Data Privacy and Security

Your privacy is important to us, and so is being transparent about how we collect, use, and share information about you.

Data Privacy

What information we store

Agile Toolbox stores only what it needs to run refinements, Planning Poker rooms and retrospectives for your site:

• Installation data sent by Atlassian when the app is installed, upgraded or uninstalled, including the site’s cloud ID.
• Refinements: the refinement names and the keys of the Jira issues added to them, plus the per-board display preferences (sorting, page size, collapsed sections).
• Planning Poker rooms: the issue key, the room configuration (card set, calculation method, options and the ID of the chosen story-point field), the Atlassian account IDs of participants, and their votes. Your saved default configuration is stored against your account ID, per project and issue type.
• Retrospectives: the retrospective name and settings, the column names, the text of every card, the group titles, the votes and emoji reactions with the account IDs of the people who cast them (also on anonymous boards, where they are never displayed), the keys of Jira issues created or linked from cards, and archived boards.
• Error data, such as stack traces and error messages, to help us diagnose and fix problems.

What we read but do not store

Some information is read from Jira by your browser while you use the app and never reaches our servers:

• The list of fields on an issue, during room configuration. Only the ID of the field you choose is stored.
• Issue summaries, statuses, epics, assignees, sprints and estimates shown in the refinements view. They are fetched live from Jira each time.
• The display names and avatars of participants. They are resolved in your browser from the stored account IDs.

When data is deleted

• Remove room deletes the room’s configuration and votes.
• Delete on a refinement or a retrospective deletes it permanently, including its cards, votes and reactions. Jira issues created from cards are never deleted by the app.
• Uninstalling the app marks the installation as removed. Data is retained so that a reinstall restores your refinements and retrospectives; contact us through the support portal to have it deleted.

How we use the information we collect

We use the collected information to provide the product to you. Error-related data is used to improve the product and fix bugs. We do not sell data and do not use it for advertising.

Data residency

Agile Toolbox for Jira runs in two regions, the European Union and the United States. Atlassian routes each installation to the region that matches your Jira site’s data residency, and the app keeps that installation’s data, including the real-time database behind rooms and boards, in that region only.

Security

We use industry-standard technical and organizational measures to secure the information we store, leveraging Google Cloud as our infrastructure provider. This provides a secure-by-design infrastructure, encryption at rest and in transit, a well-defined privacy policy, and advanced access management.

The app is built on Atlassian Forge. Requests from Jira to our services carry Atlassian-signed tokens that are verified on every call, and the app only asks for the Jira scopes it needs: reading and writing work items, reading users, boards, sprints, projects and JQL.

How we keep the product safe

• Development, test, and production environments are isolated.
• Every installation’s data is isolated by its cloud ID; the isolation is covered by automated tests.
• Access to our infrastructure and source code is secured by 2-factor authentication and is periodically reviewed.
• All code changes are reviewed and accepted through pull requests.
• Deployment procedures are automated to limit access to production environments and reduce the risk of human error.
• Security scanners are included in our build process to quickly discover and remove security bugs.