Privacy Policy: Specpane: OpenAPI (Swagger) Viewer for Confluence
Effective date: November 14, 2026
This policy explains what information the Specpane: OpenAPI (Swagger) Viewer for Confluence app (the "App") handles, where it goes, and how long it's kept. The App is provided by Brainstatic Threads ("we", "us").
Summary
- The App runs entirely on Atlassian Forge, Atlassian's hosted app platform. We run no servers of our own, and we can't access your Confluence content or the App's stored data.
- The App reads API specification files you choose to display, and stores only what it needs to show them.
- The App contacts only GitHub, GitLab and Bitbucket, and only when a page uses a Git source.
- On sites with Rovo, the App's agent answers people's questions from the specs on a page. It reads as the person asking, and its answers go only to Rovo, Atlassian's AI service.
- We don't sell data, show ads, or use tracking or analytics of our own.
Information the App handles
| Information | Why | Where it's kept | How long |
|---|---|---|---|
| API spec files attached to Confluence pages | To display them | Not stored. Read when the page is viewed, using the viewer's own Confluence permissions. | Not retained |
| API spec files from Git repositories | To display them | Forge storage, as a short-lived cache for files up to 200 KB | 5 minutes |
| Git connection details (name, provider, allowed spaces, creation date) | So admins can manage connections | Forge storage | Until an admin deletes the connection or the App is uninstalled |
| Git access tokens | To read files from private repositories | Encrypted Forge secret storage. Never sent to the browser. | Until an admin deletes the connection or the App is uninstalled |
| Macro settings (spec source, repository, path, display options) | To remember how each viewer is set up | Saved by Confluence as part of the page | As long as the page exists |
| Page content, for the Rovo agent | To find the Specpane viewers on a page when someone asks the agent | Not stored. Read when the agent is asked, using the asking person's Confluence permissions. | Not retained |
| Spec details sent to Rovo (for example an operation's parameters, or a schema) | To answer the question someone asked the agent | Returned to Rovo, which uses them to answer. The App doesn't keep them. | Not retained by the App. Rovo's chat history is kept by Atlassian (see Third parties). |
| Index of the Git specs on each page (repository, branch, file path, connection, space, and when the page was last viewed with that spec; no spec content, tokens or user details) | So the agent can find a page's Git specs and apply each connection's space limits | Forge storage | Each entry is dropped 90 days after the page was last viewed with that spec |
| Monthly usage counts (how many times each agent action ran; no user, page or content details) | To see how much the agent is used | Forge storage | Until the App is uninstalled |
| Error logs | To diagnose failures | Atlassian's Forge logging. Logs record errors, never spec contents, questions or tokens. | Per Atlassian's log retention |
The App receives Atlassian account IDs and site details as part of the Forge platform context, but doesn't store them.
Third parties
- Atlassian hosts the App and its storage on Forge. Atlassian's privacy policy applies to its handling of data. Forge storage follows your organization's Atlassian data residency settings.
- GitHub, GitLab and Atlassian Bitbucket. When a viewer uses a Git source, the App's backend requests the configured file from the provider's API. The request includes the repository, branch and file path, plus the access token if a connection is used. Each provider's own privacy policy applies to those requests.
- Atlassian Rovo. When someone asks the Specpane API Docs agent a question, the App returns spec details from the page to Rovo, which uses them to write the answer. Rovo is part of your Atlassian subscription, runs in Atlassian's cloud, and keeps its own chat history; Atlassian's terms for Rovo apply. If your admins let outside AI clients (such as Claude or Cursor) use the App's MCP tools through Atlassian, the App returns the same spec details to the clients they allow, under your agreements with those providers.
No other third parties receive data from the App.
Our access to your data
We can't browse your Confluence content or the App's Forge storage. If your administrators allow log sharing for the App (an Atlassian Administration setting), we can see the App's error logs to help with support. Admins can turn log sharing off at any time.
Security
- Access tokens are stored as Forge secrets and read only by the App's backend.
- Only Confluence administrators can create, change or delete Git connections.
- Connections can be limited to specific spaces, and the limit is enforced on the server.
- Attachments are read as the viewing user, so the App never shows a file that user couldn't open.
- The Rovo agent reads pages and specs as the person asking, so it never answers from a spec they couldn't open. It only reads: it can't change pages or call your APIs.
Deleting data
- Git connections and tokens: deleted immediately when an admin deletes the connection.
- Cached specs: expire after 5 minutes.
- Page spec index: each entry is dropped 90 days after the page was last viewed with that spec.
- Everything else: when the App is uninstalled, Atlassian removes the App's stored data under Forge's data retention practices.
Your rights
Depending on where you live, you may have rights to access, correct or delete personal data. The App doesn't store personal data about you, apart from any that happens to be in a spec, which is cached for at most 5 minutes. Questions you ask Rovo, and its answers, are kept by Atlassian, not by the App. For anything else, contact us at support@brainstaticthreads.com.
Data Processing Addendum
For customers subject to the GDPR or UK GDPR, our Data Processing Addendum sets out our obligations as a processor.
Children
The App is a business tool and isn't directed at children under 16.
Changes
We'll post updates to this policy at https://brainstaticthreads.com/specpane/privacy/ and change the effective date above. Significant changes will also be noted in the App's Marketplace release notes.
Contact
Brainstatic Threads support@brainstaticthreads.com