Privacy policy

Last updated: [date]. Who we are: sinusgamma, [legal name, address, registration number, tax number]; see the legal notice. Contact: support@sinusgamma.com.

This policy covers the Jira → Google Sheets app (“the app”) and this website.

What the app keeps, and why

The app runs on Atlassian Forge, inside Atlassian’s cloud. We run no server of our own. What the app keeps is stored in Forge’s storage for your Jira site, in your site’s own storage area at Atlassian.

What	Why	How long
The Google account’s email address	To show which account is connected, and as the report owner’s name to colleagues it is shared with	Until the person disconnects
A Google sign-in token (a “refresh token”)	To update the spreadsheet without anyone signed in	Until the person disconnects; kept in Forge’s encrypted secret storage
Each report’s settings: name, Jira filter, the picked spreadsheet’s id and name, tab, columns, who sees it and who gets its alerts (Jira group ids)	To run the report	Until the report is deleted
The Jira account id of the person who set up a report, and of each person with a Google sign-in	The report reads Jira as its owner; the owner gets the alert email	Until the report is deleted or the person disconnects
The site’s settings for the app, set by Jira admins (including Jira group ids and names, and allowed Google domains)	To apply the site’s rules	Until an admin changes them
The activity log: who added, changed, paused, took over, cleaned up or deleted a report, saved a copy of its tab, connected or disconnected a Google account (with that account’s email address), or changed the site’s settings, and when	So Jira admins can see who did what	One year
The last 20 updates of a report: start time, outcome, counts and any error message	To show recent updates on the app’s page	Until the report is deleted
An open alert: when updates stopped, why, and whether its email was sent	To show the alert and to email it only once	Until the report works again
A problem with one of a report’s extra tabs (trend, time in status, summary)	To show it on the report until the tab is written again	Until fixed
A person’s Jira group ids; whether a person is a Jira admin	To show the reports shared with them without asking Jira every minute	15 minutes; 10 minutes
Notes of which issues changed (issue id and key)	So updates read only the issues that changed	3 days
The site’s use of Jira’s hourly request allowance (numbers only)	To share Jira’s limit fairly between reports	2 days

Jira issue data (the fields the report shows) is read during each update, as the report’s owner, and written into your spreadsheet. The app doesn’t keep a copy of it.

What the app writes into your spreadsheet

The fields the report shows, as the report’s owner sees them in Jira. Depending on the columns chosen, this includes people’s names (for example the assignee, the author of the latest comment, or who made a change in the “… changes” tab).
Invisible tags (Google’s “developer metadata”) on the report’s columns and rows. They hold a Jira field id per column and an issue id per row, so the app finds its columns and rows after you move or sort them. Only the app can read the row tags.
The time of the last update, in row 1 or as a note on the Key header.

Anyone who can open the spreadsheet sees what the report shows, even issues they can’t open in Jira. Who can open it is set in Google, with its Share button.

Atlassian’s privacy report

Every week the app tells Atlassian which Jira account ids it keeps, as Atlassian requires. When Atlassian answers that an account was closed, the app deletes that person’s Google sign-in, removes them from the activity log and the history of their reports, and pauses their reports until a Jira admin takes them over.

Logs: Atlassian keeps short technical logs of each update (a run id and its outcome) that we can read to fix problems. They contain no sign-in tokens and no spreadsheet contents.

Access the app asks for

Jira:
- read issues and saved filters (read:jira-work);
- read a person’s groups and find groups by name (read:jira-user), for sharing reports and sending alerts to groups;
- write access (write:jira-work), used only to have Jira send the alert email about an issue (the app changes no issue);
- the weekly privacy report (report:personal-data);
- storage (storage:app) for the table above.
Google: drive.file, which lets the app open only the spreadsheets you pick in Google’s file picker or that the app creates. It can’t see the rest of your Drive. openid and email, to show which Google account is connected.

sinusgamma’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don’t sell this data, use it for advertising, or use it to train AI models.

Alert emails

When a report stops updating, Jira sends an email to the report’s owner and, if chosen, to the members of Jira groups picked for the report or by a Jira admin. Jira sends it from your Jira site, to people’s Jira email addresses; the app never sees those addresses.

Who else handles the data

The full list, with what each one does: sub-processors.

Atlassian hosts the app and its storage (Atlassian’s privacy policy).
Google hosts your spreadsheet (Google’s privacy policy).
Microsoft hosts our email, if you write to support (Microsoft’s privacy statement).

How long it is kept, and deleting it

Disconnect your Google account on the app’s page: the app forgets your sign-in on that Jira site and your reports stop. To also remove the app’s access in Google, use your Google account (Google Account → Security → Third-party apps); updates then stop on every site, and the app shows a message.
Delete a report on the app’s page: its settings, run history and alert are deleted. The spreadsheet stays yours.
Uninstalling the app deletes its storage. Atlassian keeps a deleted copy for 28 days so it can be restored by request, then destroys it (Atlassian’s data lifecycle for Forge storage).
Write to us to have anything deleted sooner.

This website

Analytics: Cloudflare Web Analytics counts page views without cookies and without identifying you.
Forms: if you send us a form, the form service stores your answers in the EU. (Named at launch.)
Hosting: the site is served by Cloudflare.

Your rights

Under the GDPR you can ask to see, correct or delete your personal data, to limit or object to its use, and to get a copy. Write to support@sinusgamma.com. You can also complain to the Hungarian data protection authority (NAIH, naih.hu) or the authority where you live.

Changes

We’ll update the date at the top when this policy changes, and tell app users on the app’s page if a change matters.