Privacy notice

Purpose

RuleWatch lets a Jira administrator monitor whether a recurring Jira Automation rule's configured success-path heartbeat was observed within an interval and grace period. A missed signal prompts investigation; it does not prove that the automation itself failed.

Data used and stored

A monitor stores its name, timing configuration, status, last heartbeat, Jira alert project key and work type ID, and optionally an assignee's Atlassian account ID. It records when the account ID was supplied so it can report the age of the stored reference.

RuleWatch stores a hash of each monitor's Bearer credential; the plaintext is shown once to the Jira administrator and is not stored by RuleWatch. Incident history stores monitor and timing details, Jira issue keys and IDs, and write status. The privacy-enabled release does not persist a second assignee account ID in new incident records, and its first privacy cycle removes any such field left by older releases.

RuleWatch creates Jira incident issues and recovery comments containing the monitor name, relevant times, and a RuleWatch incident ID. Jira itself retains the selected issue assignee under the site's Jira data controls. Administrators should avoid personal or sensitive information in monitor names.

Hosting, access, and logs

RuleWatch uses installation-scoped Atlassian Forge-hosted Custom Entity Store and Jira on the installing site. It has no external backend or outbound domain. Management requires Jira administrator permission, checked by the backend. The web trigger accepts a heartbeat only with that monitor's Bearer credential.

The app owner can access operational Forge logs; Jira users' access to created issues follows their site's Jira permissions. Jira error response bodies, which can contain customer data, are not logged by RuleWatch. RuleWatch does not use advertising, tracking pixels, or unrelated analytics.

Atlassian privacy reporting

The installed app reports each stored assignee account ID and the oldest recorded time it was supplied through Atlassian's User Privacy API. The default cycle is seven days; RuleWatch follows a different Cycle-Period response header if Atlassian provides one. A five-minute Forge checker runs the cycle when due and retries failures, respecting a Retry-After response.

If Atlassian marks an account closed or updated, RuleWatch clears that optional assignee reference from all affected monitors; a Jira administrator may then select another assignable user if needed. Historical incident copies are scrubbed before reporting. The report:personal-data Forge scope is required for this API.

Retention and removal

A Jira administrator can clear or change an assignee in monitor settings, or delete the monitor. Deleting a monitor stops its heartbeat and removes its stored configuration, including the account ID. Incident history remains until uninstall; its privacy-enabled form has no assignee account ID.

Before uninstall, Forge invokes RuleWatch's cleanup function to delete this installation's monitor and incident records. Atlassian says a pre-uninstall function has a 55-second, non-blocking window, so this cleanup cannot be guaranteed if it fails or times out. Forge then applies its hosted-storage uninstallation retention and deletion process. Jira issues and comments remain under the site's Jira retention and deletion controls.

Requests and corrections

Privacy and support contact: lilenginesoftware@gmail.com. A site administrator can remove or change a monitor's assignee account ID immediately. Little Engine Software will coordinate any remaining request with the site administrator and review the installation's stored records. Atlassian's closed and updated responses are also handled automatically as described above.

Heartbeat credential handling

The Bearer value is replayable: anyone holding it can send a false healthy heartbeat. Put it in a hidden Jira Automation header, restrict rule editors, and rotate it if exposed. Do not include it in support requests or pilot notes.

Further reading

See Atlassian's Forge user privacy guidelines, Privacy API reference, pre-uninstall trigger reference, and hosted-storage lifecycle.