App Privacy Policy

Last updated: 26 October 2026

This policy covers Delivery Gadgets for Jira Cloud, an app distributed through the Atlassian Marketplace. For this website, see the Website Privacy Policy.

In short

• Delivery Gadgets reads work item data from Jira as the person viewing the dashboard, with read-only access.
• It processes that data in your browser. No data is transmitted outside Atlassian's Jira Cloud and Forge platform, and we receive none of it.
• To avoid loading the same data twice, the app keeps a copy in your browser's session storage for at most five minutes.
• What we do process is the licensing and contact data Atlassian provides to us, and the support requests you send us (see part 2).

Part 1: What the app does with data

What the app reads

Delivery Gadgets reads data from your Jira site through Jira's REST API, always as the person viewing the dashboard. It sees only what that person is allowed to see in Jira. The app has read-only access (the read:jira-work permission) and cannot create, change or delete anything in Jira.

To draw its charts, the app reads the following for each work item in the selected project or saved filter (Jira's API calls work items "issues"):

• its ID and key,
• when it was created, last updated and resolved,
• its status (ID and name), and when that status changed.

The app does not request summaries, descriptions, comments, assignees or custom fields.

What the app discards

To see when a work item's status changed, the app reads its change history. Jira includes the person who made each change in that history, with their name and email address. The app discards this information as soon as it arrives. It is never stored, displayed or logged.

Where the data goes

No data is transmitted to any destination outside Atlassian's Jira Cloud and Forge platform, which hosts this app. The app has no backend of its own and sends no telemetry or usage data. The app itself sets no cookies. We therefore receive none of the data the app reads.

The app does keep a short-lived copy of some of this data in your browser (see Browser cache).

Browser cache

When a dashboard shows several gadgets, they often need the same data. To avoid loading it more than once, the app keeps a short-lived copy of the data listed under What the app reads in your browser's session storage.

• Each entry is kept for at most five minutes.
• Session storage belongs to a single browser tab.
• The entries are labelled with a pseudonym derived from your Jira site and account (a SHA-256 hash), never with your account ID in clear text. A pseudonym is not anonymous: it can still be linked to you.
• Your browser manages session storage. Browsers may keep it on disk, for example to restore tabs after a restart, and copy it when you duplicate a tab. The app removes its own expired entries the next time a gadget loads.

Nothing in this cache is transmitted anywhere.

Gadget configuration

When someone sets up a gadget on a dashboard, Jira stores the chosen settings as part of the dashboard: the source (a project or saved filter, with its ID and name) and the display options. Everyone who can view the dashboard can see these settings, including the name of the project or filter, even if they cannot open that project or filter themselves. We have no access to these settings.

While a gadget is being set up, the configuration form lists the projects and saved filters that the person editing it can see in Jira, by name. It shows no information about people, such as who owns a filter.

Atlassian's role

Atlassian operates Jira Cloud and the Forge platform that hosts and serves this app. How Atlassian processes data in Jira, including the data the app reads, is described in Atlassian's privacy policy. Atlassian's platform may set cookies when it serves the app; Atlassian's privacy policy covers those as well.

Our role for this data

Because we receive none of the data the app reads, and the app stores it only briefly in your browser, we are neither a controller nor a processor of that data under the GDPR. For the same reason, we do not offer a data processing agreement (DPA) for the app. Part 2 describes the data we do process.

Part 2: What we process in connection with the app

Licensing and contact data from Atlassian

Atlassian sells the app and handles all payments. Atlassian provides us, as the app's vendor, with licensing information through its Marketplace reports, including for trials. This can include your organisation's name, the name and email address of your technical and billing contacts, licence details such as edition, user tier and subscription dates, and the Atlassian Solution Partner involved, if any. We do not collect this data from you directly.

We use it to manage licences, to answer questions about your subscription, and to inform your technical contact about important changes to the app, such as security updates. We do not use it for marketing. The legal basis is Art. 6(1)(b) GDPR where we need the data to perform our agreement with your organisation, and otherwise our legitimate interest in managing our customer relationships (Art. 6(1)(f) GDPR).

We do not pass this data on. We delete it no later than three years after your subscription ends, unless the law requires us to keep it longer.

Support requests

When you contact our support through the support portal or by email to support@deliverygadgets.com, we process what you send us: your name, your email address, the content of your request and any attachments, and, where needed to help you, your licence information. We use it to answer your request and to fix problems you report. The legal basis is Art. 6(1)(b) GDPR where your request concerns your subscription, and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

We handle support requests in Jira Service Management, a service of Atlassian, which processes them on our behalf under Atlassian's data processing addendum. Emails to support@deliverygadgets.com are received by our email provider, United Domains (Germany), and forwarded to Jira Service Management. Atlassian may process data outside the European Union; its data processing addendum provides the EU Standard Contractual Clauses for such transfers.

We delete support requests no later than three years after they are closed, unless we need them longer to establish or defend legal claims.

Who is responsible

The processing described in part 2 is the responsibility of Marco Spörl, who publishes Delivery Gadgets (on the Atlassian Marketplace under the vendor name Marco Spoerl). The postal address is in the site notice. For privacy questions, email privacy@deliverygadgets.com.

Your rights

For personal data we process (part 2), you have the right under the GDPR to access it, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interests. To exercise these rights, email privacy@deliverygadgets.com.

We do not hold the data in your Jira site, including what the app reads. For that data, contact your organisation's Jira administrator or Atlassian.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, www.lda.bayern.de).

Changes to this policy

We update this policy when the app or our processing changes. The date at the top shows when it was last updated.