Leafward — privacy

Last updated 13 August 2026

Leafward is an Atlassian Forge app for Confluence Cloud. This page describes exactly what it holds, where it holds it, and what it never touches. It describes behaviour rather than making legal claims: everything below is a statement about the software, and each one is enforced by a test in the codebase rather than by a promise on a web page.

Nothing leaves Atlassian

Leafward declares no egress permissions. A Forge app can only reach the internet if its manifest says so, and Leafward’s does not. There is no server of ours, anywhere, for your data to travel to — which is why a security review of Leafward has no third-party host to ask about.

Everything Leafward computes runs inside Atlassian’s infrastructure, and everything it keeps is stored in Atlassian’s app storage, in the same region as your Confluence site.

What Leafward stores

Only what it needs to show you an impact preview before it writes anything, and to keep a record of what it wrote:

• Account identifiers — the opaque Atlassian ids that appear in page restrictions.
• Page and space identifiers, and page titles, so a preview and a run journal can name the pages they are about.
• Restriction sets — who a page is restricted to, as identifiers.
• What Leafward did: which pages it changed, when, at whose request, with the reason the person typed if they typed one.

What Leafward does not store

Display names. Not in a plan, not in a run journal, not in a queued job, not in a cached scan. Names are read from your directory at the moment a screen shows them and are never written down.

This is deliberate and it is Atlassian’s own recommendation for apps. An app that stores display names must enrol in Atlassian’s personal-data reporting cycle — declaring every account it holds, every seven days, for as long as the app exists. Leafward removes the obligation instead of servicing it.

Page content. Leafward reads which pages exist, how they are arranged and who they are restricted to. It never reads, stores or transmits what a page says.

Email addresses, group membership, or anything about who people are. Leafward cannot list who belongs to a group — no Confluence app can — and it never claims to.

How long it keeps things

• Run journals: the fifty most recent runs. Older ones are dropped automatically, with everything attached to them.
• Impact previews: the fifty most recent. A preview is only useful until the page it describes changes.
• Site scans: five minutes, as a cache.
• The access-review baseline: one, replaced when you take a new one.
• Automatic-inheritance and space-access logs: bounded, oldest dropped first.

Uninstalling Leafward removes its storage. Atlassian handles that; we cannot retain a copy, because there is nowhere for us to retain it.

Sub-processors

None. Leafward has no infrastructure of its own and uses no third-party service — no analytics, no error reporting, no logging service, no content delivery network. The list of companies that process your data through Leafward is empty.

The app’s own account

Confluence refuses any restriction that would lock out the account making the change, so Leafward’s own app account appears in every restriction it writes. You will see it named in the list of people a page is restricted to. This is a property of Confluence, not a choice, and no app can avoid it. Leafward shows it in the preview rather than hiding it.

Questions

Write to [email protected]. If you are completing a security questionnaire and need something stated in a particular form, ask — it is usually quicker than guessing which of the sentences above answers the question.