Privacy policy

This policy explains how YATT processes information when you use our Jira Cloud app, visit this website, or contact us.

1. Who operates YATT

YATT is operated by Andrii Bohun, an individual based in Ukraine. For privacy questions or requests, contact [email protected]. YATT is an independent app and is not operated by Atlassian.

2. Our role and your organization's role

Your organization decides why its employees' time and Jira information are processed and manages its Jira site, user permissions, and YATT configuration. For organizational app data, we provide YATT on your organization's instructions. We are responsible for our own processing of website, support, and business correspondence. Atlassian separately operates Jira and Forge under its applicable agreements and policies.

3. Information the app processes

• Jira identity and work information: account identifiers, display names and available profile information; issue identifiers, keys, summaries, projects and hierarchy; worklog authors, descriptions, dates, durations, visibility and related properties.
• App settings: personal working-hour targets, favorite issue references, view preferences, roles, team memberships, reporting schedules, timezone, holidays and access configuration.
• Reporting records: submissions, selected reviewers, approval and rejection actions and reasons, totals, fingerprints, audit history and closed-period archives. Archives can include complete worklog descriptions and issue summaries.
• Optional Google Calendar connection: when you choose to connect your Google account, YATT uses your Google identity and read-only calendar access to display only your primary calendar’s event identifiers, titles, start and end times, and links for the week you are viewing. Your connected Google account avatar may identify the integration. Event titles and descriptions are parsed for Jira issue keys and links to suggest a work item in the time-logging form. Only the references extracted from descriptions reach the browser; raw event descriptions and HTML are discarded. After you save a calendar-linked worklog, YATT also uses recurring meeting identifiers, normalized titles and participant email addresses to remember your task choice and suggest tasks for similar meetings. Declined participants, the calendar owner and room resources are excluded. Calendar participant lists do not confirm attendance. Learned suggestions require you to choose a task. Suggested issues are checked using your current Jira permissions. Calendar events are private to the connecting user and do not automatically become Jira worklogs or reporting records.
• Support information: your contact details and any messages, screenshots or diagnostic information you choose to provide. Avoid sending passwords, API tokens or unnecessary personal information.

YATT does not ask for your Atlassian password or personal API token. The app uses Forge authorization to access Jira as the current user.

4. Why we use information

We process information to provide time logging, reports, review workflows, period closure, configuration and support; maintain security; investigate errors; and meet applicable legal obligations. We do not sell app data or use Jira worklogs for advertising. Depending on the information and applicable law, our own processing relies on performing our agreement with you, legitimate interests in running and securing the service, legal obligations, or consent where required. Your organization determines the lawful basis for its workforce reporting.

5. Storage and service providers

Jira remains the ledger for worklogs and their YATT metadata properties. Private settings and reporting records are stored in Atlassian Forge. The app does not send Jira worklog data to a separate YATT-operated backend. For the optional Google Calendar integration, Forge communicates with Google’s authentication and Calendar APIs. Forge securely manages the OAuth client secret and each user’s OAuth tokens. YATT stores your display and event-filter preferences, with the primary calendar identifier, in Forge. It fetches raw event content on demand. Private meeting memory stores account-scoped SHA-256 fingerprints of meeting identifiers, recurring series, titles, title words and participant email addresses, linked to Jira issue IDs. Raw meeting titles and participant details are not stored in Forge. The most recent 50 distinct confirmed meetings are retained per user and connected Google account; saving a corrected task replaces that meeting’s previous choice. You can clear this memory using “Forget meeting suggestions” in Calendar settings. Existing private calendar links contain only account, event and worklog identifiers and the date. To make Calendar load quickly, YATT keeps sanitized event display data in a browser cache, including titles, timing, event types, links and extracted Jira issue references. Raw descriptions, attendees and OAuth credentials are not cached. Account avatars are loaded from Google’s profile image hosting and are not stored by YATT. If you explicitly save a time entry from an event, its title can become the Jira worklog description; the raw event description is not copied.

This public website is hosted by DigitalOcean. Hosting providers may process IP addresses and request information to deliver and secure the website. Our email service processes correspondence sent to [email protected]. We do not include advertising trackers or analytics scripts on this website.

Atlassian, DigitalOcean and communication providers may process information in countries outside your own. Hosting locations and safeguards depend on their services and your organization's configuration. Where applicable, required contractual safeguards must be addressed in the customer agreement or data-processing arrangements. Contact us for information needed for your organization's assessment.

YATT uses Google user data only to provide the calendar feature you request. We do not sell it, use it for advertising, or use it to train generalized AI or machine-learning models. YATT’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Access and sharing

Live Jira data is retrieved under the user's Jira permissions. YATT also checks app roles and report ownership for management and review actions. Organization administrators and authorized reviewers can see reporting records appropriate to their roles.

Closing archives are historical records. Authorized YATT reviewers may retain access to a stored archive even after the underlying issue or worklog becomes inaccessible in Jira. Changing a Jira permission or deleting a Jira worklog does not automatically remove these archives.

Information may also be disclosed where required by law, to protect the service or users, or with your instructions. We do not routinely access customer worklogs for support; any diagnostic access or disclosure should be limited to what is necessary and authorized.

7. Browser storage

The app uses local storage for layout preferences, session storage for navigation and pending worklog operations, and IndexedDB to cache worklog ranges scoped by site and user. Cached worklog ranges are eligible for reuse for up to seven days. Google Calendar display data and Jira activity observations are also cached in IndexedDB, separated by Jira site, user, date range and timezone, and eligible for reuse for up to 24 hours. Google cache reuse also requires the connected account and event filters to match. Caches are refreshed in the background and pruned during cache operations; inactive browser data may remain until cleared. Disabling an activity source clears its cache. Failed Jira activity access checks clear cached observations. Session storage generally lasts for the browser tab's session. You can remove local data through your browser's site-data controls. Clearing pending operations before synchronization can lose unsaved work.

This public website does not set application cookies or use browser storage. Infrastructure providers may apply their own necessary security mechanisms.

8. Retention and deletion

Jira worklogs and properties follow your Jira site's retention and deletion controls. Uninstalling YATT does not itself delete those Jira records. Forge settings, reporting history and closing archives are retained while the installation is active; the current app does not automatically expire closing archives.

Atlassian currently retains Forge hosted storage for 28 days after uninstall under its hosted-storage policy. Retention and recovery are governed by Atlassian's platform rules. Browser caches are separate and must be cleared on the device.

For removal of app-held data, contact us and your organization's administrator. We will verify authority, assess the request and explain available steps, including any legal or technical limits. Support correspondence is retained as needed to resolve the request, manage the relationship and meet legal obligations.

You can turn off Google Calendar display in Personal settings. This stops event retrieval but does not revoke the OAuth grant. Use the settings link to your Atlassian connected apps to revoke Google access, or remove YATT’s access through your Google account connections. Disabling Google Calendar display clears its browser event cache. If Google access is revoked or denied, the cache is cleared when YATT next checks the connection. Closing the view does not immediately erase the browser cache; you can clear it through your browser’s site-data controls.

9. Your rights

Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing, receive a portable copy, or withdraw consent where processing relies on consent. For organizational Jira and reporting data, contact your organization first; we can assist with requests relating to YATT. For our own records, email [email protected]. You may also complain to the relevant data-protection authority. We may need information to verify your identity or your authority to act for an organization.

10. Security and changes

YATT uses Forge hosting, Jira permissions and server-side authorization checks. No system can guarantee absolute security. Notify us promptly of suspected unauthorized access. We may update this policy as the service or requirements change, update the date above, and provide additional notice where legally required.