What the app reads, what it keeps, and the one thing it can change.

The app reads the following from your Confluence Cloud site, using the permissions granted at installation:

• User directory data: account IDs of people named by space permissions, restrictions and group memberships; display name and email address (where the user's Atlassian profile makes it visible to apps) when a page is displayed and in the evidence file an administrator downloads. The app also checks that the person using it is a Confluence administrator. None of these except the account ID are written to storage.
• Groups: every group on the site, the members of groups named by a space permission or a restriction, and one person's groups when an administrator looks them up.
• Spaces and space permissions: every space's ID, key, name and type, and which people and groups hold which permission on it.
• Page and blog post restrictions: for each page and blog post, its ID, space and parent pages, the people and groups on its view and edit restrictions, and how many pages sit below a view-restricted page. Page and blog post titles are read only to show them.
• Confluence's permission check: when an administrator checks one person or group on one page, the app asks Confluence whether they can view or edit it. This check only reads.

The app does not read page or blog post content, comments, attachments, or who has viewed a page.

One thing: it can add or remove a person or group on a page's or blog post's view or edit restriction. It does this only after an administrator has seen the list of changes and confirmed it, and it runs as that administrator, so Confluence checks their permission on every page and records them in its own audit log. Before each page changes, the page's restrictions as they were are written to the change log, and the change can be undone.

The app cannot change page content, space permissions, groups, users or any other setting.

The app stores, in Forge's Atlassian-hosted storage within your site's data residency region:

• Snapshots: space IDs, keys and names; group IDs and names; account IDs; which permission each person or group holds on each space; page and blog post IDs with their space ID, parent page IDs and the IDs on their restrictions; the count of pages below; who found each restricted page; the account ID of the administrator who ran the admin sweep and when.
• Reviews: decisions, notes, the account ID of who decided and when, who took the snapshot, who signed off and when, the restricted page coverage at sign-off, and earlier sign-offs with who reopened the review and when.
• Change log: what each change was, who planned and confirmed it, and for each page its restrictions before the change (IDs only), the actions, their results and who ran them.
• Working data: progress of a running snapshot, admin sweep or change, and two settings (when the first snapshot was taken, and whether the review request was closed).

Display names, email addresses, page titles and page content are not stored; names, emails and titles are read from Confluence each time they are shown.

The app keeps the 12 most recent reviews. Older reviews are deleted, with their decisions, when the next snapshot is saved. An administrator can delete a review that has never been signed off; a signed-off review is kept as evidence until it is no longer one of the last 12. Each review keeps up to 20 earlier sign-offs.

The change log keeps 50 changes. When it is full, changes that never ran are deleted first, then the oldest changes that ran. Working data from a snapshot or admin sweep is deleted when it ends, fails or is cancelled. Locks expire after 60 seconds.

Closed Atlassian accounts: when Atlassian reports that an account was closed, the app erases its account ID within hours, everywhere it is kept: in reviews, decisions, sign-offs, the change log and working data it is replaced by a stand-in that holds nothing of the old ID, so a review keeps its rows, decisions and totals and shows "(closed account)". Notes written about that person are cleared, and their personal space is renamed in stored snapshots.

When the app is uninstalled, Forge deletes all app storage for your site. We cannot reach this data from outside the app, so we cannot delete it for you on request.