keelapps/AccessLens for Confluence/Privacy policy
Privacy policy — AccessLens for Confluence
The short version
AccessLens for Confluence (“AccessLens”, “the app”) is published by Keelapps. It is read-only: it declares no write scope of any kind and cannot change a permission, a restriction, a page or a comment. Everything it stores lives in Atlassian-hosted Forge storage inside your own Atlassian site. The app declares no external network permissions, which Atlassian enforces at the platform level, so there is no Keelapps server, no analytics, no telemetry and no third party.
What the app reads
AccessLens's entire function is to read the permission state of your site and present it back to you. It reads:
- Spaces — id, key, name, type and status.
- Space permissions — which principal (user, group or access class) holds which operation on which space, and, on sites using role-based space permissions, the role assignments that carry the same information.
- Pages — id, title and parent id (and, when the parent is not a page, what kind of content it is, such as a folder), so restricted pages can be named and their inheritance chain walked. Page content is never read. Only pages are listed — not blog posts, folders, whiteboards or databases.
- Page restrictions — which users and groups a page's view or edit is restricted to.
- Groups and their members — group id, group name, and the account ids and display names of members, so a group-level answer can be turned into a person-level one.
What the app stores
All data lives in Atlassian-hosted Forge storage inside your own Atlassian site. The app has no servers of its own and makes no calls to any external service.
| Data | What it contains | Why |
|---|---|---|
| Snapshots | who started the snapshot, and who cancelled it if anyone did (account ids); for each space, its identifiers and its permission grants, including the account ids and display names of users granted access directly; for each restricted page, its id, title, parent id and the users (account id and display name) and groups named in its restrictions; the ids and titles of unrestricted pages hidden under a restricted page; for each group named in a grant or only in a page restriction, its name and the account ids and display names of its members; for a space that could not be scanned, the reason (a request path and status, never a query string); and, where someone used "Confirm coverage", the page counts and that person's display name, with the date | a point-in-time record is what makes an access review evidence rather than an opinion |
| Access reviews | the review's title, the snapshot it is pinned to, the account id of whoever created it, and for each space the decision, any free-text note, the deciding account id and a server-side UTC timestamp, with every decision ever recorded kept; at sign-off, a copy of the review's rows carrying each decision with the decider's display name and account id, and the signer's display name and account id; and, if the review's snapshot is deleted later, the account id of whoever deleted it | a sign-off has to name who signed and when |
| Settings | scan cadence, shard size, page-restriction mode and budget, the snapshot retention limit, the outcome of the last scheduled run, and whether the site's subscription was active the last time the app was opened | so a large site can be scanned within a budget you chose |
Display names are stored at the moment they are read — at scan, at sign-off or at confirmation — so a record reads the same after an account is renamed or removed; the account id stored beside each name remains the identity.
Personal data stored: Atlassian account ids, display names, and whatever reviewers type into notes. No email addresses, no page content, no attachments.
What the app writes to Confluence
Nothing. AccessLens declares no write scopes at all. It cannot change a permission, a restriction, a page or a comment even if it were asked to.
What the app never does
- No data leaves your Atlassian site. There are no external calls, no analytics, no telemetry, and no third-party services. The app declares no external permissions, which Forge enforces at the platform level.
- CSV exports are assembled in your own browser from data delivered over the Forge bridge. They never pass through any server.
- Keelapps runs no servers and cannot browse the data the app stores: Forge storage is reachable only by the app itself, running inside Atlassian's infrastructure.
- Keelapps can see the app's Forge logs. Forge shares an app's logs with its developer by default when the app is installed; a site admin can switch this off under Atlassian Administration → Connected apps → the app → Logs access. The logs contain snapshot ids, space keys, space, page and group ids, request paths without their query strings, HTTP status codes, counts, progress and error reasons. They never contain account ids, display names, page titles, review notes or permission content.
Retention and deletion
Snapshots and reviews persist in Forge storage for as long as the app is installed, or until an administrator deletes them from the app's own interface. AccessLens deliberately never deletes a snapshot automatically — at the retention limit it refuses to take a new one rather than evicting an old one, because an audit record destroyed without being asked for is worse than a refused scan.
A signed-off review cannot be deleted from the app at all. If the site's subscription lapses, the app becomes read-only: existing snapshots and reviews stay readable and exportable, and nothing new is collected.
After the app is uninstalled, Atlassian keeps its storage for 28 days and then deletes it — signed-off reviews included. Export the CSVs you need first.
Data residency
Because everything is stored in Forge hosted storage, data residency follows your Atlassian site's data residency configuration automatically.
Sub-processors
None. Atlassian hosts everything; there is no other party involved.
Changes
Material changes to what is read, stored or where will be reflected here and in the Marketplace listing before they ship.
Contact
support@keelapps.atlassian.net — for questions about this policy, and for data access, correction or deletion requests.