Sprint Subtask Pulse security and data

Architecture

• Jira Cloud app built on Atlassian Forge
• Forge UI Kit jira:projectPage rendered inside Jira
• Jira API requests run in the interacting user's context through requestJira
• No declared Forge Remote, web trigger, external backend, database, or external data-egress domain
• No declared analytics, advertising SDK, AI processing, or customer tracking

Permissions

The manifest requests only:

• read:jira-work
• read:sprint:jira-software
• read:issue-details:jira
• read:jql:jira

The app requests no Jira write, administration, user-directory, storage, or external-service scopes.

Data handling

When a user selects or refreshes a sprint, the app reads the Jira data needed to identify visible sprint issues and direct subtasks: issue key, summary, issue type, parent reference, status, status category, assignee, and sprint metadata. It calculates aggregates in the app view and displays them to that user.

The app has no app-owned customer database and does not write results back to Jira. It does not intentionally send Jira issue data to third-party analytics, advertising, AI, or machine-learning services. Jira permissions and issue security remain authoritative.

Completed-sprint results are live calculations over the current visible Jira data; the app does not store historical sprint snapshots.

Reporting a vulnerability

Contact: support@kitawolfstudios.com. Do not send credentials, tokens, session cookies, or unnecessary customer data. Include reproduction steps and impact only after removing confidential information.