Privacy and Security

When installing the app, Jira will say that our app can read & change a lot of information. But in reality, we don’t do this. Jira’s permission schema (at least the current recommended one) has very granular. For example, we need to get issue details to check whether issue is resolved or not, for this we are requestig “read:jira-work” classic scopes as recommended by documentation. But in that case Jira will tell you that we need access to lots of details including worklog and attachments. We don’t access most issue details.

• storage: app is used to store reminder data and configuration

• write:jira-work is required to add comment to issue and sending reminder notifications using mail. You can check the API and permission here.

• read:jira-user is used to convert from account id to actual user display names. We store Account ID on reminders and convert to real user only at runtime. Also required for getting user groups.

• manage:jira-configuration we need this to read application properties. Strangely this requires manage:jira-configuration, you can check it here.

• Our add-on is using the domain thestarware.atlassian.net for our legacy Slack integration only at the moment. We don’t share any of your user or issue detail to this site. If you use legacy Slack integration, we use our AWS lambda function to redirect reminder content to Slack.

• slack.com, google-chat.com and ms-teams.com are used to send reminders to these services. If you don’t configure them, no reminder content will be send to these domains.