | so a large site can be scanned within a budget you chose |
| AI tools list | only if a site admin uses it: whether AI tools are on, the account ids of the people allowed to use them, who added each person and when, and the account id of whoever last turned AI tools on or off, with the time; no display names are stored for this list | so only the people an admin chose can ask the AI tools |
Display names are stored at the moment they are read — at scan, at sign-off or at confirmation — so a record reads the same after an account is renamed or removed; the account id stored beside each name remains the identity.
Personal data stored: Atlassian account ids, display names, and whatever reviewers type into notes. No email addresses, no page content, no attachments.
What the app writes to Confluence
Nothing. AccessLens declares no write scopes at all. It cannot change a permission, a restriction, a page or a comment even if it were asked to.
AI tools (off by default)
AccessLens offers three read-only tools to AI agents through Atlassian's Forge MCP support: which spaces are open to everyone, who can access a space, and which spaces a group can reach. They are off until a Confluence site admin turns them on in the app's settings, and then they answer only the people that admin has listed. Anyone else, and any agent acting for someone else, gets a refusal.
The tools read the latest completed snapshot already stored by the app. They do not read anything new from Confluence and do not change anything.
When a listed person asks, the answer goes to the AI that person uses:
- Rovo agents run inside Atlassian Cloud.
- External AI clients (such as Claude or Cursor) can reach the tools only after an organization admin turns on external access for the app in Atlassian Administration, and the person connects the client with their own Atlassian sign-in. The answers that person asks for are then delivered to that client and handled under the client provider's terms. Atlassian marks this capability as early access.
The app itself still makes no external calls; Atlassian delivers the answers. Turning AI tools off, or removing a person from the list, stops further answers immediately.
What the app never does
- The app makes no external calls. There are no analytics, no telemetry, and no third-party services, and the app declares no external permissions, which Forge enforces at the platform level. The only way data reaches anything outside your site is the AI tools above, if your admins turn them on, or a CSV that someone exports.
- CSV exports are assembled in your own browser from data delivered over the Forge bridge. They never pass through any server.
- Keelapps runs no servers and cannot browse the data the app stores: Forge storage is reachable only by the app itself, running inside Atlassian's infrastructure.
- Keelapps can see the app's Forge logs. Forge shares an app's logs with its developer by default when the app is installed; a site admin can switch this off under Atlassian Administration → Connected apps → the app → Logs access. The logs contain snapshot ids, space keys, space, page and group ids, request paths without their query strings, HTTP status codes, counts, progress and error reasons. They never contain account ids, display names, page titles, review notes or permission content.
Retention and deletion
Snapshots and reviews persist in Forge storage for as long as the app is installed, or until an administrator deletes them from the app's own interface. AccessLens deliberately never deletes a snapshot automatically — at the retention limit it refuses to take a new one rather than evicting an old one, because an audit record destroyed without being asked for is worse than a refused scan.
A signed-off review cannot be deleted from the app at all. If the site's subscription lapses, the app becomes read-only: existing snapshots and reviews stay readable and exportable, and nothing new is collected.
After the app is uninstalled, Atlassian keeps its storage for 28 days and then deletes it — signed-off reviews included. Export the CSVs you need first.
Data residency
Because everything is stored in Forge hosted storage, data residency follows your Atlassian site's data residency configuration automatically. Answers delivered to an external AI client through the AI tools are held wherever that client keeps them.
Sub-processors
None. Atlassian hosts everything, including Rovo. An external AI client connected through the AI tools is chosen and authorised by your organization, not by Keelapps.
Changes
Material changes to what is read, stored or where will be reflected here and in the Marketplace listing before they ship.
Contact
support@keelapps.atlassian.net — for questions about this policy, and for data access, correction or deletion requests.