keelapps/Satchel for Confluence/Privacy policy
Privacy policy — Satchel for Confluence
The short version
Satchel for Confluence (“Satchel”, “the app”) is published by Keelapps. Satchel runs entirely inside Atlassian's infrastructure. It makes no external network calls, and it stores nothing outside Forge hosted storage on your own site. Keelapps cannot read what Satchel stores: there is no Keelapps server for your data to reach. The one thing Keelapps can see, while your administrators allow it, is the app's Forge logs — see Logs for what they hold.
Attachment contents are never stored by Satchel at all. When you download an archive, the files travel from Confluence to your browser, are assembled into a zip in that browser tab, and are saved to your disk. Nothing is buffered, cached or retained in between.
What Satchel stores, and where
Everything below lives in Forge hosted storage, which is Atlassian infrastructure attached to your own Confluence site. Atlassian's data-residency options apply to it.
| Data | Why | Kept until |
|---|---|---|
| For each attachment on a page in a scanned space: id, file name, size, media type, version count, upload timestamp, uploader account id, status, whether its own page embeds or links it, and its Confluence web link | The space inventory that makes a cross-page view possible | The next scan replaces it |
| For each page in a scanned space: id, title, status | So the inventory can say which page a file is on | The next scan replaces it |
| For each scanned space: counts, timestamps, the account id of whoever started the last scan, up to 20 ids of pages Confluence would not list | The space page's summary | The next scan replaces it |
| Scan progress while a scan runs: counts and where it is up to | So a scan survives several runs and can be resumed | The scan ends |
| Site and per-space settings | Configuration | Changed or uninstalled |
| Bulk job records: kind, space, the starter's account id, counts, the target page's id and title, and up to 100 per-file problems (file name, attachment and page ids, reason) | So a job survives a closed tab and can be reported honestly | 30 days after the job ends |
| Bulk job plans: each selected file's id, name, size, media type, status, page id and title | What a running job works through | The job ends |
| While a job runs: a random id for the browser tab driving it, and a stop request if one was made | So two tabs never run one job | The job ends |
| Per space: the running jobs and their starters' account ids | So a job whose tab closed can be resumed | The job ends |
| Undo journals: for each file a move touched, its old and new attachment ids, name, size, media type, and source and target page ids and titles; with when, where and the mover's account id | So a move can be reversed | The undo runs, or 30 days after the move |
| Per space: the moves on offer for undo, with the mover's account id | The undo list | As the journal |
| What Satchel moved, trashed or purged since the last scan: attachment ids and target page ids and titles | So the space page shows Satchel's own changes at once | The next scan |
| An audit trail of moves and deletions: timestamp, action, the actor's account id, file name and size, attachment ids, source and target page ids and titles, outcome | Because moving and deleting change people's files, and an administrator is owed a record | The 2,000 most recent events are kept |
| For ten minutes per person: which of a space's pages they can open, and whether they administer the space, with their account id | So Confluence is not asked the same question on every click | Deleted within the hour after it lapses |
| How this site moves attachments (re-parent or copy), and when that was measured | So a move says which route it will take | Uninstalled |
| An hourly count of API points this site has spent | Rate-limit self-throttling | Two hours |
Audit events recorded before 2.8.0 also hold the actor's display name, and inventory rows scanned before 2.8.0 hold the attachment's v2 download link until the next scan. Since 2.8.0 display names are looked up when they are shown and are not stored.
Not stored: attachment file contents, page body text (page bodies are read during a scan to find which files a page embeds or links, and are discarded immediately — only a true-or-false flag per attachment is kept), passwords, tokens, or anything about users beyond their Atlassian account ids.
Retention
- The inventory is replaced wholesale by each rescan.
- Everything with a "kept until" above is deleted on that schedule by the app itself, by an hourly sweep. The audit trail keeps its 2,000 most recent events; older events are deleted. If you need a longer record, export it as CSV — the button is in Confluence administration and on each space page.
- Undo journals are deleted 30 days after the move they describe, whether or not anybody used them.
- When the app is uninstalled, Atlassian keeps its Forge storage for 28 days — under Atlassian's hosted-storage data lifecycle a reinstall can be relinked to it if that is requested within 21 days — and then deletes it. Keelapps has no copy to delete, because Keelapps never had one.
Who can see what
| Space member | Space administrator | Site administrator | |
|---|---|---|---|
| The space's files, reports and uploader ranking | Files on pages they can open | Files on pages they can open | As a member of the space |
| The space's settings | Read-only | Can change them | Sets the site-wide defaults |
| The space's Activity tab and its CSV | Moves and deletions of files on pages they can open | Every move and deletion in the space | — |
| Undo, stop or confirm a job | Their own | Anybody's in the space | — |
| Cross-space totals, the full audit trail, the site settings | No | No | Yes, in Confluence administration |
- By default the space page hides rows whose page the viewer cannot open: Satchel checks with Confluence, as that person, which pages they can open before any row leaves the server, and remembers the answer for ten minutes. A site administrator can switch this off.
- Aggregate totals on a space page (file count, total size) cover the whole space and are labelled as such, next to a count of how many rows are hidden from the current viewer.
- Whether someone administers a space, or Confluence, is asked of Confluence as that person; nothing is taken on trust from the browser.
- Every download, move and delete is performed as the signed-in user, so Confluence's own permissions decide what actually happens regardless of what the index shows.
Logs
Atlassian keeps logs of the app's function runs and, by default, makes them available to Keelapps, the developer. A site administrator can download them, or switch Keelapps' access off, in Atlassian Administration → Connected apps → Satchel.
Satchel writes little to them: space keys, job references, counts of what a scan or sweep did, and the status codes Confluence answered with when something failed. An unexpected error is logged with where in the code it happened, which can include one of Satchel's internal storage keys — and some of those contain a space key or an account id. Satchel does not write file contents, file names or page titles to its logs.
Third parties
None. Satchel makes no external network calls of any kind — no analytics, no error
reporting service, no telemetry, no CDN. Its manifest.yml declares no
external network access (there is no permissions.external block),
which is what makes the app eligible for Atlassian's Runs on
Atlassian badge and what makes this statement checkable rather than a
promise.
Sub-processors
None. The app runs on Atlassian's platform, under your agreement with Atlassian.
GDPR and CCPA
Keelapps does not receive, store or process the data Satchel keeps: it is processed only by app code running inside your own Atlassian site, under Atlassian's terms and on Atlassian's infrastructure. On that basis Keelapps is neither a controller nor a processor of your end-user data for this app, and neither a CCPA business nor a service provider. The Forge logs described above are the one thing Keelapps can see, and your administrators control that access.
If you need a Data Processing Addendum for the Atlassian platform itself, that is between you and Atlassian.
Personal data requests
Satchel stores Atlassian account ids — of uploaders, of whoever started a scan, a move, a delete or an undo, and of whoever was shown a space page in the last few minutes. It does not store names. To remove a person's data:
- Uninstall Satchel; its storage is then deleted as described under Retention.
- Or let it age out: rescan the space after Atlassian has deactivated the account, and the inventory no longer holds their uploads; the job records, undo journals and short-lived answers that name them are deleted on the schedule above. The audit trail is deliberately not rewritten — an audit record that can be edited is not an audit record — and their events leave it as newer events push them out of the 2,000 kept.
Security
- No egress, so no data in transit outside Atlassian.
- No vendor access to what the app stores, so no vendor-side breach surface for your content.
- The app never edits page content. Its only writes are attachment moves and deletions, both explicitly initiated and both preceded by a dry run; deletions also need a typed confirmation checked on the server. Every one is recorded.
- Bulk delete is off by default and must be enabled by a site administrator. A space administrator can switch it off for their space, but cannot switch it on while the site has it off.
- Deletions move attachments to Confluence's own trash, where a space administrator can restore them through Confluence itself. Purging — the one irreversible step — applies only to files already in the trash and needs its own typed confirmation.
Changes
Material changes to what is stored or where will be reflected here and in the Marketplace listing before they ship. The effective date above moves with any change.