Privacy Policy

What Keelbits collects when you visit this website, write to us, or use a Keelbits app in your Atlassian site. Short version: the website collects nothing, the apps keep your data inside your site, and we cannot see it.

Last updated 2026-09-18 · Privacy requests: privacy@keelbits.com · General contact: support@keelbits.com

Who we are and which role we play

Keelbits is operated by Yaroslav Kharchenko, private entrepreneur, registered in Ukraine. Keelbits publishes apps for Jira Cloud on the Atlassian Marketplace and runs this website.

For this website, for support email and for the licensing data Atlassian shares with us, Keelbits is the controller: we decide why and how that data is used, and this policy describes it in full.
For the data a Keelbits app processes inside your Atlassian site, your organisation is the controller and Keelbits is the processor, on the terms of our Data Processing Agreement. Atlassian hosts the app and its storage as our subprocessor.

For anything in this policy, write to privacy@keelbits.com.

This website

keelbits.com sets no cookies, runs no analytics and has no forms. There is no cookie banner because there is nothing to consent to. The only thing the site keeps in your browser is your light or dark theme choice, in local storage, after you use the theme switch; it never leaves your browser. The web server records a standard access log: IP address, requested page, time and browser user agent. We use it to keep the site running and to spot abuse, keep it for 14 days and share it with no one.

The website is served from a virtual server rented from Hetzner in Germany; DNS and email forwarding are provided by Cloudflare. Those providers see the traffic needed to deliver the site and mail to you.

When you email us

When you write to any address at keelbits.com we receive your email address, your name if you include it, and the content of the message. Mail is routed through Cloudflare Email Routing to a mailbox we control. We use it only to answer you and keep the correspondence for as long as needed to handle your request and to meet our accounting obligations.

Please do not send passwords or API tokens. Screenshots of your Jira site are welcome when they help us understand a problem.

Data processed by the apps

Keelbits apps run on Atlassian Forge inside your own Atlassian site. Issue Recycle Bin keeps copies of issues, comments, work logs, issue links, attachment metadata (name, size and type, never the file), sub-task relationships, and the display name of the user who deleted an issue. Inside these copies are the account ids and display names of the people involved: the assignee, reporter and creator of an issue, the authors of comments, work logs and attachments, and the user who deleted it. These copies are stored in Forge storage that belongs to your installation, in the region of your Atlassian site.

The app has no external network permissions. The data never leaves Atlassian infrastructure, and Keelbits cannot read it. Atlassian hosts the app and its storage; it is the only party that processes this data on our behalf.

You control how long deleted issues are kept (30 to 365 days), you can empty the trash at any time, and uninstalling the app removes its storage. Details per app are on the Security page; the contractual terms are in the Data Processing Agreement.

Personal data reporting

Every 7 days the app reports the account ids it holds to Atlassian through the Forge personal data reporting API. When Atlassian answers that an account has been closed, the app erases that person's account id and name from all its copies; when the account was updated, it refreshes the stored name. A Jira administrator can run this report at any time from the app's Settings tab.

Marketplace and licensing data

When your organisation starts a trial or buys an app, Atlassian shares limited details with us through the Marketplace partner tools: the site name, the licence status and tier, and the name and email of the technical contact. We use them to provide support, to meet licensing obligations and to send notices about the app you use. Your purchase itself is handled by Atlassian under its own privacy policy.

Legal bases and international transfers

Where the EU or UK GDPR applies, we rely on our legitimate interest in running a website and supporting our customers, and on the contract with your organisation for licensing data. App data stays in the region of your Atlassian site; the app never transfers it anywhere. Support email is read in Ukraine; where the GDPR applies, that transfer is necessary to handle the request you sent us (Article 49(1)(b)), and we keep the correspondence to the minimum needed.

Children

This website and our apps are made for organisations and their Jira administrators, not for children. We do not knowingly collect personal data from anyone under 16. If you believe a child has written to us, tell us at privacy@keelbits.com and we will delete the correspondence.

Your rights

You can ask what we hold about you, ask us to correct or delete it, restrict or object to our use of it, or receive a copy. Email privacy@keelbits.com: we confirm receipt within 7 days and complete the request within one month, or tell you why we need longer. There is no charge.

Data held inside your Atlassian site is under your organisation's control, not ours: ask your Jira administrator, who can restore or delete an issue or empty the trash. If you close your Atlassian account, the app erases your account id and name from its copies within its next 7-day reporting cycle.

You can also lodge a complaint with a data protection supervisory authority, in particular in the EU or UK country where you live or work. In Ukraine the competent body is the Ukrainian Parliament Commissioner for Human Rights. We would welcome the chance to answer your concern first.

Changes to this policy

We update this page when our practices change and move the date at the top. A change that affects how an app handles your organisation's data is announced by email to the technical contact of the installation at least 30 days before it takes effect, together with any change to the Terms of Service or the Data Processing Agreement.