Last updated 16 August 2026
There is no server of ours. This app runs entirely inside Atlassian's own infrastructure on the Forge platform. Nothing it reads or writes is sent anywhere else, because there is nowhere else for it to go.
It records who approved a page, and which version of that page they approved. When the page is edited, it says the approval has been superseded. That is the whole job.
It never writes to your Confluence. It does not change your pages, lock them, gate publishing, or add anything to their content.
What it stores is one small record per page: the decision, the display name of the person who made it, the version number, a note if one was left, and a fingerprint of the page at that moment. The fingerprint is a short hash, not a copy: it changes when the content changes and cannot be turned back into your text. That is what lets an approval survive Confluence renumbering its own version history.
It is kept in Forge storage, which is Atlassian's, scoped to your installation, and deleted when you uninstall.
| Permission | What it is for |
|---|---|
read:page:confluence |
To read the page's current version and produce the fingerprint. This comparison is the entire product, so this one is not optional. |
read:confluence-user |
To record who approved. An approval with no name on it is worth very little. |
storage:app |
To keep the decision record. |
One piece: the display name of whoever approves or requests changes, so the page can say who it was. That is shown to anybody who can read the page, which is the point of an approval. Nothing else about your users is read or kept.
Page content is read in order to fingerprint it and is never stored. Only the hash is kept.
None. No analytics, no tracking pixels, no third-party scripts, no telemetry back to us. Atlassian collects its own platform-level operational metrics about app invocations, as it does for every Forge app, and that is described in Atlassian's own privacy policy.
Inside your Atlassian instance, in the region Atlassian hosts it in. The app makes no outbound network calls to any other host. It is eligible for Atlassian's Runs on Atlassian programme, which is their check for exactly this: that an app stores its data on Atlassian infrastructure and does not egress.
Uninstall the app and its storage goes with it, including every approval record. Your pages are untouched, because the app never wrote to them.
Support requests reach us by email. If you send us a description of a problem, we hold that email in order to answer it, and for no other purpose. We do not add support contacts to any mailing list.
If this policy changes, the date at the top changes with it. If a change ever made the statement at the top of this page untrue, that would be a different product, and it would be said plainly here and on the listing rather than buried in a revision.