keelapps/Evergreen/Privacy policy
Privacy policy — Evergreen for Confluence
The short version
Evergreen does not send your data anywhere. It runs entirely on Atlassian Forge, inside Atlassian's infrastructure. There is no external server, no analytics service, no email, and no third party. The app declares no external permissions, which Atlassian enforces at the platform level — it cannot make an outbound call even if it tried to.
What the app stores
Two places, both inside your Atlassian site.
On each page, as a content property named evergreen:
| Field | Example | Why |
|---|---|---|
lastConfirmedAt |
2026-06-01T09:12:00Z |
when someone last confirmed the page |
confirmedBy |
Atlassian account ID | who confirmed it |
confirmedByName |
display name | so the byline stays readable if that account is later deactivated |
overrideThreshold |
{agingAfterDays, staleAfterDays} |
per-page threshold, if set |
exempt |
true |
if the page is excluded from tracking |
exemptBy, exemptByName, exemptAt |
account ID, display name, time | who excluded the page and when, cleared when it is included again |
In Forge storage, per space: an index of the pages the app can see, holding page ID, title, last-edited timestamp, last-confirmed timestamp, the confirming user's account ID and display name, the page owner's account ID and display name, and the computed status. Plus threshold settings, the list of pages needing attention, and any review assignments — each holding the assignee's account ID and display name, when the assignment was made, and the account ID of whoever made it. For each page someone confirmed, excluded or gave its own thresholds through Evergreen, a small record repeats those fields (including the confirming user's account ID and display name), so the dashboard keeps them while the index is rebuilt.
Page content is never read into storage. The app reads page metadata — title, timestamps, labels, author — and never the body.
Personal data
Atlassian account IDs and display names, for five roles: who confirmed a page, who excluded a page from tracking, who owns a page, who is assigned to review one, and who made each assignment. Nothing else. No email addresses, no IP addresses, no usage analytics, no behavioural tracking.
Display names are stored alongside account IDs deliberately, so that a confirmation made by someone who has since left still reads sensibly rather than showing a bare ID or an error.
Who can see it
Only users of your Confluence site, subject to Confluence's own permissions. The space dashboard sits in space settings, which Confluence restricts to space administrators.
The app reads Confluence as the app, not as you. Pages restricted away from the app are invisible to it and left out of every count. Confluence answers the app the same way for a restricted page as for a deleted one, so the dashboard cannot say how many there are; on such a page, the byline says that Evergreen can't read it.
Anyone who can read a page can mark it fresh. Excluding a page from tracking, or giving it its own thresholds, is limited to people who can edit that page: Evergreen asks Confluence, as you, before it writes.
Retention and deletion
- Page confirmation data is a content property, so it follows the page: delete the page and it goes with it.
- Space-level data is in Forge storage and is removed when the app is uninstalled, per Atlassian's data retention for Forge apps.
-
To remove one page's data without uninstalling, delete the
evergreencontent property via the Confluence REST API. Exclude from tracking stops the page being counted but keeps its record, and adds who excluded it.
Sub-processors
None. Atlassian hosts everything; there is no other party involved.
Data residency
Whatever your Atlassian site's residency is. Evergreen adds no storage outside Forge and therefore introduces no additional residency considerations.
Changes
Material changes to what is stored or where will be reflected here and in the Marketplace listing before they ship.
Contact
support@keelapps.atlassian.net — for questions about this policy, and for data access, correction or deletion requests.