What the app reads, what it keeps, and what it never does.

The app reads the following from your Confluence Cloud site, using only the read-only permissions granted at installation:

• User directory data: the list of accounts that can use your Confluence site, and for each one the account ID, account type, account status and guest flag while a scan lists users; display name and email address (where the user's Atlassian profile makes it visible) only when a report is displayed or exported. None of these except the account ID are written to storage.
• Content activity metadata: for recently modified pages, blog posts, comments and attachments, the author and timestamp of the latest version and of creation; for pages and blog posts that other people edited, the author and timestamp of earlier versions. The app reads this to determine who contributed and when. It does not read page text, comment text, attachment contents, titles or labels.

The app stores, in Forge's Atlassian-hosted storage within your site's data residency region:

• Scan progress (cursors, counters, timestamps).
• For each dormant user: the Atlassian account ID and a dormancy band derived by the app. Display names and email addresses are not stored; they are read from Confluence each time you open or export the report.

The app never stores page content, comment text, attachments, or any text authored by your users. Every stored value is regenerated by each scan and is deleted when the app is uninstalled.

• It does not remove access from, deactivate, modify or delete users, and holds no permission that could.
• It does not change any setting, page, or configuration on your site.
• It does not use your data for any purpose other than producing the report you request.
• It does not sell, share, or transmit your data to any third party.