This policy explains what the Link Health - Broken Link Checker for Confluence app (the “App”) accesses, stores and transmits. The App is an Atlassian Forge app: its code, its storage and its interface all run on Atlassian's platform.
The short version. The App is read-only — it finds broken links and reports them; it cannot edit, move or delete anything. It transmits nothing outside Atlassian: it declares no external-fetch permission and no remote hosts, which is why it is eligible for Atlassian's Runs on Atlassian program. The publisher operates no servers for this App and never receives your content.
The App requests only these Confluence scopes:
read:space:confluence and read:page:confluence —
to read space metadata and page bodies during a scan, so it can extract and
check links.storage:app — the App's own Forge storage (see §2).These are read-only Confluence scopes. No write scope is requested, so the App cannot change your content even in principle. Access happens when a user runs a scan, and — for spaces where an administrator has switched on the daily re-scan — once a day at a time chosen by Atlassian. A daily re-scan reads the same pages, under the same scopes, into the same storage as a scan run by hand: no new data category, no new destination. It is off unless it is switched on, it is set per space, and Atlassian skips it entirely on sites without an active licence. Both App pages are visible to Confluence administrators only.
| What | Why |
|---|---|
| Scan results — page titles, page IDs, space identifiers and the link targets found on those pages | To show the fix queue and to report what changed since the last scan |
| The per-space “ignore” list | So dismissed links stay dismissed |
| The App's own settings — which spaces an administrator switched the daily re-scan on for, and the time the one-time Marketplace review request was shown on this site | So the daily re-scan runs for those spaces and no others, and the review request is shown at most once per site. Space identifiers and a timestamp only; no page content and no user identity |
| Your Atlassian account ID, stored as the key of a single preference: the last space you selected | So the space picker remembers your choice. It is an identifier only — the App does not read your name, email or profile |
All of it is held in Atlassian-hosted Forge storage (KVS), scoped to your installation and readable only by this App. It is not the publisher's storage, and the publisher cannot read it. There is no external database and no copy of your content anywhere off Atlassian's platform.
While a scan runs, its working state (where the scan has got to, and the link targets it has already looked up) is also handed from one scan step to the next through Atlassian's Forge async events, on Atlassian's platform like the storage above. It goes nowhere else.
When the App is uninstalled, Atlassian deletes the storage belonging to that installation, and the data above goes with it.
Nothing. The App's manifest declares no
permissions.external block and no remotes block, so it
has no ability to make a request to any host outside Atlassian. External links
are therefore not checked — they are reported as skipped rather than
silently treated as healthy, and the App says so on screen.
Where the App processes personal data, our understanding of the chain is: you (the Confluence customer) are the controller; Basis Ventures (“Basis”) is a processor acting on your instructions; and Atlassian is a sub-processor, hosting the platform and the storage under Atlassian's Forge Data Processing Addendum.
Zero egress means your data does not travel to us. It does not mean we are outside that chain, and we do not claim to be.
Atlassian only. Atlassian hosts the platform, the compute and the storage. There are no other sub-processors, because there is nowhere else for the data to go.
The App runs on Atlassian Forge and inherits the platform's security and data handling. Beyond that: it holds read-only Confluence scopes, its storage is scoped to a single installation, and both of its pages check for administrator permission before rendering anything.
Only the App can read its own Forge storage — a site administrator cannot browse it directly. If you need data relating to a particular person located, exported or deleted, write to us at the address below and we will tell you exactly what is held and help you remove it. Uninstalling the App deletes all of it.
If this policy changes, the “Last updated” date above will change with it. A change that alters what the App transmits would also change its manifest, and would be visible in the App's Runs on Atlassian status.
Basis Ventures — Basis Gova Binyan Veyazamut Ltd., a company registered in Israel.
support@basis-s.co.il