keelapps/Evergreen/Privacy policy
Privacy policy — Evergreen for Confluence
The short version
Evergreen does not send your data anywhere. It runs entirely on Atlassian Forge, inside Atlassian's infrastructure. There is no external server, no analytics service, no email, and no third party. The app declares no external permissions, which Atlassian enforces at the platform level — it cannot make an outbound call even if it tried to.
What the app stores
Two places, both inside your Atlassian site.
On each page, as a content property named evergreen:
| Field | Example | Why |
|---|---|---|
lastConfirmedAt |
2026-06-01T09:12:00Z |
when someone last confirmed the page |
confirmedBy |
Atlassian account ID | who confirmed it |
confirmedByName |
display name | so the byline stays readable if that account is later deactivated |
overrideThreshold |
{agingAfterDays, staleAfterDays} |
per-page threshold, if set |
exempt |
true |
if the page is excluded from tracking |
In Forge storage, per space: an index of the pages the app can see, holding page ID, title, last-edited timestamp, last-confirmed timestamp, the confirming user's account ID and display name, the page owner's account ID and display name, and the computed status. Plus threshold settings, the list of pages needing attention, and any review assignments — each holding the assignee's account ID and display name, when the assignment was made, and the account ID of whoever made it.
Page content is never read into storage. The app reads page metadata — title, timestamps, labels, author — and never the body.
Personal data
Atlassian account IDs and display names, for four roles: who confirmed a page, who owns a page, who is assigned to review one, and who made each assignment. Nothing else. No email addresses, no IP addresses, no usage analytics, no behavioural tracking.
Display names are stored alongside account IDs deliberately, so that a confirmation made by someone who has since left still reads sensibly rather than showing a bare ID or an error.
Who can see it
Only users of your Confluence site, subject to Confluence's own permissions. The space dashboard sits in space settings, which Confluence restricts to space administrators.
The app reads Confluence as the app, not as you. Pages restricted away from the app are invisible to it — they are excluded from all counts, and the dashboard states how many such pages it found rather than quietly omitting them.
Retention and deletion
- Page confirmation data is a content property, so it follows the page: delete the page and it goes with it.
- Space-level data is in Forge storage and is removed when the app is uninstalled, per Atlassian's data retention for Forge apps.
-
To remove one page's data without uninstalling, use
Exclude from tracking on the page byline, or delete the
evergreencontent property directly via the Confluence REST API.
Sub-processors
None. Atlassian hosts everything; there is no other party involved.
Data residency
Whatever your Atlassian site's residency is. Evergreen adds no storage outside Forge and therefore introduces no additional residency considerations.
Changes
Material changes to what is stored or where will be reflected here and in the Marketplace listing before they ship.
Contact
support@keelapps.atlassian.net — for questions about this policy, and for data access, correction or deletion requests.