Data, privacy and AI

The short version: all data stays on Atlassian infrastructure. The vendor never sees it.

Where data lives

All app data is stored in Forge hosted storage on Atlassian infrastructure, isolated per site. There are no third-party services, no analytics, no tracking and no external data flows of any kind. Forge hosted storage follows the data residency settings of the host product.

What the app stores

Per reminder: the owner’s account ID, the ticket key or JQL text, the trigger definition (including the AI condition text if used), notification channels, the owner’s profile language, status and timestamps. Additionally: in-app notifications, an audit log per reminder, and usage counters for AI Credits. The site’s monthly pool is counted anonymously; alongside it the app keeps a per-user counter for each month.

An in-app notification holds the subject, the timestamp and the notification text. For comment and AI triggers that text contains an excerpt of the triggering comment, at most 200 characters long. The excerpt is exactly what the recipient is allowed to read in the ticket anyway, and the app checks that permission again when the inbox is read. Beyond this excerpt, ticket contents are not copied into app storage.

What is in scope for data residency

Atlassian leaves the definition to the app vendor and requires it to be published. For HeadsUp the answer is short.

All app data is in scope. Everything the app stores, as described above, is kept in Forge hosted storage on Atlassian infrastructure, which follows the location pinned for the host product.

Nothing is out of scope. The app stores nothing outside Forge hosted storage and defines no egress of its own.

Comments with restricted visibility

Comments restricted to a project role or a group do not reach HeadsUp at all. The app runs under its own app user, and Jira delivers no event for a comment that this user cannot see. Internal Service Management notes do arrive, because the app has agent visibility there. For everything that arrives, HeadsUp never stores, shows or sends the text: notification, inbox entry and audit log carry a neutral sentence instead of the excerpt, and no auto comment is written for them. AI reminders skip such comments entirely, so their text never reaches a model and no credit is used. A project administrator can deliberately add the app user to a restricted role; the comment then triggers a reminder, and the suppression of its content stays in place. See Setup and permissions.

One limit belongs with this. The app reacts to the comment event. A comment that is written openly and restricted seconds later has already been delivered as an open comment by then, and a later restriction does not reach back into a mail that is on its way.

What the vendor can access

Nothing stored by the app: Forge hosted storage is operated by Atlassian and is not readable by the vendor. Operational platform logs are deliberately kept free of personal data and content; they contain technical identifiers and error messages, but no comment texts, no AI reasoning and no full account IDs.

AI processing

Reminders with an AI condition evaluate new comments via the Forge LLMs API: models hosted and operated by Atlassian on Atlassian infrastructure. Comment texts do not leave the Atlassian platform. Atlassian’s Acceptable Use Policy and AI moderation apply. There are no AI costs for the customer organization; model usage is billed to the app vendor.

Every AI decision is written to the reminder’s audit log in the site’s own app storage, where users can review it.

AI Credits in detail

• Monthly pool per site: licensed Jira users × 20 (Standard) or × 200 (Advanced) AI Credits, with a guaranteed minimum pool for small sites (100 and 500) and a ceiling at 1,000 users. Where a site licenses several Jira products, the largest product count applies, so nobody is counted twice.
• All users share the pool freely, following the same model as Atlassian Automation. Usage is visible to everyone in the app.
• When the pool is exhausted, AI reminders pause until the first of the next month. Anyone whose AI reminder wants to fire after that is notified once per month, in the inbox and by email; anyone without one is not notified. All other functionality continues normally.
• Cost controls built in: comments are pre-filtered by JQL before any AI call, comments shorter than 15 characters are never evaluated, and comments written by apps and automations never reach a model either.

Automatic housekeeping

Two scheduled runs keep the shared AI Credits from being wasted. Neither of them deletes anything.

When a Jira account is deactivated, a daily run pauses that person’s reminders. Watchers of accounts that have left would otherwise keep running and keep drawing from the site’s shared AI Credits, and for AI triggers the credit is consumed before the model is even called. The app only pauses on an explicitly deactivated account; if the state cannot be determined, the reminder is left alone. Reactivating the account deliberately does not reactivate the reminders: after a longer absence old watchers are often no longer wanted and would immediately start consuming AI Credits again. Each affected entry carries a Reactivate button, so the person decides which ones they still need.

Expiry dates are checked hourly. Users can give repeating reminders and filter alerts an expiry date, and no expiry is preselected. Expired rules are paused and can be extended with one click.

Retention

In-app notifications and the audit log have no expiry date. Nothing in the app deletes them on a schedule; the two scheduled runs above only change the status of reminders. They stay in the site’s own app storage until they are removed through the deletion function in the app, and at the latest when Atlassian deletes the app storage after uninstalling.

Deletion and uninstall

Users can delete individual reminders anytime. Doing so also removes that reminder’s audit history and the user’s own notifications about it; on a shared reminder the owner’s inbox is left untouched. One action inside the app removes everything else that belongs to a user: every reminder, the complete inbox, the audit history, the personal usage counters and the marker for the welcome dialog. The welcome dialog reappears afterwards, which is intended. After uninstalling, Atlassian deletes the app’s storage according to the Forge platform retention period (currently 28 days). The vendor holds no copies.