PublicThread for JSM (the “App”) is an Atlassian Forge app for Jira Service Management Cloud. This policy explains what data the App touches when a customer runs it, and — just as importantly — what it does not do with that data.
In short: the App has no server of its own, no database, and no analytics. It runs entirely inside Atlassian’s Forge platform, reads a Jira Service Management request’s public comments at the moment an Automation rule invokes it, and returns formatted text back into that same rule. Nothing is stored, logged, or sent anywhere outside Atlassian’s infrastructure.
The App adds one action to Jira Automation: Get Public Conversation (PublicThread for JSM). Given a Request/Issue key, it retrieves that request’s comments through the Jira Service Management REST API, keeps only the comments marked public (customer-visible), and returns them as formatted text (conversationText, conversationHtml) and a count (commentCount) for the rest of the Automation rule to use — for example, to compose a summary email.
Each time the action runs, it reads, for the single request specified by the Automation rule:
public: true — their author display name, timestamp, and body.Internal notes (comments marked non-public) are deliberately excluded through two independent checks in the App’s code, and their content is never included in the App’s output or written to any log.
asUser()), the App never sees a password or token.The App runs as a Forge function hosted by Atlassian. It never calls any server operated by the vendor, and it never sends data to any third party. The only network calls the App makes are to Jira Service Management’s own REST API, within the same Atlassian Cloud site that installed it. Data residency therefore follows the customer’s own Atlassian Cloud data-residency configuration; the App has no infrastructure of its own to introduce a separate region.
| Scope | Purpose |
|---|---|
read:servicedesk-request | Read a Jira Service Management request and its public comments, and confirm the running user’s access to it. |
This is the only scope the App requests. It is read-only: the App cannot create, edit, or delete anything in Jira.
None. The App integrates no third-party service, analytics vendor, email provider, or storage provider of its own. The only infrastructure involved is Atlassian’s own Forge platform, which is already covered by Atlassian’s own privacy and security commitments to the customer.
Because the App retains nothing after each Automation run completes, there is no App-held personal data to access, export, or delete. Any personal data that appears in an Automation rule’s output (for example, a summary email built from conversationText) is retained only by the customer’s own Jira Automation configuration and downstream tools, under the customer’s own control. If you believe the App has behaved differently from what this policy describes, contact us using the details below and we will investigate promptly.
If this policy changes in a way that affects how the App handles data, we will update the effective date above and, for material changes, note it in the App’s Atlassian Marketplace listing.
Questions about this policy or the App’s data handling: support@asunoki.jp.