Provider
Runbook Relay, United States.
Privacy contact: javen@runbookrelay.com.
This disclosure covers the Review Receipts app for Confluence Cloud.
Last updated November 2, 2026.
Data and purpose
Review Receipts retrieves page metadata that the current Confluence user can access: page identifiers, titles, owner identifiers, edit dates and versions. It checks edit permission before accepting an explicit review. Display names are fetched when permitted and used transiently for presentation.
A saved review receipt contains a unique receipt ID, page ID, reviewer account ID, server UTC timestamp and the page version fetched for that action. These are account-linked records, not anonymous data. Receipt ledgers are scoped to the app installation and environment.
The receipt ledger does not store page bodies, display names, email addresses or account credentials. Report searches, filters and intervals are request-local. Operational privacy progress can temporarily contain account IDs and retains account-derived digests and suppression markers. Those digests are pseudonymous identifiers, not anonymous information.
Hosting and access
The current app uses Atlassian Forge functions and hosted storage with Confluence APIs. Its production configuration declares no publisher-operated external application server or external egress destination. It does not add an advertising or analytics tracker.
Page reads and export requests recheck the current user's access. Confirmations also require page edit permission. The server supplies reviewer identity, time and installation context; the browser cannot choose these values. The app records review actions, not proof of content accuracy or reviewer diligence.
Downloaded reports
Users can request CSV and HTML snapshots of the filtered, loaded page batch. CSV includes account IDs and latest receipt references. HTML includes page metadata, readable identity labels where available and receipt history.
Customers control copies they download or distribute. App-side privacy maintenance cannot recall those copies or remove information from a recipient's computer. Review permissions and data sensitivity before sharing a report.
Retention and ending use
Installed receipt history and privacy suppression markers currently have no automatic expiry. Page deletion and license deactivation do not delete receipts. Where an account ID is redacted, receipt IDs, page IDs, timestamps and page versions remain and may still be indirectly identifiable in context.
Atlassian documents a 28-day hosted-data retention period after uninstall. A request to recover hosted data must be made within 21 days and requires customer consent. Reinstallation does not automatically restore earlier data.
Uninstalling the app, canceling a subscription, deleting an Atlassian account and requesting privacy erasure are different actions.
Privacy maintenance
The app sends stored account identifiers and associated receipt times to Atlassian for scheduled account-status reporting. When the app processes a closed-account status, it can replace affected reviewer IDs with a removed-user marker and prevent that identity from recording new reviews. Review-event metadata, account-derived digests and suppression records can remain and may still be indirectly identifiable.
Application logs for privacy maintenance use fixed events, counts and sanitized failure text. The maintenance process does not guarantee immediate erasure or remove downloaded copies.
Privacy requests
For a question or request about Review Receipts data, contact Runbook Relay at javen@runbookrelay.com. We may need information to verify that you are authorized and identify the relevant Confluence installation and account. Do not send passwords, API tokens or page contents.
We will review the request and confirm what can be done in the app. Contact your site administrator about customer-controlled exports.