Privacy Policy

Last updated: 2 August 2026

1. Who we are and what this policy covers

Aurora Diagrams is a Jira Cloud app published by Aurora Makers ("we", "us"). It adds a diagram editor to Jira as an issue panel on every issue and as a full-page workspace under Jira → Apps.

This policy covers:

• The Aurora Diagrams Forge app — installed by an administrator into an Atlassian Cloud site and used by that site's Jira users.
• This marketing website — the pages you are reading now. It is covered separately in section 11, and the answer there is also "nothing is collected".

It does not cover Atlassian's own products and services. Your use of Jira Cloud is governed by your organisation's agreement with Atlassian and by Atlassian's own privacy policy.

2. The architecture, because it determines everything else

Most privacy policies for SaaS add-ons describe what a vendor's servers do with your data. Aurora Diagrams has no such servers, so most of that section does not exist here, and this is a verifiable technical property rather than a promise.

• The app is built on Atlassian Forge. Its front end runs in a sandboxed Forge iframe served by Atlassian, and its back end is a Forge function that runs on Atlassian's infrastructure — not ours.
• The app makes zero external network calls. It has no configured egress permissions in its manifest, which means the Forge platform itself blocks any outbound request to any domain. There is no analytics endpoint, no error-reporting endpoint, no font or script CDN, no "phone home" of any kind.
• Because of this, the app qualifies for Atlassian's "Runs on Atlassian" designation, which the Forge CLI confirms at deploy time.
• All persistence uses Forge storage, which is provisioned per installation and lives inside your own Atlassian Cloud site.

The practical consequence: even if we wanted your diagram content, we would have no path to it. There is no vendor-side database to breach, subpoena, or misconfigure.

3. What the app stores, and where

Everything below is written to Forge storage inside your Atlassian site. None of it is transmitted to Aurora Makers.

• Diagram documents — the shapes, connectors, text labels, colours, positions and theme of each diagram, serialised as JSON. Large documents are split into chunks purely for storage reasons.
• Diagram metadata — the diagram title, its identifier, creation and last-updated timestamps, and its size.
• Version snapshots — immutable copies of a diagram taken when a version is saved, so that version history and visual diff work. Snapshots carry an optional label, a timestamp, and a shape count. The app retains up to 30 snapshots per diagram and prunes the oldest beyond that.
• Scope index — a small list mapping each diagram to where it belongs: either a specific Jira issue (diagrams created in that issue's panel) or the app workspace (diagrams created in the full-page workspace). Diagrams are visible only within the scope they were created in.

The one personal identifier

Each diagram and each version snapshot records the Atlassian account ID of the user who created it and of the user who last updated it. This is used so the app can show "last edited by" style attribution in version history.

• An Atlassian account ID is an opaque identifier (for example 5b10a2844c20165700ede21g) that Atlassian supplies to the app at request time. It contains no name and no email address.
• It is written to Forge storage in your site and stays there. It is never sent to Aurora Makers, because nothing is ever sent to Aurora Makers.
• This is the only personal identifier the app handles. Resolving it to a human — a name, avatar or email — happens in Atlassian's own systems, not in ours; the app does not have permission to perform that lookup.

4. What we do not collect

To be explicit, Aurora Makers does not collect, receive, store or process any of the following:

• Diagram content — we never see your shapes, labels, notes or exports.
• Names, usernames, avatars or job titles.
• Email addresses.
• IP addresses or any other network identifiers.
• Jira issue data — summaries, descriptions, comments, attachments, project names, workflow states or custom fields.
• Usage analytics or product telemetry — no event tracking, no feature-usage counters, no heatmaps, no session recording.
• Crash or error reports. Errors are handled inside the app; nothing is reported to us.
• Cookies of any kind, and no local-storage identifiers used for tracking.
• Advertising or device identifiers, and we run no advertising and share nothing with ad networks.
• Training data. No customer data is used to train, fine-tune or evaluate any AI or machine-learning model — ours or anyone else's. The app's text-to-diagram feature parses Mermaid-style syntax locally in your browser using deterministic code; it calls no AI service and sends nothing anywhere.

We also do not sell, rent, share or disclose customer data, because we do not hold any.

5. Permissions the app requests

Aurora Diagrams requests exactly one Forge scope:

That is the entire permission set. In particular, the app cannot:

• read or modify Jira issues, comments, attachments, projects or boards;
• read your user directory, group memberships, profiles or email addresses;
• act on behalf of a user against the Jira REST API;
• make any outbound network request, to us or to anyone else.

Forge enforces these limits at the platform level, and Atlassian displays the requested scopes to your administrator before installation. If a future version of the app ever needed an additional scope, Atlassian would require an administrator to review and approve the upgrade before it took effect.

6. Sub-processors and third parties

Aurora Makers uses no sub-processors for customer data, because no customer data reaches us.

The only third party involved is Atlassian, which acts as the platform, host and storage provider for the app as part of your existing Jira Cloud subscription. Data written by the app is held in Atlassian's infrastructure under your organisation's agreement with Atlassian and is governed by Atlassian's privacy policy and the security and compliance information published in the Atlassian Trust Center.

There are no analytics providers, no error-tracking providers, no CDNs, no payment processors (the app is free), and no AI or LLM providers in the data path.

7. Data residency

Because all app data is stored in Forge storage belonging to your installation, it resides wherever your Atlassian Cloud site's data resides. Aurora Diagrams inherits your site's data-residency configuration and any in-scope Forge data-residency support that Atlassian provides — we neither choose the region nor operate any storage that could move data out of it. If your organisation pins its Atlassian data to a particular region, the app's data follows that decision automatically.

8. Retention and deletion

• While in use. Diagrams persist until someone deletes them. There is no expiry and no background archival by us.
• Deleting a diagram. When a user deletes a diagram in the app, the app removes its document chunks, every version snapshot belonging to it and their chunks, its metadata record, and its entry in the scope index. Version history for that diagram is not recoverable afterwards.
• Version pruning. When a diagram exceeds 30 saved versions, the oldest snapshot and its data are deleted automatically.
• Uninstalling the app. When an administrator uninstalls Aurora Diagrams, the Forge storage for that installation is removed by Atlassian in accordance with Atlassian's platform retention behaviour for app data. Aurora Makers holds no copy, no backup and no archive, so there is nothing for us to delete and nothing for us to restore. If you need your diagrams, export them to PNG, SVG or JSON before uninstalling.
• Backups. Any backup of this data is part of Atlassian's platform backups of your site. We take none.

9. Children's data

Aurora Diagrams is a business tool distributed through the Atlassian Marketplace and is not directed at children. It is used by people with an Atlassian account provisioned by their organisation. We do not knowingly collect information from anyone, including children under 13 (or under 16 where applicable), and we hold no account records of any kind.

10. GDPR, CCPA and data-subject rights

We describe our factual position rather than claiming a certification.

Controller and processor. Your organisation is the controller of everything the app stores — you decide what diagrams to create and what to put in them. Atlassian acts as your processor and hosts the data as part of your Jira Cloud subscription. Aurora Makers supplies software, but is not in the data path: we do not receive, transmit or store personal data from the app, and therefore act as neither controller nor processor of your app data in the ordinary course of providing it.

Exercising rights. Because of this, requests for access, correction, export, restriction, objection or erasure of data held by the app should be directed to your own Jira administrator, who can view, export or delete diagrams directly in the product, or to Atlassian for anything held at the platform level. We have no data store to search and no means of identifying an individual from an Atlassian account ID, so a request sent to us cannot be fulfilled by us — though we are happy to explain where the data lives and how to remove it.

CCPA/CPRA. We do not collect personal information from California residents through the app or this website, we do not sell or share personal information, and we do not use it for cross-context behavioural advertising. There is therefore no "Do Not Sell or Share" mechanism to offer, because there is nothing to opt out of.

International transfers. Since the app performs no egress, no transfer of app data out of your Atlassian site occurs by our doing. Any transfer arrangements are those between your organisation and Atlassian.

Legal requests. If we received a subpoena or government demand for customer diagram data, we would have nothing to produce. Such requests would have to be directed to the organisation that owns the Atlassian site, or to Atlassian.

11. This website

This marketing website is static. It sets no cookies, uses no analytics (no Google Analytics, no Plausible, no pixel of any kind), embeds no third-party fonts, scripts, videos or social widgets, and shows no consent banner because there is nothing to consent to. We do not build profiles of visitors and run no email marketing lists. Standard server request logs may exist at the hosting layer for operational and security purposes; we do not use them for analytics, profiling or advertising.

12. Security

The app's security posture is largely inherited from Forge: code runs in Atlassian's sandboxed runtime, storage is isolated per installation, authentication and authorisation are handled by Jira itself, and the platform blocks network egress that the manifest does not declare — and ours declares none. The app also ships a strict content policy and performs no dynamic code evaluation. We make no certification claims: Aurora Makers is not SOC 2 or ISO 27001 certified, and we would rather say so plainly than imply otherwise. Questions from a security reviewer are welcome at the address below, and the manifest and requested scopes are visible to your administrator at install time.

13. Changes to this policy

If this policy changes, we will update the "Last updated" date at the top of this page. Any change that would materially alter what the app stores or introduce data collection of any kind would come with a new app version and, where an additional Forge scope is involved, a fresh administrator approval before it could take effect. We recommend reviewing this page when you upgrade the app.

14. Contact

For privacy questions, security review questions, or help with a data request, contact us at support@auroramakers.com. General product help is on the support page.