Privacy Policy

Effective Starting: 1st November 2020 · Last updated: 31st October 2026

Overview

Appbox.ai LLC (herein “We”, “Us”, “Our” or “Appbox”) takes security very seriously and only relies on secured and trusted infrastructure providers to deliver our services (the “Add-on”, or “Product”) to the Customers (herein “Customers”, “You”) of our product.

Where Our Apps Run

Forge apps (every current Appbox app, including the Pro and Lite editions) run entirely on Atlassian’s Forge platform. Their code, storage and logs are hosted and secured by Atlassian. Appbox runs no servers for them, and they make no calls to services outside Atlassian.
Connect apps (our older Atlassian Connect versions, being replaced by Forge) are served from Amazon Web Services (AWS). AWS hosts the app’s code and receives Atlassian’s install and licence callbacks (your site address and the keys Atlassian issues for it). No Jira issue content and no personal data is stored or logged on AWS.

Certification

Atlassian and AWS are responsible for the security of their own data centres and cloud services. Their certifications and compliance statements are listed here:

Atlassian: https://www.atlassian.com/trust/compliance
AWS: https://aws.amazon.com/compliance/

Data Storage

All customer data is kept inside Atlassian only: in your Jira site (for example as Jira entity properties) or, for Forge apps, in Atlassian’s Forge hosted storage. It is never stored on or sent to systems that Appbox runs.

Logs and Retention

Appbox keeps no logs of its own. Forge app logs are held by Atlassian under its Forge retention rules, and our Connect apps write no logs on AWS.

Uninstalling and Deleted Users

When you uninstall an app, data in Forge hosted storage is deleted by Atlassian under its Forge rules. Data kept in your Jira site stays under your control and is removed when you delete the issue, project or site it belongs to. Because Appbox holds no personal data outside Atlassian, deleting a user’s Atlassian account leaves no copy with us; to have account ids removed from app data in your site, write to support@appbox.ai.

Analytics

Forge apps send no analytics. Some older Connect versions load Google Analytics through Google Tag Manager to count page views and which features are used. It never collects Jira issue content, summaries or comments, and Google Analytics does not log or store IP addresses. It stops when a site moves to the Forge version.

Customer Data

We do not have any access to customer data (“Projects”, “Tickets” etc) beyond the information provided by Atlassian Marketplace.

Cookies

Cookies are files with a small amount of data, which may include an anonymous unique identifier. Cookies are sent to your browser from a web site and stored on your computer’s hard drive.

Like many sites, we use “cookies” to collect information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Site.

Security

Customer data lives on Atlassian’s platform, where Atlassian encrypts it at rest (AES-256) and in transit (TLS 1.2 or later). Traffic between your browser and our Connect apps on AWS uses HTTPS.

If you believe you have discovered a security vulnerability please contact our security team at security at appbox.ai and we will take immediate action on the issue. If a security incident affects your data, we will notify you and Atlassian within 48 hours of confirming it.

Your Rights

Under the GDPR and similar laws you may ask to access, correct, delete or export personal data we hold about you, or object to how we use it. Write to support@appbox.ai and we will answer within one month.

Further Personal Information

When you install one of our apps and a licence (evaluation, free or paid) is applied, Atlassian shares the technical contact and billing contact for that licence with Appbox.ai through its Marketplace reporting. Please see Atlassian’s privacy policy for how Atlassian treats your information. Appbox.ai, not Atlassian, is responsible for how we process this information.

We use it only to provide and support our apps, for example:

a short series of onboarding emails when you start using an app: a welcome email with setup guides, documentation and support links, and a check-in a few days later to ask how it is going (we stop once you buy, uninstall or opt out);
replies to your support requests;
important service, security and licensing notices; and
notices about changes to our apps, such as new or removed features, pricing or licensing changes and security fixes, which we may send at any time.

We do not sell this information or use it for third-party marketing. You can opt out of onboarding emails at any time: reply “unsubscribe” or write to support@appbox.ai and we will stop. Service, security and licensing notices and notices of changes to our apps are essential and continue while you use the app. To have your contact details deleted, email support@appbox.ai.

Policy Changes

Changes in this policy document will be posted on our Websites. You are advised to check our Websites regularly to view our most recent privacy policy. If you object to any changes, you may close your account by writing to support at appbox.ai.

Contact

Appbox.ai LLC, 100 Lakeforest Blvd, Suite 650, Gaithersburg, MD 20877, USA. Email support@appbox.ai, or security@appbox.ai for security matters.