Privacy
What RollGrid stores, where it stores it, how long it keeps it, and how to have it deleted.
Gold Standard Web LLC makes RollGrid. This page describes the app, not this website.
The short version
- Nothing leaves Atlassian. There is no server of ours in the path. RollGrid makes no outbound connection to anywhere.
- We cannot see your data. Everything is stored inside your own Atlassian site's app storage. We have no copy and no access.
- The only personal data stored is Atlassian account IDs. No names, no email addresses, no profile pictures.
- Uninstalling deletes everything.
What is stored
| What | Why | Kept |
|---|---|---|
| Report definitions — source, hierarchy, tabs, measures, slices | So a report can be opened again | Until deleted, or uninstall |
| Account IDs of owners, editors and people a report is shared with | To decide who may open and change a report | Until deleted, or uninstall |
| Account IDs in the team map and leave calendar | So timesheets and capacity can group and subtract correctly | Until removed, or uninstall |
| The account ID of whoever used the move assistant, on each entry of its log (counts only, no report content) | A record of what was rebuilt, by whom | Until uninstall; the ID is removed when the account closes |
| Cached report results | So a second open is instant and costs nothing | At most 4 hours; 30 minutes by default |
| A snapshot of the work items a report last read | So the next open asks Jira only for what changed, instead of reading everything again | At most 26 hours |
| Site settings — access, calendar, cache window, budgets | Admin configuration | Until changed, or uninstall |
| Hourly counts of loads, cache hits and points spent | The Health tab | Rolling 24 hours |
Cached results and snapshots are held per person. One person's are never shown to another, whatever a report is shared with.
What is not stored
- Names, email addresses, avatars or any other profile detail. Names you see on screen are fetched from Jira as you look at them and are not written down.
- Work item summaries, descriptions, comments or field values — except inside a cached result or a snapshot, both of which expire on the schedule in the table above. The snapshot is the longer of the two at 26 hours, because an overnight gap is exactly when a cheap next-morning refresh is worth most.
- Anything at all about you on any system of ours. There isn't one.
Logging
RollGrid's own diagnostic logging records identifiers, counts and timings. It does not record names, email addresses, work item summaries or field values. This is enforced in the code, not left to care.
Where it is stored
In Atlassian's Forge storage, which follows your Atlassian site's own data residency. If your site is pinned to a region, RollGrid's storage is in scope for that pinning.
Deletion
- A single report: delete it in the app.
- Everything: uninstall RollGrid. Atlassian deletes the app's storage: it keeps a soft-deleted copy for 28 days, which it can re-link to a reinstall only if you ask Atlassian within 21 days, and then it is gone. We hold no copy and no backup.
- A person: when an Atlassian account is closed, RollGrid removes that account's ID from everything it holds — leave entries, team entries, the access list, shares, the move assistant log and their cached results — and marks anything they owned as belonging to a former user, so it keeps working for the people it was shared with. It then reads its storage back, and an account counts as erased only when nothing of it is left; otherwise the next weekly run tries again.
That last step runs weekly, by itself, and records each run in the admin Health tab, including runs that failed. Until the first run has happened the tab says so explicitly, rather than showing a reassuring blank.
Contact
Privacy questions and deletion requests: see the support page. We answer within one business day.