What the app reads, what it changes, and what it keeps.

The app reads the following from your Jira Cloud site, using the permissions granted at installation:

• Requests in a merge (the read:jira-work permission): key, summary, project, status, reporter, comments with their author, date, text and visibility, attachments (name, size, type, and the file itself while it is copied), organizations, watchers, issue links and the transitions available. Also, for the request search, the key, summary and status of matching requests in the same project.
• Permission checks (read:jira-work): whether the person using the app is an agent of the project and may see, edit, comment on, link and change the status of each request, and whether a Jira administrator is the one on the settings page.
• Project settings (read:jira-work, read:servicedesk-request): the list of service projects, the done statuses of a project's workflows, the site's resolutions, link types and the Organizations field.
• Request participants (read:servicedesk-request): the account IDs of the people on each request.
• User directory data (read:jira-user): display names of agents and of people who could not be added, looked up when a page is shown, when the CSV is built, and when the app writes the line naming the agent who merged.

Comment text and file content are read only to copy them to the main request during a merge. They pass through the app's function on Atlassian and are not stored.

Only the requests in a merge that an agent has previewed and confirmed. Using the write:jira-work and write:servicedesk-request permissions, the app:

• adds to the main request: copies of the duplicate's comments (internal comments stay internal; public comments stay public or are copied as internal, as an administrator chose), copies of its files, its reporter and request participants, its organizations, its watchers and its issue links;
• links the duplicate to the main request as a Duplicate;
• adds an internal note to both requests about the merge, and, if an administrator chose to tell customers, a public comment on the duplicate saying where the request went;
• moves the duplicate to the done status a Jira administrator chose, and sets the resolution they chose, if they chose one.

The app does not delete anything. It does not edit or remove existing comments, files, links or people, change other fields, reopen requests, or change permissions, workflows or settings in Jira.

The app stores, in Forge's Atlassian-hosted storage within your site's data residency region:

• Site settings: whether to tell customers, the largest file to copy, and the account ID of whoever saved last.
• Project settings: for each service project, whether merging is on, the done status and resolution (IDs and names), and the account ID of whoever saved last.
• The merge log: for each merge, the project, issue keys, the plan and counts for each duplicate, the names, sizes and reasons of files and other items not copied, notes, the step reached, any error, and the account IDs of the agents who started or continued it and of any participants or watchers who could not be added.
• A list of the last 10 merge IDs for each request, a lock on each request while a merge that includes it runs, and the ID and date of the first finished merge and when an administrator closed the note (used for one review prompt on the settings page).

No comment text, file content, display names or email addresses are stored. Reasons and errors are Jira's own messages; any email address in them is replaced before they are stored.