keelapps/Satchel for Confluence/Privacy policy
Privacy policy — Satchel for Confluence
The short version
Satchel for Confluence (“Satchel”, “the app”) is published by Keelapps. It runs entirely inside Atlassian's infrastructure. It makes no external network calls, it stores nothing outside Forge hosted storage on your own site, and Keelapps has no ability to read your data. There is no Keelapps server for your data to reach. Attachment contents are never stored by Satchel at all: when you download an archive, the files travel from Confluence to your browser, are assembled into a zip in that browser tab, and are saved to your disk. Nothing is buffered, cached or retained in between.
What Satchel stores, and where
Everything below lives in Forge hosted storage, which is Atlassian infrastructure attached to your own Confluence site. Atlassian's data-residency options apply to it.
| Data | Why |
|---|---|
| Attachment metadata: id, file name, size, media type, version count, upload timestamp, uploader account id, status | the space inventory that makes a cross-page view possible |
| Page metadata: id, title, status | so the inventory can say which page a file is on |
| Space keys and per-space settings | scoping and configuration |
| Bulk job records: what was selected, progress, per-file outcomes | so a job survives a closed browser tab and can be reported honestly |
| Undo journals for completed moves | so a move can be reversed |
| An audit trail of moves and deletions: timestamp, action, actor account id and display name, file name and size, source and target page | because deleting attachments matters and an administrator is owed a record |
| An hourly count of API points this site has spent | rate-limit self-throttling |
Not stored: attachment file contents, page body text (page bodies are read during a scan to find which files a page references, and are discarded immediately — only a true-or-false flag per attachment is kept), passwords, tokens, or anything about users beyond the account ids and display names Confluence itself returns.
Retention
- The inventory is replaced wholesale by each rescan and deleted when the app is uninstalled.
- The audit trail is a bounded ring buffer of the 2,000 most recent events. Older events are dropped automatically. If you need a longer record, export it as CSV — the button is in Confluence administration and on each space page.
- Undo journals expire 30 days after the move they describe.
- Uninstalling the app removes all of it. Atlassian deletes Forge storage associated with an uninstalled app; Keelapps has no copy to delete because Keelapps never had one.
Who can see what
- The space attachment browser is visible to anyone who can open the space, but by default it hides rows whose page that person cannot open — Satchel intersects its inventory with the pages Confluence says that user may read before any row leaves the server. A site administrator can switch this off.
- Aggregate totals on a space page (file count, total size) cover the whole space and are labelled as such, next to a count of how many rows are hidden from the current viewer.
- Cross-space totals, uploader rankings and the audit trail live in Confluence administration, so only site administrators can reach them.
- Every download, move and delete is performed as the signed-in user, so Confluence's own permissions decide what actually happens regardless of what the index shows.
Third parties
None. Satchel makes no external network calls of any kind — no analytics, no error reporting, no telemetry, no content delivery network. Its manifest contains no external permissions block, which is what Atlassian's Runs on Atlassian badge certifies and what makes this statement checkable rather than a promise.
Sub-processors
None.
GDPR and CCPA
Keelapps is neither a controller nor a processor of your end-user data for this app, and is neither a CCPA business nor a service provider, because Keelapps has no access path to it. Data is processed only by app code running inside your own Atlassian site, under Atlassian's terms and on Atlassian's infrastructure.
If you need a Data Processing Addendum for the Atlassian platform itself, that is between you and Atlassian.
Personal data requests
Satchel stores Atlassian account ids, and display names cached alongside them for readability. To remove a person's data:
- Uninstalling Satchel removes everything it stores.
- Alternatively, rescan the space after Atlassian has deactivated the account — the inventory is replaced wholesale, and account ids no longer visible to the app disappear with it. Note that the audit trail is deliberately not rewritten by a rescan: an audit record that can be edited is not an audit record. It ages out of the 2,000-event ring on its own.
Atlassian's own personal-data reporting API governs deletion timelines for account data across Forge apps.
Security
- No egress, so no data in transit outside Atlassian.
- No vendor access, so no vendor-side breach surface for your content.
- The app never edits page content. Its only writes are attachment moves and deletions, both explicitly initiated, both behind a dry run and a typed confirmation, and both recorded.
- Bulk delete is off by default and must be enabled by a site administrator.
- Deletions move attachments to Confluence's own trash, where a space administrator can restore them through Confluence itself.
Changes
Material changes to what is stored or where will be reflected here and in the Marketplace listing before they ship. The effective date above moves with any change.
Contact
support@keelapps.atlassian.net — for questions about this policy, and for data access, correction or deletion requests. Security issues: report them privately.