Privacy Policy
Effective date: [doplnit datum zveřejnění prvního doplňku] Last updated: 28 July 2026
Who we are
Brasscog is a trading name of Hore Hrou s.r.o., a limited liability company registered in the Czech Republic.
- Registered office: Masarykovo náměstí 103, 766 01 Valašské Klobouky, Czech Republic
- Company ID (IČO): 21768153 · VAT ID: CZ21768153
- Registered in the Commercial Register maintained by the Regional Court in Brno, Section C, Insert 140133
- Contact: support@brasscog.com
- Security reports: security@brasscog.com
This policy explains how our Atlassian Marketplace apps handle your data. It applies to all apps published by Brasscog, currently TreeTotals for Jira.
We — not Atlassian — are responsible for how our apps process your data.
The short version
Our apps run entirely inside Atlassian's own infrastructure using Atlassian Forge. We operate no servers and no databases of our own. Your data never leaves Atlassian's infrastructure, and we never receive a copy of it.
We do not sell data, we do not use it for advertising, and we do not use it to train machine learning models.
What data our apps process
TreeTotals for Jira
To calculate rolled-up totals across an issue hierarchy, the app reads the following fields from issues in your Jira site:
| Field | Why |
|---|---|
| Issue ID and key | to identify issues and write results back |
parent |
to reconstruct the epic → story → subtask hierarchy |
summary |
to display issue names in the app's panel |
status |
to show progress in the app's panel |
timespent, timeestimate |
values being summed |
| Story point fields | values being summed |
The app then writes the calculated totals into read-only custom fields it provides on your issues. Those fields live in your Jira site like any other field and are subject to your own Jira permissions.
Note on issue summaries: the app reads issue summaries in order to display them in its panel. If your team writes personal data into issue summaries, that data is read by the app during processing — but it is only displayed back to users who already have permission to view those issues, and it is never stored by us or transmitted anywhere.
What our apps do not access
- User profiles. We do not read names, email addresses, avatars, account IDs or
group memberships. The app does not request the
read:jira-userscope. - Issue descriptions, comments, attachments, or worklog comments.
- Anything outside Jira — no Confluence data, no other Atlassian products.
The app requests only two OAuth scopes: read:jira-work and write:jira-work.
Where data is stored
Nowhere outside Atlassian. Our apps have no database, no file storage and no logging of your content. Calculated values are written back into Jira custom fields — that is, into your own Jira site, hosted by Atlassian in the region you selected.
The app performs no outbound network calls to any third party. It holds no external permissions in its Forge manifest, which Atlassian enforces at the platform level.
Because all processing happens inside Atlassian's infrastructure, our apps qualify for the Runs on Atlassian badge on the Atlassian Marketplace.
Who we share data with
No one. We have no sub-processors for your Jira content, because we never hold it.
Atlassian hosts your data as your cloud provider under Atlassian's own privacy policy and your agreement with them.
Data we do hold about you
We hold data you send us directly:
- Support correspondence. If you email
support@brasscog.com, we keep your message and our reply so we can help you and follow up. Stored with our email provider (Migadu, Switzerland). Kept for as long as needed to support you, then deleted. - Marketplace reports. Atlassian provides us with aggregated licence and installation data for our apps, including the name and country of the purchasing organisation and a billing contact. We use it for invoicing, support and product decisions.
Retention
Calculated field values persist in your Jira site until you uninstall the app or delete the issues. When you uninstall the app, Atlassian removes its data and fields from your site — there is nothing for us to delete on our side, because we hold nothing.
Roles under the GDPR
For your Jira content, you are the data controller and we act as a data processor when the app processes issue data on your instance. Because processing takes place entirely within your own Atlassian infrastructure, our role as processor is limited to the operation of the app code itself.
A Data Processing Agreement is available on request at support@brasscog.com.
Your rights
Under the GDPR you have the right to access, correct, erase, restrict and port your personal
data, and to object to its processing. For data inside your Jira site, exercise those rights
directly in Jira or via Atlassian — we have no copy. For support correspondence, write to
support@brasscog.com.
You also have the right to lodge a complaint with the Czech data protection authority, Úřad pro ochranu osobních údajů.
Security
We report and handle security issues seriously. If you believe you have found a vulnerability in one of our apps, please write to security@brasscog.com. Please do not disclose it publicly until we have had a chance to fix it.
Changes to this policy
If we make a material change, we will update the "Last updated" date above and notify affected customers through the Atlassian Marketplace listing. Continued use of the app after a change means you accept the updated policy.
Contact
support@brasscog.com — Hore Hrou s.r.o., Masarykovo náměstí 103, 766 01 Valašské Klobouky, Czech Republic