Keelcroft / Cross-Site Issue Sync for Jira / Privacy

Privacy Policy

Effective 7 October 2026. Cross-Site Issue Sync for Jira is published by Keelcroft. Privacy contact: support@keelcroft.com.

This app sends your issue content to another Jira site.

That is the purpose of a cross-site sync, and it is the most important thing to understand before installing. The sections below state exactly which fields leave your site and where they go.

Scope

This policy explains how Cross-Site Issue Sync for Jira processes information when installed in Jira Cloud. The app runs entirely on Atlassian Forge. There is no vendor-hosted backend: Forge calls the partner Jira Cloud site directly, and no customer data is relayed through infrastructure operated by Keelcroft. The app contains no advertising, no external analytics, and no AI services.

Information transferred to the partner site

Only the fields a project administrator has enabled for the direction from this site to the partner, and only for issues that are linked to a partner issue — either explicitly, or because auto-create was switched on and the issue was created after sync was turned on:

The issue summary.
The issue status, translated through the status map you set.
The issue labels.
The issue description as plain text, only if you switch it on. It is off by default.

Summaries, labels and descriptions may contain personal information chosen by your organisation. The app does not read or transfer comments, attachments, worklogs, custom fields, reporters, assignees, watchers, or any issue that is not linked.

Information transferred to this site

The mirror of the above, for the fields enabled in the direction from the partner to this site. When the app reads a linked partner issue it also receives the issue’s id, key, update time and assignee account id; the assignee is never written anywhere. When it checks the partner project for changes it receives only issue ids, keys, and created and updated times.

Information stored by the app

Connection settings: the partner site address and project key, field and status maps, conflict policy, auto-create choice, whether sync is enabled and when it was enabled, and the id of the webhook the app registered on the partner site.
Link records: the issue id and key on this site, the partner issue id and a link to it, per-field content digests, the agreement state, and timestamps. Digests are one-way SHA-256 hashes and cannot be turned back into field values.
An event journal recording the origin of each change, the identifiers of the two issues involved, the outcome, which fields were written, and any verification mismatch. It does not store issue content, which is why a replay always re-reads both sites rather than reusing a stored copy.

Credentials

The partner user’s email address and API token, and the webhook signing secret this app generates when sync is turned on, are written to Atlassian Forge encrypted secret storage. The email and token are sent only to the partner site (or to Atlassian’s API gateway for that site, for scoped tokens), as HTTP Basic authentication over HTTPS, and are never returned to the app’s user interface or written to a log. The interface only ever reports whether credentials are present. The signing secret is sent once to the partner site when the webhook is registered and is used afterwards only to verify deliveries; pausing sync discards it and removes the webhook.

External destinations

The partner Jira Cloud site on *.atlassian.net — reading and writing issues in the partner project you chose, reading that project’s statuses and issue types, and registering or removing one webhook.
Atlassian’s API gateway at api.atlassian.com — the same calls, used only when the partner token is a scoped token that the site address does not accept.

The app cannot reach any other host.

Authorization and retention

Creating, changing, enabling or disabling a connection, storing credentials, and linking or unlinking an issue all require Jira project administrator rights on this site, which the app re-checks on the server for every such request. A connection is scoped to a single project on this site and a single partner project.

Connection settings and link records are kept until the app is uninstalled.
Event journal entries expire 90 days after their latest write.
Forge retains hosted storage for 28 days after uninstall.

Contact

Send privacy, access or deletion questions to support@keelcroft.com. Report suspected vulnerabilities to the same address with the subject line “Security”. Include the Jira site, but never send passwords or tokens.