Privacy Policy

This policy covers the FolioCradle apps distributed for Atlassian products and this website. It is written to be read, not to be survived; where a section can honestly say "none," it says none.

Sections 1 to 5 and 7 to 15 apply to every FolioCradle app. They describe things that are true because of how the apps are built rather than because we promise them: the apps run inside Atlassian's own infrastructure, declare no external network permissions, and have no server of ours to send anything to.

Section 6 is per app, because that is what differs between them: the permissions an app asks for, what it stores in your site, and whether it uses a language model. Each app has its own subsection there, and each Marketplace listing links to it. Today there is one app.

1. The short version

Our apps run on Atlassian Forge, inside Atlassian's own infrastructure. We operate no servers, and your Confluence content is never transmitted to us. Two optional AI features — each one behind a button somebody presses — send text to a language model that Atlassian runs inside its own infrastructure; it does not leave Atlassian and it does not reach us, and section 4 says exactly what is sent and when. A bulk run does keep a working record of its own progress, and that record is written to Atlassian's storage inside your site, never to us — section 3 says exactly what is in it. We use no analytics or tracking, in the apps or on this site.

2. Who we are

FolioCradle is operated by James Graham, a sole proprietor in California, USA ("we", "us"). Contact: support@foliocradle.com.

3. Content in your Atlassian site

To do their job, our apps read and write the pages you point them at. This happens entirely within Atlassian's infrastructure using Atlassian's own APIs. Specifically:

• We receive no content. The apps declare no external network permissions, which means the Forge platform blocks outbound network requests from them. There is no technical path by which your page content could reach a FolioCradle server, for the straightforward reason that we do not operate one. The single place your text is read by something other than Confluence itself is the two optional AI features, which stay inside Atlassian; section 4 describes them in full.
• A run keeps a working record — inside Atlassian. A bulk run can cover thousands of pages and takes longer than one request, so the app saves its progress using Forge's own key-value storage, which belongs to the app's installation in your Atlassian site. That record holds the words you searched for and their replacement; the space key or search query you scoped the run to, and the options you chose; the list of pages in scope with their IDs and titles; per-page counts of what happened, including the text of any error; the account ID of the person who started the run; and, for the first 25 changed pages, a sample of the individual before-and-after text so the results screen can show you what it did. Where a run is set to include comments, that sample text can come from a comment as well as from a page body, and the record also holds the IDs and version numbers of the comments the run changed, which is what lets Undo put them back. Where a run renames labels, it holds the label names it added and removed on each page, for the same reason: a label is not part of a page version, so the only way Undo can put one back is to have kept it. It also holds examples of matches the run declined to rewrite, so the results screen can tell you what it left alone and why: up to forty kinds of refusal, each keeping up to three short excerpts, and that set is kept for the run as a whole and again for each page it reports on. The excerpt is the matched text itself rather than the words around it, and it is capped at 120 characters — with the regular-expression option on, a pattern can match more text than the term you typed, so the excerpt is whatever it matched, trimmed to that length. Where you untick individual matches before applying, it holds a key for each one so the run can leave exactly those alone; in a plain search that key is the term you searched for, and where the regular-expression option is on it is the text on the page that your expression matched. It is written to Atlassian, not to us, and we have no means of reading it.
• The record expires after seven days. It survives the run deliberately, because it is what the results screen reads from — but not indefinitely. Every part of it is written with a seven-day expiry, measured from the last time that run wrote anything, so Atlassian removes it whether or not anyone comes back for it. The expiry is recorded on the record itself and enforced by Atlassian, which sweeps lapsed records on its own schedule rather than at the exact moment they expire. Discarding a run in the app — or starting another run from the results screen — deletes the part that identifies it — the terms you searched for, the replacement and the account id — before the app answers. The per-page parts are deleted in the same call until its time runs out; on a very large run the remainder finishes in the background within minutes rather than waiting for the seven days. Uninstalling the app hands its storage to Atlassian's own deletion process.
• An administrator's settings are kept until changed, not for seven days. Separately from any run, the admin screen saves the choices made there: whether the app is enabled, whether the AI features are enabled and their monthly budget, any restriction to particular spaces, and any restriction to particular groups or people. A restriction to particular people is stored as the Atlassian account IDs an administrator chose, because that is what the permission check compares against. Alongside each ID the app also stores a label for it — the email address that account has in your site’s directory, or where there is none, the display name. That is read back from the directory rather than taken from what the administrator typed, so an administrator who typed only a name will find an address stored beside it — so the admin screen can show names on a later visit instead of a column of opaque IDs. Access is decided by the IDs; the labels are shown, and they are the only personal identifiers this record holds. They are covered by the same terms as the rest of it: stored in your own site, readable only by your administrators, and not readable by us. This record is configuration, so it deliberately has no expiry: it lasts until an administrator changes it, or until the app is uninstalled and Atlassian deletes the app's storage. It lives in your site, like everything else here, and we cannot read it.
• Comments are content too, and the app can rewrite them. A run can be set to include page comments, off unless you turn it on. When it is on, the app reads the comments on the pages in scope — including the replies under them, at any depth — and rewrites the ones you approve, exactly as it does page bodies — the same dry run, the same per-match approval, the same permission checks. A comment is not part of a page version, so a comment the app changes leaves no entry in the page’s history; it has a version history of its own, which is where the app’s Undo restores it from. Comment text is read and written inside Atlassian on exactly the terms described above, and the only copy that outlives the run is the sample in the working record, which expires with it.
• Each edited page records what changed, in your own page history. Every page the app writes gets an ordinary Confluence version message naming the text searched for and its replacement — or, for a run of several terms, how many it had — which is how the change stays visible and revertible. That message is part of your page's version history: it lives in your site, under your own retention rules, it is not covered by the seven-day expiry above, and the app cannot remove it afterwards.
• We keep no logs of your content. We have no logging infrastructure. Atlassian may retain platform-level operational logs under its own policies, which we do not control and cannot read your content through.
• Access is limited to yours, by default. Two mechanisms, depending on where a page lives, and both come to the same thing. Most pages are handled by a background worker that has no identity of its own, so before such a page is written — or even reported to you — the app asks Confluence whether you personally may edit it, and skips it if the answer is no or if the question cannot be answered. Pages in a knowledge base space where the app could not establish that it can read them, and pages in a space whose type could not be established, are handled in your browser using your own session, where Confluence applies your permissions directly and refuses anything you could not do by hand. Either way, pages you cannot edit are reported to you rather than passed over silently.
• An administrator can lift that, deliberately. A Confluence administrator — and only an administrator, from an admin-only screen — can start a run that may edit pages the person running it could not edit themselves: every run started from that screen is one. Such a run is counted and reported separately from ordinary edits, and every page EDIT made that way is labelled [elevated] in that page's Confluence version history. A comment rewritten or put back that way is labelled [elevated] in that comment's own version history. A label change is not part of any version, so it leaves no history entry to label; those pages are counted in the run's own report instead. A run interrupted and restarted part-way through a page can leave that page out of these counts.

4. The AI features, and exactly what they send

Bulk Find & Replace has two optional features that use a language model. Both are described here in full, because "the app has AI in it" is not a disclosure — what leaves the page, and where it goes, is.

Neither one runs on its own. Nothing is sent to a model because you opened the app, typed in it, or ran a search. Each feature is a button, and text is sent only when somebody presses it.

• "Suggest other spellings" sends no page content at all. It sends the search term and the replacement you typed into the form, and nothing else — not a page, not a title, not a match. It exists to propose that renaming Acme Corp probably also means renaming ACME and acme.com, which needs only the pair you typed.
• "Check these matches" sends the text around each match. This one does send page content: for each match on the dry-run screen, the surrounding paragraph, trimmed to 300 characters, and a number counting the matches in the request so the answer can be put back on the right row. It is capped at 300 matches — and not the first 300: every distinct passage in the dry run is given a slot before any passage is given a second one, so a page late in the run is represented rather than crowded out by a single paragraph earlier in it. Fewer than 300 when the site's remaining monthly AI allowance would not cover that many, and when it is capped the screen says so rather than presenting a partial check as a complete one. It sends no page titles, no page or space identifiers, no author or account names, no labels, and nothing from any page outside the dry run you are looking at. On a run that includes comments, a match found inside a comment sends the text around it on the same terms as any other match — it is the same dry-run screen and the same 300-character window.
• It advises; it never decides. The model is asked to report only the matches that look wrong to replace — a mention quoted from a contract, a different company with the same name, a code identifier, a URL that would break. What comes back marks those rows and gives a reason. It unticks nothing and changes nothing. The dry run is still the dry run, and the person still decides.
• Where the model runs, and why that matters. The features use Atlassian's own Forge LLMs API, which runs on Amazon Bedrock embedded in Atlassian's infrastructure. The text stays within Atlassian's cloud — it is not sent to FolioCradle, and we hold no key, account or agreement with any model provider. This is what allows an app using these features to keep Atlassian's Runs on Atlassian designation. Atlassian applies to these requests the same moderation checks it applies to its own AI features, and the handling of the text at the model is governed by Atlassian's terms and privacy policy rather than by anything we control. Atlassian also discloses an app's use of Forge LLMs independently of us, on the Marketplace listing and at install time.
• We keep none of it. We receive neither the text sent nor the answer, so there is nothing on our side to retain. The suggestions and flags live in the screen you are looking at and are gone when you leave it. What the app does record is a count — tokens used this month, per installation, in your own site's storage — which is a meter, not content, and is there so the feature can be capped.
• An administrator can switch it off entirely. From the admin-only screen, a Confluence administrator can disable the AI features for the whole site. With them disabled the two buttons are not offered at all, so nothing can be sent. Setting the monthly budget to zero is a different control and stops the same thing happening: the buttons remain, and pressing one is refused before any text leaves the page. Either way no content reaches the model.

5. Where your data is held, and who is responsible for it

Atlassian requires every Marketplace partner to state both of these plainly, and they are easy to get wrong, so they have a section of their own.

• Where it is stored. Everything described in section 3 is held by Atlassian, in the cloud region associated with your own Atlassian site. Atlassian determines that region, based on your site's configuration — we do not choose it, cannot change it, and hold no copy anywhere else. We operate no servers and no storage of any kind, in any country.
• Who is responsible. FolioCradle, not Atlassian, is responsible for the privacy, security and integrity of the data our apps process. Atlassian provides the platform and the storage; the decisions about what our apps read, write and retain are ours, and this policy is our account of them. Where our apps cause Atlassian to store data on our behalf, Atlassian acts as our sub-processor.

6. Each app: permissions, storage and AI

Everything above this point is the same for every app. This section is where they differ, so each app gets its own heading below covering three things: the permissions it asks for, what it stores inside your Atlassian site, and whether it sends anything to a language model.

Bulk Find & Replace (Confluence Cloud)

Storage: the working record described in section 3, expiring after seven days. AI: the two optional features described in section 4, both off unless pressed, both refusable site-wide by an administrator. Permissions, which Atlassian shows you when you install — the minimum the functionality requires:

7. Information we do collect

We collect nothing automatically. The only personal information we hold is what you choose to send us:

• Support correspondence. If you email us, we keep your message and address in order to reply and to keep a record of the issue. We do not use it for marketing and we do not sell or share it.
• Marketplace records. If you purchase through the Atlassian Marketplace, Atlassian handles the transaction and provides us with limited licensing information (such as your organisation's name and licence status) so that we can support the account. Atlassian's handling of that data is governed by its own privacy policy. We never receive your payment details.

8. This website

This site serves static pages only. It sets no cookies, runs no analytics, and loads no fonts, scripts, or images from other domains. Our hosting provider processes standard server request data (such as IP address and user agent) for delivery and security, as any web host must.

9. Sub-processors

We engage no sub-processor of our own for customer content, and we receive no customer content to hand to one. Atlassian is the only party that processes your content on our behalf: it runs the apps, it holds everything they store (section 3), and it runs the language model behind the AI features (section 4), on its own infrastructure and under its own terms. Our remaining providers touch none of it — our website host serves this site, and email you send us is handled by our email provider. We will not add a sub-processor that changes any of this without updating this policy first.

10. Retention

Customer content: not retained by us, because we never receive it — including the text the AI features send, which we neither receive nor store (section 4). Three things are kept inside your own Atlassian site, on different clocks. An administrator's settings are configuration and are kept until changed or until the app is uninstalled. The AI meter — a month's token count, described in section 4, holding no content of yours — is kept for sixty days so the monthly allowance can be reported honestly. The working record a run keeps (section 3) expires seven days after that run last wrote anything. Discarding the run, or starting another one from the results screen, deletes the part that identifies it before the app answers and the rest in the background within minutes, apart from a marker holding only the run's id, which stops the run being recreated and expires after seven days. The version message written into each edited page's Confluence history is part of your own site's data and stays under your retention rules, not ours. Support correspondence: kept while it is useful for support history, and deleted on request. Marketplace licensing records: kept while the licence is active and for a reasonable period afterwards for accounting purposes.

11. Your rights

Depending on where you live, you may have rights to access, correct, delete, or port personal information we hold about you, and to object to certain processing. Since the only such information is normally your support correspondence, these requests are easy to honour — email support@foliocradle.com and we will respond within 30 days. We do not sell personal information, and we do not "share" it for cross-context behavioural advertising as defined under California law.

12. Children

These are workplace administration tools. They are not directed at children and we do not knowingly collect information from anyone under 16.

13. Security

The strongest security property here is structural rather than procedural: data we never receive cannot be breached from us. Beyond that, the apps run within Atlassian Forge and inherit its platform security model, including its authentication, tenancy isolation and egress controls.

14. Changes

If this policy changes materially, we will update the effective date above and, where the change affects how customer data is handled, note it on this page.

15. Contact

Questions about this policy: support@foliocradle.com.