Provider: Karelia Labs, Sweden ("we", "us")
Contact for privacy questions: support@karelialabs.atlassian.net
Version / date: 1.0 / 2026-10-18
1. What this policy covers
Specfold ("the App") is an app for Atlassian Confluence Cloud built on the Atlassian Forge platform. It shows OpenAPI, Swagger and AsyncAPI documents that a user attaches to a Confluence page or pastes into the macro settings, as searchable documentation. This policy explains what data the App handles and what we, the provider, do and do not receive.
2. The short version
- The App runs entirely on Atlassian's infrastructure (Atlassian Forge, "Runs on Atlassian"). It does not send customer data to us or to any third party.
- The App stores no data. It uses no Forge storage of any kind and keeps no database, files or logs of your content.
- We cannot read your pages, attachments or specifications. We do not receive page content, titles, attachments, user names or email addresses from the App.
- The App contains no analytics, no tracking, no advertising and no cookies of its own, and loads no external scripts, fonts or images.
3. Data the App handles while it runs
| Data | Examples | Purpose | Where | Retention |
|---|---|---|---|---|
| Content of an attachment | The YAML/JSON file chosen in the macro settings | Show it as documentation | Read by a Forge function with the permissions of the viewing user, sent to that user's browser and parsed there | Not kept: it exists only in the memory of the function call and the browser tab |
| Pasted specification text | Text pasted in the macro settings | Show it as documentation | Stored by Confluence as part of the page (macro settings), read back by the page | Under the Customer's control, as part of the page and its version history |
| Macro settings | File name, comparison file name, height, colour mode | Remember the editor's choices | Stored by Confluence in the page | As part of the page |
| Atlassian account id and site information | Present in the context of each Forge call | Make the call as the viewing user and check the license | In memory during the call | Not stored, not logged |
| License status | Active, trial, inactive | Allow or refuse use of the App | In memory during the call | Not stored |
| Viewer preference | The colour mode a reader picked with the toggle in the viewer | Remember the choice | In the reader's browser (local storage of the app's iframe), if the browser allows it | Until the reader clears browser data |
The App does not request or store names, email addresses, profile pictures or any other profile data. Specifications may themselves contain personal data (for example example payloads); that data is shown to users who may see the page, and nothing else happens to it.
4. Data we receive as the provider
- Support requests: if you contact support we receive what you send us (typically name, email address, site URL and the problem description). We use it to answer you and keep it as long as needed for support and legal obligations for at most 24 months after the last message, unless a longer period is required by law (for example bookkeeping rules).
- Marketplace transactions: purchases, licenses and billing are handled by Atlassian under the Atlassian Marketplace terms. We receive license and sales information from Atlassian as described in the Marketplace Partner Agreement, such as site, tier and contact details of the technical and billing contacts.
- Website: the Karelia Labs website sets no cookies and uses no analytics or trackers.
5. Roles and legal basis
For data handled by the App on the customer's site, the customer decides why and how it is used and is the controller. Atlassian hosts and processes it as the customer's processor under Atlassian's terms and the Forge Data Processing Addendum. Because the App's code runs on that platform, stores nothing and we have no access to the data, we do not process the customer's personal data on our servers. For the support requests you send us, we are the controller of that correspondence.
For our own data (support, partner and billing contacts) we are the controller. The legal basis is our contract with you and our legitimate interest in running and supporting the App, and legal obligations (bookkeeping).
6. Sub-processors and recipients
We use no sub-processors for customer data. Atlassian (platform, hosting, billing, Marketplace) acts under its own terms. Support requests, whether sent through our support portal or by email, are handled in Atlassian's Jira Service Management, with Atlassian as our processor under its Data Processing Addendum.
7. International transfers
Customer data stays where the customer's Atlassian product keeps it; the Forge functions of the App run with the data residency of the host product. Our own support data is stored in Atlassian's cloud. Atlassian may process it outside the EU/EEA, for example in the United States, and protects such transfers with the EU Standard Contractual Clauses and its certification under the EU-U.S. Data Privacy Framework.
8. Retention and deletion
- The App keeps nothing, so there is nothing to delete in the App. Uninstalling the App removes it from the site.
- Specifications and settings stored in pages are deleted when the pages are deleted, according to the customer's Atlassian Product settings.
- Because the App stores no personal data, it does not use Atlassian's personal data reporting process.
9. Security
The App follows the Forge security model: it requests one granular read scope (read:attachment:confluence), makes every Confluence request with the permissions of the viewing user, checks its license on the server, treats every specification as untrusted input (parsed as data, size limited, never executed), turns text in descriptions into elements instead of HTML, runs under Forge's default content security policy without relaxations, and writes no content to logs. Data in transit is protected by the Forge platform. We handle vulnerabilities within Atlassian's required time limits and notify Atlassian of security incidents within 48 hours.
10. Your rights
Under the GDPR you may have the right to access, correct, erase, restrict or object to the processing of your personal data, to data portability, and to complain to a supervisory authority (in Sweden: Integritetsskyddsmyndigheten, IMY). For data in your Confluence site, please contact the administrator of that site first; for our own data contact support@karelialabs.atlassian.net.
11. Children
The App is a business tool and is not directed at children.
12. Changes
We will update this policy when the App's data handling changes and publish the new version with a new date. Material changes are announced in the release notes.