Inkwell ("the App") is a Confluence Cloud application developed by MiddleCore. This Privacy Policy explains what data the App stores and how we handle it.
Data collection
What we store. To provide section tracking, the App stores the following data in Atlassian Forge hosted storage:
- Section data: section titles, instructions, statuses, order, due dates, timestamps, and review comments
- User references: Atlassian account IDs of assignees, reviewers, and section creators/editors
- Cached display names: the display names of assignees, reviewers, and section creators, cached for display purposes
- Page metadata: page IDs, space IDs, and aggregate completion statistics
- AI usage counters: aggregate counts of AI generations, used to display the team's shared monthly allowance under Team usage
All of this data remains within Atlassian's cloud infrastructure at all times.
What we do not collect.
- No email addresses, passwords, or credentials
- No Confluence page body content (the App reads page information only to render its features in real time)
- No analytics, tracking, or telemetry data sent to external services
Data storage
All data is stored in Atlassian Forge hosted storage, which runs entirely within Atlassian's secure cloud infrastructure. Data is encrypted at rest and never leaves Atlassian's environment. The App makes no outbound network requests to external servers.
AI features (Draft with AI, AI Digest)
The App's AI features run on Atlassian-hosted models via Forge LLMs, entirely within Atlassian's infrastructure:
- Draft with AI processes the rough notes you type, together with the section's title and instructions, to generate a draft. The draft is inserted into the page only when you explicitly choose Append or Replace
- AI Digest processes section tracking metadata (titles, statuses, assignees, due dates) to produce a team summary
- Prompts and generated output are processed by Atlassian-hosted models and never leave Atlassian's environment; no external AI providers are used
- Site administrators can disable the AI features for the entire site
Personal data reporting (Atlassian user privacy guidelines)
In accordance with Atlassian's user privacy guidelines for Forge apps, the App periodically reports the Atlassian account IDs it stores to Atlassian:
- If an account's profile has been updated, the App refreshes its cached display name
- If an account has been closed, the App erases that user's personal data from its storage
Data retention
- Data is retained while the App is installed on your site
- When the App is uninstalled, all app data is automatically deleted by the Forge platform after 28 days
- Personal data of closed Atlassian accounts is erased as described above
Data sharing
We do not share, sell, or transfer any data to third parties.
Sub-processors
The App does not use any sub-processors. All processing — including AI processing via Atlassian-hosted Forge LLM models — occurs within Atlassian's Forge infrastructure.
Security
Inkwell is built on Atlassian Forge, which runs entirely within Atlassian's secure cloud infrastructure. Backend code executes within Atlassian's serverless infrastructure, the frontend runs in a sandboxed iframe, no external network requests are made, and data is encrypted at rest and in transit. See the Security policy for details.
GDPR compliance
For users in the European Economic Area (EEA):
- Data minimization: we store only the data required to provide section tracking (account IDs, display names, and section metadata)
- No data transfer: no data is transferred outside of Atlassian's infrastructure
- Right to erasure: personal data of closed Atlassian accounts is erased automatically via Atlassian's personal data reporting cycle. For other erasure requests, contact us at contact@middle-core.com
- Right to information: you may contact us at contact@middle-core.com for any privacy-related inquiries
CCPA compliance
For California residents:
- We do not sell personal information
- We store only the minimal personal information described above (account IDs and display names)
- For questions or requests, contact us at contact@middle-core.com
Children's privacy
The App is not intended for use by children under the age of 16. We do not knowingly collect any information from children.
Changes to this policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.
Contact
If you have questions about this Privacy Policy, please contact:
MiddleCore
Email: contact@middle-core.com
This privacy policy is effective as of August 2026. Last updated: August 2026.
