What the app reads, what it keeps, and what it never changes.

The app reads the following from your Jira Cloud site, using the permissions granted at installation:

• User directory data: account IDs of the people who logged work, of the members of groups that have a rate, and of the people who save budgets, expenses and settings; display names when a page is displayed and in the export a user downloads. Only account IDs are written to storage. The app does not use email addresses, and it reads avatars only because Jira's group member endpoint requires that permission; avatars are not shown or stored.
• Projects: the ID, key and name of each project that has a budget.
• Work logs: for projects with a budget, each work log's ID, author, start date and time spent, and which issue and project it belongs to. Jira may return a work log's comment with it; the app ignores it and does not store it.
• Groups: the names of groups when an administrator searches for one on the rate form, and the members of every group that has a rate.
• Permissions: whether the person using a page can browse or administer the project, or is a Jira administrator. Jira is asked as that person.

The app does not read issue summaries, descriptions, comments, attachments or any other text your users write in issues.

The app also holds what your users enter in it: budget amounts, currencies and months, expense lines (date, description, amount), hourly rates, and the setting for who can see money on project pages.

The app stores, in Forge's Atlassian-hosted storage within your site's data residency region:

• For each project with a budget: the amount, currency, first and last month, who changed it last (account ID) and when.
• Expense lines: date, description, amount and who added each line (account ID).
• Hourly rates, by account ID or group ID, with their start months.
• Hours logged per account ID, per project and month, and for each counted work log a small entry with its ID, project, month, account ID and time spent, so a later change or deletion can be applied.
• The account IDs of the members of each group that has a rate.
• Sync progress (cursors that can hold issue keys, work log IDs and account IDs while a sync runs, counters, timestamps, the last error, and the account ID of whoever started the last sync) and a note when a project could not be read.
• Settings: who can see money on project pages, who changed it last (account ID) and when; when the first sync finished; when someone hid the review note.
• Short-lived markers that stop two saves from overwriting each other. They expire after 2 minutes.

Display names and email addresses are not stored; names are read from Jira each time they are shown. Costs are not stored either; they are worked out from the stored hours and rates when a page opens.

Budgets, expense lines and rates are kept until someone removes them in the app. Deleting an expense line or removing a rate deletes it at once. Removing a budget deletes its expense lines at once and the hours read for that project at the next sync; the small per-work-log entries for that project are deleted when the work log changes in Jira, or when the app is uninstalled. When a work log is deleted in Jira, its hours and its entry are removed at the next sync. Group member lists are replaced each time they are read; when a group's rate is removed, its last list stays until the app is uninstalled.

Closed Atlassian accounts: when Atlassian reports that an account was closed, the app erases what it keeps about that person within hours: their per-work-log entries and hours are deleted, their personal hourly rate is deleted, they are taken out of group member lists, and their account ID is removed from "changed by" and "started by" on budgets, expense lines, rates and settings. Budgets and expense lines stay. Their hours then no longer count toward a project's cost. Jira keeps the work logs of closed accounts, so a later sync can count some of them again; the next weekly report removes them again.

When the app is uninstalled, Forge deletes all app storage for your site. We cannot reach this data from outside the app, so we cannot delete it for you on request.