Privacy Policy

Last updated: 16 September 2026

1. Introduction

This Privacy Policy describes how Backlog Bridge ("we", "our", "us") collects, uses, and handles information when you use any of our applications published on the Atlassian Marketplace. Backlog Bridge is a brand operated by Anasita, MB, a company registered in Lithuania, European Union.

As an EU-based company, we comply fully with the General Data Protection Regulation (GDPR). We also respect applicable US privacy frameworks, including the California Consumer Privacy Act (CCPA) where applicable.

By installing or using any Backlog Bridge application, you agree to the practices described in this Privacy Policy.

2. What Data We Access

Our applications process data through Atlassian Forge and the official Jira APIs. An integration app may also connect to a third-party service that a Jira administrator explicitly configures. Depending on the application installed, this may include:

  • Issue data — issue keys, titles, types (Story, Epic, Sub-task), and hierarchy relationships
  • Time tracking fields — original estimates and logged time (worklogs) as stored natively in Jira
  • Project metadata — project keys and names, used to scope calculations to the correct context
  • User display names — shown within the application UI for context; not stored or processed externally
  • Integration configuration — for apps that connect to a service such as Nextcloud, the configured HTTPS URL, account identifier, and app-specific credential needed to make the connection
  • Connected-service metadata — for integration features, the folder, file, deal, contact, or other records requested from the service configured by the customer

We access only the data strictly necessary to provide the functionality of each application. No data is accessed beyond what the installed application requires.

3. What We Do Not Collect for Unrelated Purposes

Subject to the application-specific processing described above, Backlog Bridge applications do not collect or store:

  • Your Atlassian account password
  • Email addresses or personal contact information for marketing purposes
  • Personal data unrelated to the installed application's functionality
  • Behavioral analytics, usage metrics, or tracking data
  • Any data for advertising or marketing purposes

When an integration requires a customer-supplied app password or token, the application processes that credential only to establish and use the connection configured by a Jira administrator.

4. Data Storage and Retention

Backlog Bridge does not operate a separate external database for application data. Depending on the application's features, configuration and mappings may be persisted in Atlassian Forge hosted storage.

When Nextcloud for Jira saves a Nextcloud app password, it uses Forge encrypted secret storage. The application runtime can retrieve the credential when it needs to authenticate to the configured Nextcloud service, but the saved value is not returned to the administration UI.

Source Jira data — including worklogs, estimates, and issue metadata — remains in Jira. Data requested from a customer-configured service remains governed by that service, although the application processes the requested data at runtime to provide its Jira feature. Uninstalling a Backlog Bridge application does not modify or delete source data in Jira or a connected service.

App-owned configuration remains subject to the application's deletion behavior and Atlassian Forge's hosted-storage lifecycle. To stop a connected service from accepting an integration credential immediately, revoke that app password or token in the connected service. Contact support@backlogbridge.com with retention or deletion questions about a specific application.

5. Data Sharing and Third Parties

We do not sell, rent, or trade your data, and our applications do not integrate with external analytics platforms, advertising networks, or data brokers.

Atlassian Forge provides the application runtime and hosted storage and is governed by Atlassian's security and privacy terms. For details, refer to the Atlassian Privacy Policy. When a Jira administrator configures an integration with a service such as Nextcloud, the application sends the data and authentication request required for that feature only to the configured service endpoint.

6. EU/EEA Users — GDPR Rights

As a company registered and operating within the European Union, we comply fully with the General Data Protection Regulation (GDPR). As a data subject under GDPR, you have the following rights:

  • Right of access — request confirmation of whether we process your personal data and obtain a copy
  • Right to rectification — request correction of inaccurate or incomplete personal data
  • Right to erasure (right to be forgotten) — request deletion of personal data we hold
  • Right to restriction of processing — request that we limit how we process your data
  • Right to data portability — receive your data in a structured, machine-readable format
  • Right to object — object to processing based on legitimate interests
  • Right to withdraw consent — where processing is based on consent, withdraw it at any time

Many of these rights can be exercised in the source system, such as Jira or the customer-configured connected service. For questions about app-owned configuration or to exercise any right involving data processed by a Backlog Bridge application, contact us at support@backlogbridge.com.

You also have the right to lodge a complaint with your national data protection authority. In Lithuania, this is the State Data Protection Inspectorate (vdai.lrv.lt).

7. US Users — CCPA and State Privacy Rights

For users located in California or other US states with applicable privacy laws, the following applies:

  • We do not sell personal information as defined under the California Consumer Privacy Act (CCPA)
  • We do not share personal information for cross-context behavioral advertising
  • When account identifiers or credentials qualify as sensitive personal information under applicable law, we use them only to provide the customer-configured integration and do not use them to infer characteristics

Jira source data should be managed within the Atlassian Jira instance, and connected-service source data should be managed within that service. Contact us if a request concerns app-owned configuration or other data processed by a Backlog Bridge application.

To submit a privacy request or ask questions about your rights, contact us at support@backlogbridge.com.

8. Security

Our applications are built on the Atlassian Forge platform, which provides an isolated execution environment. Jira API calls use Atlassian's authentication mechanisms. When an integration requires a customer-supplied credential for a configured service, sensitive values are stored using Forge encrypted secret storage and retrieved by the application runtime only when needed for that connection.

We follow the principle of least privilege — each application requests only the minimum Jira API permission scopes required for its specific functionality. No write scopes are requested unless a feature explicitly requires creating or modifying Jira data, in which case this is clearly disclosed in the application listing.

9. Atlassian API Scopes

Each Backlog Bridge application requests only the scopes necessary for its functionality. These are disclosed individually on each application's Atlassian Marketplace listing. As a general principle:

  • read:jira-work — used to read issue data, time tracking fields, and project information
  • storage:app — used when an application needs Forge hosted storage for app configuration, mappings, or encrypted secrets
  • Write scopes are only requested when an application feature explicitly requires modifying Jira data, and are always disclosed

10. Children's Privacy

Backlog Bridge applications are professional productivity tools intended for use within business Jira environments. They are not directed at children under the age of 16 (or 13 in the United States). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at support@backlogbridge.com.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our applications, legal requirements, or business practices. When we do, the updated version will be published at www.backlogbridge.com with a revised effective date.

For material changes, we will make reasonable efforts to notify users via the Atlassian Marketplace listing or our website. Continued use of any Backlog Bridge application after changes are published constitutes acceptance of the updated Policy.

12. Contact and Data Controller

Backlog Bridge is a brand of Anasita, MB, the data controller for the purposes of GDPR. If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to report a concern, please contact us: