Data security and privacy
This page describes what Event Planner stores, where it stores it, and who can read or change it, in Confluence and in Jira. Use it for your security review, together with the privacy and security tab of each Marketplace listing.
Where the app runs
Both apps are built on Atlassian Forge. Their code and storage run on Atlassian's infrastructure. The apps have no servers of their own and can't send data to any address outside Atlassian. That makes them eligible for the Runs on Atlassian program.
No data goes to Apportunity UG (haftungsbeschränkt) or to any third party.
What a calendar holds
Every calendar, in either product, holds the same kind of data:
| Data | What it holds | Why |
|---|---|---|
| Events | Title, description, start and end, all-day flag, color, and optionally a location and a link | To show the calendar |
| People on events | Atlassian account IDs only | To show who's involved. Names and avatars are looked up each time the calendar opens, and aren't stored |
| Day headers | A date and the text you typed for it | To label days |
| Calendar settings | Default view, start of week, weekends, working hours, time slots, height and the lock | To show the calendar the way you set it up |
| Save markers | A revision number and random tokens of the last saves | To merge changes when several people save at once |
A calendar never holds who created or changed an event, email addresses, or the content of the page or work item it sits on. Personal data is limited to account IDs of people on events and whatever people type into event fields.
Confluence
Event Planner for Confluence keeps calendars in Confluence itself, as page attachments and space content.
Where the data is
| What | Where | Visible to |
|---|---|---|
| Page calendar | A JSON file attached to its page, named events-<macro ID>.json, created by the first save | Whoever can see the page's attachments |
| Space calendar | Confluence content in its space, of the app's own content type. Confluence keeps a version for every save | Whoever the space permissions and the calendar's restrictions allow |
| Admin page settings | Forge hosted storage: two values, Let people create calendars in spaces and Default access for new calendars | Confluence admins |
A space calendar's name is indexed by Confluence search, like a page title. Its events aren't.
How data flows
- Your browser loads the app from Atlassian. The calendar runs in a sandboxed frame inside Confluence.
- The calendar reads and saves its data through Confluence's own REST API, as you. Confluence applies page permissions, space permissions and restrictions to every request.
- For a PDF or Word export, the app's Forge function reads the calendar as the person exporting, and returns it as part of the document.
- Your browser builds ICS and CSV exports and saves them to your device.
Jira
Event Planner for Jira keeps calendars in Forge hosted storage, not in Jira.
Where the data is
The app keeps one calendar for each Event Planner panel and each Event Planner gadget, in Forge hosted storage inside your site's app installation.
How data flows
- Your browser loads the app from Atlassian. The calendar runs in a sandboxed frame inside Jira.
- When you open a calendar, the request goes to the app's Forge function. Forge tells the function which work item, or which dashboard and gadget, the calendar belongs to. The browser can't pick another calendar.
- The function asks Jira, as you, whether you can see the work item or dashboard. For a change, it also checks that you can edit it and that the app license is active.
- Only then does the function read or save the calendar in Forge hosted storage.
- Your browser builds ICS and CSV exports and saves them to your device.
Who can see and change a calendar
| Calendar | View | Create, edit or delete events |
|---|---|---|
| Confluence page calendar | View the page | Edit the page |
| Confluence space calendar | Space access and the calendar's restrictions | Space permissions and the calendar's restrictions |
| Jira work item calendar | See the work item (BROWSE_PROJECTS) | Edit the work item (EDIT_ISSUES) |
| Jira dashboard calendar | The dashboard is shared with you | Own the dashboard, or be shared on it as an editor |
- People who can view but not edit get the calendar read-only.
- People who aren't signed in can't open Jira calendars. On public Confluence pages they can view page calendars.
- If the app license isn't active, calendars stay readable, but nobody can change them.
- Anyone who can edit a calendar can change or delete any event on it. Events have no owner.
The full list is in Permissions.
Data residency
In Confluence, page attachments and space calendars are Confluence content, so they follow your Confluence site's data residency. The admin page settings are in Forge hosted storage.
In Jira, Forge hosted storage keeps calendars in the same location as your Jira site. It moves them with the site when an admin changes its data residency location.
See Atlassian's Forge data residency page for the supported locations.
Encryption, retention and deletion
All traffic between browsers, Forge, Confluence and Jira uses HTTPS. Atlassian encrypts Confluence content and Forge hosted storage on disk.
| When you | What happens to the calendar |
|---|---|
| Delete a Confluence page | Its calendar file goes with it, under Confluence's trash rules |
| Move a space calendar to the trash | It disappears for everyone, then follows Confluence's trash rules |
| Delete a Jira work item | Its calendar is deleted |
| Uninstall the Confluence app | Page and space calendars stay in Confluence; admin page settings are deleted |
| Uninstall the Jira app | Atlassian keeps the calendars for 28 days, so a reinstall can restore them, then deletes them |
What isn't deleted automatically
Jira doesn't tell apps about these changes, so the calendar stays in the app's storage until you uninstall the app:
| You do this | What stays in storage | To remove the data first |
|---|---|---|
| Delete a space | The calendars of the space's work items | Delete the events on each calendar, or delete the work items, before you delete the space |
| Remove a dashboard gadget | That gadget's calendar | Delete the gadget's events before you remove it |
| Delete a dashboard | The calendars of its Event Planner gadgets | Delete the events on each gadget before you delete the dashboard |
Data left behind can't be opened again: the work item, gadget or dashboard it belonged to no longer exists.
In Confluence, removing the Event Planner macro from a page leaves its calendar file in the page's attachments. Delete the file from the page's attachments to remove the events.
App permissions
Each app asks for these permissions (scopes) when it's installed.
Event Planner for Confluence
| Scope | What the app uses it for |
|---|---|
read:confluence-content.all, read:confluence-content.summary, read:content:confluence, read:page:confluence | Read the page a calendar is on, and check whether it's published |
read:attachment:confluence, readonly:content.attachment:confluence | Find and read a page calendar's file |
write:confluence-file | Save a page calendar's file |
read:confluence-content.permission | Check, as you, whether you can edit the page |
read:custom-content:confluence, write:custom-content:confluence, delete:custom-content:confluence | List, read, create, save and move space calendars to the trash |
write:confluence-content | Set the restrictions of a space calendar |
read:confluence-space.summary, read:space:confluence | Show space names, and let you pick a space in Embed space calendar |
read:confluence-user, read:content-details:confluence | Search for people to add to events and restrictions, and show their names |
read:confluence-groups | Search for groups to add to restrictions |
storage:app | Keep the admin page settings |
read:confluence-props, write:confluence-props, write:page:confluence | Not used by the current version of the app. It doesn't read or change content properties, and doesn't change pages |
Event Planner for Jira
| Scope | What the app uses it for |
|---|---|
read:jira-work | Check, as you, whether you can see or edit a work item or dashboard. It also lets the app learn that a work item was deleted, so it can delete its calendar |
read:jira-user | Search for people to add to events, and show their names |
write:jira-work | Not used by the current version of the app. The app doesn't change work items, comments or attachments |
storage:app | Keep calendars in Forge hosted storage |
Subprocessors and AI
The apps use no subprocessors other than Atlassian. They call no AI service.
Create with AI gives you a prompt to paste into an AI assistant of your choice, outside Event Planner. Only what you type into that assistant goes to it. You paste its answer back into Event Planner yourself.
Report a security issue
Report a vulnerability or ask a security question through the support portal.
Related
- Permissions: every permission Event Planner checks.
- Install, update and uninstall the app: what happens to calendars when you uninstall.
- Atlassian's Forge platform security: how Forge isolates apps.