Last updated 27 August 2026
There is no server of ours. This app runs entirely inside Atlassian's own infrastructure on the Forge platform. Nothing it reads or writes is sent anywhere else, because there is nowhere else for it to go.
It reads worklogs. When you ask for a cost report, it runs the JQL you typed, reads the worklogs on the issues that match, multiplies the hours by the rates you set, and shows you the total. That is the whole job.
It never writes to your Jira. The permission list on the install screen says
read:jira-work, and there is no write scope there to find. It cannot change an issue,
a worklog or anything else.
It reads only what you can read. The queries run as you, so the report covers the issues your own Jira account is allowed to see. Every report says this on its face, because two people running the same report can honestly get two different numbers.
The rate card: a list of Jira group names, an hourly rate against each, a default, and a currency. That is entered by an administrator and it is all that is kept.
Rates are by group, not by account. "Senior Engineers, $180" rather than a Jira account id and an individual rate. The stored card contains no account ids, worklogs, membership lists, display names, email addresses, or individual pay rates. Jira group names are administrator-entered configuration and may identify a person if your administrator chooses a person's name or email as a group name.
No worklogs are stored. No issue data, no names, no descriptions, no totals. Every report is computed when you ask for it and is gone when you leave the page. Nothing is written to a database of ours, because there is no database of ours.
The rate card lives in Atlassian's own storage inside your site, under Forge. Nothing this app touches leaves Atlassian's infrastructure.
| Permission | Why |
|---|---|
read:jira-work |
To run your query and read the worklogs on the issues it matches. Read only. |
read:jira-user |
To see which groups somebody belongs to, so their work can be priced. Read at the moment you run a report and never stored. |
storage:app |
To keep the rate card. Group names and numbers, nothing else. |
There is no write permission in that list, and no permission to send anything anywhere.
The app minimises what it stores. The rate card stores Jira group names and numeric rates in Forge storage. Group names may identify a person when an administrator uses a name, email address, or another identifying label. Cost Trail therefore treats stored group names as potentially personal data rather than assuming every customer names groups generically.
The app also reads personal information while a report runs. A worklog has an author, so a report shows who logged the hours, and it looks up which groups that person belongs to in order to price their work. Worklog author identity and membership are processed only while a report runs and are not persisted by Cost Trail. The report is shown back to the authorized Jira user.
Exported spreadsheets are built inside Atlassian and handed to your browser to save. They are not kept and no copy is sent to us.
None. No analytics, no tracking pixels, no third-party scripts, no telemetry back to us. Atlassian collects its own platform-level operational metrics about app invocations, as it does for every Forge app, and that is described in Atlassian's own privacy policy.
Inside your Atlassian instance, in the region Atlassian hosts it in. The app makes no outbound network calls to any other host. It is eligible for Atlassian's Runs on Atlassian programme, which is their check for exactly this: that an app stores its data on Atlassian infrastructure and does not egress.
Uninstalling removes the app's access and starts Atlassian's Forge app-storage retention and deletion lifecycle for the rate card. Cost Trail keeps no separate copy. Your worklogs remain in Jira and were never copied into app storage.
Support requests reach us by email. If you send us a description of a problem, we hold that email in order to answer it, and for no other purpose. We do not add support contacts to any mailing list.
If this policy changes, the date at the top changes with it. If a change ever made the statement at the top of this page untrue, that would be a different product, and it would be said plainly here and on the listing rather than buried in a revision.