tintboardTintboard — Privacy Policy
Last updated: 4 November 2026
This policy covers the Tintboard apps for Jira Cloud and Confluence Cloud (the "Forge apps"), the Tintboard browser extension for Chrome, Edge and Firefox (the "Extension"), and our website and support channels.
Who we are: Fares Baatour, micro-entrepreneur, 127 rue des Enfants du Paradis, 92100 Boulogne-Billancourt, France, France ("we"). Contact: hello@tintboard.com.
1. In short
- Your Jira and Confluence content never leaves Atlassian. The Forge apps run on Atlassian's infrastructure and keep their settings in Atlassian's Forge storage and in your own Jira and Confluence. We operate no server that receives your data.
- The Extension talks only to your own Atlassian site (
*.atlassian.net). It reads the rules your admin configured, changes how pages look in your browser, and marks the weeks you used it on your own Jira profile. It sends nothing to us or to any third party. - We see personal data only when you contact us or when Atlassian shares licensing contact details with us as the app vendor.
2. Data processed by the Forge apps
| Data | Purpose | Where it is stored | Retention |
|---|---|---|---|
| Colour and layout rules (labels, statuses, conditions, colours, space defaults). A card rule on the assignee keeps that person's Atlassian account ID, never their name or email | Apply the styling your admin configured | Forge storage, in your Atlassian site's data residency region | Until deleted by an admin or the app is uninstalled. Every week the app reports the account IDs it keeps to Atlassian, as Atlassian requires, and deletes the card rules naming an account that has been closed |
| A signed copy of those rules and of the licence state (active, trial or lapsed); the only personal data in it is the account IDs of card rules on the assignee | Let the Extension read the rules with each user's own session | A property named tintboard.published on each Jira project and each Confluence space of your site. Every user who can see the project or space can read it |
Rewritten daily; stays in your site after uninstall until an admin deletes it |
The weeks (at most the last 5, e.g. 2026-W45) in which a user's Extension was active; no times, pages or content |
Show admins how many users have the Extension active (a count only, never names) | A property named tintboardseen on that user's own Jira profile, written by the Extension |
Older weeks are dropped at the next visit; stays on the profile after uninstall until an admin deletes it |
| The latest user count | Show the count on the admin page without recounting each time | Forge storage | Replaced every hour |
| Licence state provided by Atlassian | Enable or disable the features | Forge storage (last value only) | Until the app is uninstalled |
We cannot read Forge storage ourselves outside the app's own code. The data is processed under Atlassian's infrastructure and security controls (Atlassian Trust Center). For this data, your organisation is the controller.
3. Data processed by the Extension
- Personal preferences (on/off, font size, line height, reading width) are stored locally in your browser (
chrome.storage.localor its Firefox equivalent). They are not synced through us. - Page content: the Extension reads the Jira or Confluence page currently displayed only to apply styles. Issue fields it reads for card rules are kept in the page's memory for at most one minute and never stored or sent anywhere.
- Requests: the Extension calls your own Atlassian site's APIs with your existing session to read the configured rules, the fields that card rules test (summary, labels, status, priority, type, assignee, due date, last-updated date, parent issue and components) and, once a day, to mark the current week on your Jira profile. It requests access to
*.atlassian.netonly. - Local storage: besides your preferences, the Extension keeps, per site, the state it last showed in the toolbar and the date it last marked your profile.
- No analytics, tracking or advertising. The Extension contains no third-party scripts and loads no remote code.
4. Data we process as the vendor
| Data | Source | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Name, email and company of the licence's technical and billing contacts | Atlassian Marketplace partner reporting | Licence administration, trial onboarding emails, service notices | Legitimate interest / contract | Duration of the licence + 3 years |
| Content of support requests (name, email, message, screenshots you choose to send) | You, by email | Answer your request | Contract / legitimate interest | 3 years after the request is closed |
| Website server logs (IP address, browser, pages viewed) | Our website host, GitHub Pages (GitHub, Inc.). We have no access to these logs and set no cookies | Security and operation of the website | Legitimate interest | As set by GitHub's privacy statement |
You can unsubscribe from onboarding emails at any time with the link in each email.
5. Sharing
We do not sell or rent personal data. We share it only with:
- Atlassian, which runs the Marketplace, billing and the Forge platform.
- Our providers: OVHcloud (Zimbra), France for email, and GitHub, Inc. for website hosting. Each is bound by data processing terms.
- Authorities, where the law requires it.
Some providers may process data outside the European Economic Area. In that case the transfer relies on the European Commission's standard contractual clauses or an adequacy decision.
6. Your rights
Under the GDPR you can request access, rectification, erasure, restriction, portability, or object to processing. Write to hello@tintboard.com. We answer within one month.
For data stored in your Atlassian site (Section 2), contact your organisation's Jira or Confluence admin, who controls it. Uninstalling the app removes its Forge storage. The tintboard.published and tintboardseen properties stay in your site until an admin deletes them through Atlassian's REST API; our documentation gives the exact calls.
You can complain to the French data protection authority, the CNIL.
7. Security
- No vendor-hosted infrastructure holds customer data.
- The Extension uses Manifest V3, minimal permissions and no remote code.
- Dependencies are scanned automatically.
- Vulnerabilities can be reported to hello@tintboard.com.
8. Changes
We will post changes on this page and update the date at the top. Material changes are announced in the app's release notes.