OrgSpec for Jira privacy policy

OrgSpec for Jira generates a candidate machine-readable organisation specification from Jira projects, boards, sprints, components, and selected issue metadata visible to the current Jira user.

The app is a Jira-to-OrgSpec generator. It is not a reporting dashboard, sprint analytics tool, velocity tool, capacity planning dashboard, or Orgonaut integration.

Data read from Jira

The app reads Jira data through Atlassian Forge as the current Jira user.

The current version reads:

• Jira project id, key, name, type, category, style, and simplified flag.
• Project lead account id if Jira returns it.
• Jira board id, name, type, project keys, and location/project metadata.
• Jira sprint id, name, state, start date, end date, and completion date.
• Jira issue key.
• Issue project key.
• Issue assignee account id.
• Issue reporter account id.
• Issue component names.
• Issue labels.
• Issue parent key.
• Issue status category.
• Issue type.
• Issue fix version names.
• Diagnostic counts for missing, blocked, present, or dropped evidence.

The app only sees data the current Jira user can access in Jira.

Data not read

The current version does not request or read:

• Issue descriptions.
• Issue comments.
• Attachments.
• Worklogs.
• Issue changelog history.
• Full issue body content beyond the explicit metadata field list.
• Salary, compensation, or individual cost data.
• HRIS data.
• Atlassian Teams data.
• Jira groups.
• Compass data.
• Confluence data.
• Orgonaut data.

Data processing

Data is processed in two places:

• Browser session: Jira metadata is scanned and normalized into a Jira source contract.
• Forge resolver invocation: the source contract is mapped into OrgSpec, validated, and prepared as export files.

The resolver does not call Jira directly in the current version.

Storage and retention

The current version does not use persistent Forge storage.

The current version does not use a database.

The current version does not send data to Orgonaut or any external service.

Generated data is held in browser session state while the app page is open. Export files are created only when the user downloads them.

Downloaded files are stored wherever the user's browser saves them. Users should handle downloaded exports as internal organisational data.

Exports

The current version can export:

• OrgSpec JSON.
• Jira source contract JSON.
• Mapping report Markdown.
• Validation result JSON.

Downloaded exports may include Jira account identifiers for assignee, reporter, or project lead evidence when Jira returns those identifiers.

Account identifier handling

Jira account identifiers are treated as personal data.

The on-screen mapping report preview redacts account identifiers. Downloaded exports retain account identifiers for traceability in the current version.

Users should not publish downloaded exports without reviewing and redacting internal identifiers.

Public screenshots and public examples for OrgSpec for Jira use synthetic or redacted data.

External services

The current version does not call external services.

The current version does not send data to Orgonaut.

The current version does not use external analytics, billing, storage, or AI services.

Permissions

The app requests read-only Jira scopes needed to discover projects, boards, sprints, and selected issue metadata.

It does not request Jira write scopes, admin write scopes, Forge storage scope, external fetch permissions, billing scopes, or Orgonaut API access.

Contact

Support and privacy contact:

• support@orgonaut.co
• /docs/orgspec/jira/support

This policy should be updated whenever the app changes what data it reads, stores, exports, or sends to another service.