Hourward — privacy and data handling
Last updated 25 August 2026
The short version
Hourward stores no worklogs, no names, and no email addresses. The time your team logs is written into Jira’s own worklogs, inside your Atlassian site, and it stays there. The app declares no permission to send data outside Atlassian, and it runs entirely on Atlassian’s infrastructure.
What the app stores
One record per person, per week, in Atlassian’s app storage — which lives in your site’s own region.
| Field | Example | Why |
|---|---|---|
| Week | 2026-08-17 | which week the record is about |
| Owner | 712020:1111… | an Atlassian account id — a pseudonymous reference, never a name |
| State | submitted | whether the week has been submitted, approved or sent back |
| Seconds claimed | 144000 | so the app can tell you if the hours changed after approval |
| Submitted at | timestamp | when the week was sent for approval |
| Decided by, decided at | account id, timestamp | who approved it and when |
| A reason, if a week is sent back | free text | written by the approver, shown to the person concerned |
Plus one setting per installation: the list of account ids allowed to approve, and when that list last changed.
The one place a name can appear is the free-text reason an approver types when sending a week back. It is theirs to write and it is shown to the person it concerns. Nothing else the app stores can contain a name — this is checked by an automated test that writes through every path and then searches the whole store.
What the app does not store
- No worklogs. Hours, comments, dates and issue keys live in Jira, where you already keep them.
- No display names or email addresses. Names are looked up from Jira when a screen needs to show one, and discarded when the screen closes.
- No copy of your issues, projects or users.
Where it runs, and where nothing goes
Hourward is a Forge app. It runs on Atlassian’s own infrastructure, and its storage is Atlassian’s, in the region your site is in.
It declares no egress permission — the Atlassian scopes named
read:app-system-token and read:app-user-token, which let an
app send data outside Atlassian, are deliberately absent. Atlassian’s own
tooling verifies this: the app is eligible for the Runs on Atlassian
programme, and Atlassian notifies your administrators if an update ever changed that.
There is no analytics service, no error reporting service, no third-party processor and no sub-processor to list, because there is nothing to send anywhere.
Who can see what
Hourward reads Jira as the person using it, never as itself. If Jira would not show you an issue, Hourward does not show you its hours either — and it says how many issues it could not read rather than quietly leaving them out.
Approving is limited to the account ids a Jira administrator names. Nobody can approve their own week, approver or not.
Deleting your data
Uninstalling the app removes its storage. Your worklogs are unaffected: they are Jira’s, and they stay in Jira. To have the approval records removed without uninstalling, write to [email protected].
Contact
Alexia — [email protected]
Security reports —
[email protected]
How the app is built and what it can reach is a separate document: security.