Group Watch for Confluence — Privacy Policy

Last updated: 7 September 2026
Provider: Alzhan Group LLC
Contact: support@alzhangroupllc.com

What this app is

Group Watch for Confluence is an Atlassian Forge app for Confluence Cloud. It lets a space administrator assign a group as a watcher of a space, or someone who can edit a page assign one to that page, so that every member of the group receives Confluence's own change notifications.

Where your data is held

The app is built on Atlassian Forge and runs entirely on Atlassian's infrastructure, storing data in Forge storage within your Atlassian environment.

The app operates no servers of its own and transmits no data to any third party. It makes no outbound network requests outside Atlassian's own APIs. This is not a promise about intent — the app's manifest declares no external network permissions at all, so the platform would refuse such a request, and the app qualifies for Atlassian's Runs on Atlassian programme, which requires it.

There are no sub-processors.

What the app stores

Assignment records, one per group assigned to a space or page:

• The space key or page identifier
• The group's identifier and name
• The Atlassian account ID of the person who created the assignment
• The date and time it was created

Watcher provenance records, one per person per space or page the app has acted on:

• The Atlassian account ID of that person, as part of the record's key
• Whether the watch was created by this app or already existed
• Whether that person has since unsubscribed themselves
• The date and time the record was last written

These records exist for one purpose, and it is a protective one: they are how the app tells a watch it created from a watch somebody chose for themselves, so that it never removes the latter. Without them the app could not safely withdraw anything.

Synchronisation state, one per space or page:

• A short non-cryptographic hash of the current group membership, plus a count
• Progress markers used to resume a large synchronisation across runs
• The date and time of the last complete synchronisation

The membership hash is a fixed-length value derived from the sorted set of account IDs. It does not contain the account IDs and they cannot be read back out of it. It exists so the app can notice that membership changed without re-reading every member.

What the app does not store

The app does not store names, email addresses, page or blog content, attachment contents, comments, or credentials. It stores Atlassian account IDs, which identify an account without disclosing anything about the person holding it.

Names are not stored. To show a readable name instead of an account ID, the app looks one up from Confluence while rendering a screen and discards it immediately afterwards. No name is written to storage at any point.

The app stores no free-text field of any kind. Every value it records is an identifier, a flag, a count or a timestamp.

Application logs

The app writes diagnostic logs to Atlassian's Forge logging, which lives within Atlassian's platform. Their retention is governed by Atlassian, not by us.

Those logs can contain Atlassian account IDs — specifically when a synchronisation cannot update a particular account, or when a storage read fails, because identifying which account was affected is what makes the entry useful. They contain no names, email addresses or content.

app's logs through the CLI, which is how production issues get diagnosed. It has not been confirmed how far that reaches for a distributed app — that is, whether we could retrieve logs from a customer's installation, and under what controls. Until that is checked against Atlassian's current documentation, this section must not claim that we cannot see them. Stating "your logs are private from the vendor" and being wrong is precisely the kind of overclaim that destroys a compliance document's credibility.

Who can see what

Assignment records are shown to people who can already open the relevant configuration screen: space administrators for a space, and people who can edit the page for a page. That screen displays which groups are assigned, how many people each group contains, who created the assignment, and aggregate counts of how many people the app has subscribed and how many have unsubscribed themselves.

Those counts are aggregate only — nobody is named. Someone who unsubscribes is counted, not identified, so an administrator can tell that the app is behaving correctly without a personal choice being reported to them.

That last item is deliberate. Assigning a group subscribes colleagues to notifications they did not ask for, and the person who did it should be identifiable to the others who can undo it.

Retention and deletion

Records exist for as long as the assignment does. Removing an assignment deletes its record and the provenance records for the people it subscribed. Uninstalling the app removes its Forge storage under Atlassian's platform retention rules.

Important, and easy to get wrong. Uninstalling the app stops all future synchronisation, but it does not remove watches that already exist in Confluence. Those are ordinary Confluence watch records, indistinguishable from ones people set for themselves, and they remain until removed. Anyone can unwatch normally. To have the app withdraw the watches it created, remove the assignments before uninstalling.

Your rights

Because the app stores only Atlassian account IDs and holds no independent record of a person, requests relating to an individual are normally satisfied through Atlassian, who controls the account and its personal data. If you need records referencing a specific account ID located or deleted, contact support@alzhangroupllc.com and we will help you identify them.

Changes

Material changes to this policy will be reflected in the Marketplace listing and in the app's documentation, with the date above updated.