Hooks — Privacy Policy

Effective date: 2026-06-05 Last updated: 2026-09-07

This privacy policy describes how Hooks ("we", "us", "the app") handles your data. Hooks is an Atlassian Marketplace app distributed via the Atlassian Forge platform. By installing Hooks, you agree to this policy.

Summary in plain English

All data stays inside Atlassian's infrastructure. Hooks performs all analysis inside Atlassian's Forge runtime. No End-User Data is transmitted to any third party or outside Atlassian's infrastructure.
We don't operate any servers. Hooks runs on Atlassian Forge — Atlassian hosts every function call and storage write.
All stored data is encrypted at rest in Forge's Key Value Store, tied to your Atlassian Cloud site. It is never logged or returned to any third party; all processing happens inside Atlassian's Forge runtime.

1. Data we access

Hooks is an admin-only automation tool. A Jira administrator writes TypeScript/JavaScript scripts; Hooks executes them against your Jira site using the app's granted scopes. The data Hooks accesses is therefore determined by the scripts your administrators write, within the boundary of the scopes below.

From your Atlassian site (via Forge-managed calls)

Jira work items — fields such as summary, status, assignee, priority, and issue type returned by a script's jira.search / jira.getIssue calls, and any field a script reads via the generic jira.request escape hatch. Hooks reads only what a running script asks for.
The app/user profile (GET /myself) when a script calls jira.myself().
Jira event payloads — for event-triggered hooks (work item created / updated / deleted / assigned, comments, worklogs, links, attachments, project versions), the issue-event payload Atlassian delivers to the trigger (e.g. the affected work item's key and changed fields), exposed to the script as context.event.

Stored by Hooks (in Forge Key Value Store)

Script content authored by your administrators (name, code, kind, enabled flag, version).
Version snapshots — the last 20 saved versions of each script's code.
Run records — for each execution (console or triggered): the script's own console.* log lines, its returned value, timing, status, and any error stack. These contain only what the script itself emits — Hooks does not separately harvest work-item contents or user data.

Hooks accesses no other data — not group memberships, not Confluence, not billing, not search history, and no Atlassian account data beyond what a script explicitly requests.

2. Where data is stored

Hooks stores the following entities in Forge Key Value Store, hosted and encrypted by Atlassian:

Hooks stores the following entities in Forge Key Value Store (storage:app), all of which are administrator-authored automation content, not harvested personal data:

Entity	Contents
Script index	The list of saved script names/slugs
Script record	Name, code, kind (`console`, one of ten event kinds such as `onCreate`/`onUpdate`/`onComment`, `onSchedule`, `onJql`, or `onField`), enabled flag, current version, last-updated timestamp
Version history	Up to the 20 most recent code snapshots per script
Run history	Up to the 50 most recent run summaries (status, name, trigger, duration, timestamp)
Run record	Per-run detail: the script's `console.*` logs, returned value (capped at 100 KB), and error stack

Hooks does not maintain per-user records keyed by accountId, recommendation lists, or any deliberate store of personal data. Run logs contain only what a script emits.

Forge Key Value Store data is encrypted at rest by Atlassian using AES-256 and tied to your Atlassian Cloud site. Hooks operates as a tenant inside this storage; we cannot access the data without going through Forge's authenticated APIs invoked by an admin user of your org.

Hooks performs all analysis inside Atlassian's Forge runtime. No End-User Data is transmitted to any third party or outside Atlassian's infrastructure.

Data residency: Forge storage follows Atlassian's data residency commitments. If your Atlassian site is in a specific data region, Hooks's storage stays in that region.

3. Data we share with third parties

None. Hooks makes no external network calls of any kind. It has no analytics provider, no error-reporting service, no AI vendor, no telemetry, and no third-party SDKs. The app declares no external fetch hosts (permissions.external.fetch is empty).

The only API Hooks contacts is the Atlassian Jira REST API, reached through Forge's internal requestJira proxy — an Atlassian-operated endpoint inside the Forge runtime, not an external service. No End-User Data ever leaves Atlassian's infrastructure.

3a. Account actions and data changes

Hooks holds the write:jira-work scope, so an administrator's script can modify Jira work items — for example add a comment (jira.addComment), update fields (jira.updateIssue), move an item through a workflow (jira.transition), or call any Jira write endpoint via jira.request. Every such change is:

Initiated by an administrator's own script — Hooks performs no actions on its own and ships with no built-in automations that modify data.
Recorded — each run (manual or triggered) is captured in Hooks' run history with the script's logs, result, and any error, so what a hook did is auditable.

Hooks does not manage user accounts, group memberships, licences, or Atlassian configuration. It has no admin/user-management scopes. Its write capability is confined to Jira work-item content, exercised only by the scripts your administrators choose to write and enable.

4. Data we do NOT collect

Issue contents, comments, attachments
Document contents (Confluence pages, JSM tickets, JPD ideas)
User passwords or authentication tokens beyond what you explicitly provide via Settings
Behavioral or telemetry data about how admins use Hooks
IP addresses or geolocation
Cookies (Hooks runs inside Atlassian's iframe — Atlassian's cookies apply, not ours)

5. Data retention

Scripts and the current version persist until an administrator deletes the script.
Version snapshots are capped at 20 per script — older versions are evicted automatically.
Run history is capped at 50 runs — older runs (and their detailed records) are evicted automatically as new runs occur.
Hooks stores no API keys, no credentials, and no settings containing personal data.

There is no external retention because nothing is sent off-platform; all retention is inside your site's Forge storage and bounded by the caps above.

On uninstall: Atlassian automatically purges all Forge storage associated with the app within 30 days per Atlassian's Forge data lifecycle policy.

5a. Automatic erasure on Atlassian account closure

Hooks implements Atlassian's personal-data reporting flow. Once a week, Hooks posts the list of Atlassian accountIds for which it stores personal data to Atlassian's report-accounts endpoint. If Atlassian responds that an account has been closed (the user has exercised right-to-erasure, or the account has been permanently deactivated) or updated (data is stale or the user requested a refresh):

Hooks does not deliberately store personal data tied to an accountId (it has no report:personal-data flow and keeps no per-user records). The only place End-User Data could appear is inside a run record's logs or returned value, and only if an administrator's script explicitly logged or returned it. Those run records are:

Bounded — only the last 50 runs are kept; older ones are evicted automatically.
Removable — an administrator can delete a script (removing its versions); run history rolls off as new runs occur and can be cleared by removing the hooks that produce it.

On app uninstall, Forge removes the app's Key Value Store data, erasing all stored scripts, versions, and run records.

You can also trigger the same erasure path for any user by clearing their entries through any in-app "Clear all data" developer tool, or by uninstalling Hooks entirely.

6. Your rights

You have the right to:

Access the data Hooks stores — visible in the in-app screens
Export any in-app audit log as CSV (where the app exposes one)
Delete all data via any in-app "Clear all data" developer tool, or by uninstalling Hooks
Be erased automatically when Atlassian flags your account as closed (see section 5a)

For requests under GDPR, CCPA, or similar regulations, contact us at support@taskhooker.com. The automatic erasure flow runs weekly; if you need faster action, email us and we'll process the deletion manually.

7. Children's privacy

Hooks is a business administration tool for Atlassian Cloud organisations. It is not intended for, marketed to, or used by individuals under 18. We do not knowingly collect data about minors.

8. Changes to this policy

We may update this policy when materially new features ship. The "Last updated" date at the top reflects the most recent change. Material changes will be communicated via the Marketplace listing and any in-app notice we deem appropriate.

9. Contact

For privacy questions:

Email: support@taskhooker.com
Website: https://hooks.taskhooker.com
Address: Melbourne, Australia