# Jira XT Toolkit privacy and data handling

Effective date: 2026-10-15

Jira XT Toolkit adds optional enhancements to the approved company Jira site.

The developer does not receive extension usage data. There is no analytics,

telemetry, advertising, sale of data, or third-party data collector.

## Data used by the extension

- Jira issue keys, summaries, hierarchy, status, estimates, sprint and Epic

  information, user identities and avatars, and workflow history support the

  board badges, implementer avatars, Epic views and note titles.

- Enabled Pull Requests features use configured personal access tokens to query

  the supported company GitHub services for repository, pull request, branch,

  author, assignee, review, lifecycle and CI metadata.

- Enabled Confluence features use a configured personal access token to query

  the approved company Confluence service for matching page titles, links,

  spaces, authors and modification dates. Epic timelines can also read the

  company Confluence cycle calendar using the existing browser session.

- Feature settings, selected teams, personal access tokens, note and demo text,

  and Sprint Goal marks are saved in the current browser profile.

Jira and calendar requests use the existing same-origin company session.

GitHub and Confluence token-authenticated requests run in the extension's

background service worker. Requests go to the supported company services, not

to the developer or an analytics service. Company services receive the searches

and API requests and may log them according to their own policies.

## Storage and access

Settings, tokens, notes and Sprint Goal marks use `chrome.storage.local`.

They are not encrypted by this extension, are not synchronized by it, and can

be accessed by someone with sufficient access to the browser profile. Tokens

are never displayed back in the popup or deliberately included in page content.

Use read-only tokens with the narrowest repository and service access needed.

API results are cached in extension memory and `chrome.storage.session`, with

approximately five-minute freshness limits. Session entries can remain until

the browser session ends. Changing or removing a service credential or the

Confluence URL invalidates the result caches; obsolete in-flight responses are

discarded. Rate-limit timestamps are retained to avoid unnecessary requests.

Notes and Sprint Goal marks are scoped to the approved Jira origin and issue

key, not to a sprint. They are never uploaded to Jira, GitHub or Confluence.

However, notes displayed on an approved Jira page are part of that page's DOM

and may be read by scripts on that page or other extensions. Local storage

does not make displayed notes secret from the approved site. Do not put

passwords or other secrets in notes.

On upgrade, legacy issue-only notes and Sprint Goal marks are assigned to the

approved Jira site. Existing origin-scoped entries are never overwritten.

Conflicting legacy entries remain in local storage for manual recovery and

are not automatically displayed.

## Controls and deletion

Use the popup to disable optional features and remove tokens or settings.

Reload open Jira pages after a settings change to clear already displayed

results. Clear both note fields to delete a note; unmark its Sprint Goal

separately. Disabling a feature does not delete its stored data.

Uninstalling the extension removes its browser-managed extension storage.

Browser-profile backups and company-service logs are governed separately.

## Distribution

The package contains company integration endpoints and workflow identifiers

needed by its features. An unlisted store listing is not an access-control

mechanism: anyone obtaining the package can inspect its code.

Public or unlisted distribution requires approval from the company security,

source/IP and privacy owners. The publisher must host this policy at a

reviewer-accessible URL, complete accurate Chrome Web Store data disclosures,

and provide a support/privacy contact in the listing before submission.