Expiry TrackerPrivacy policy
Last updated: 11 November 2026
Expiry Tracker ("the app") is provided by Tomas Bindac, Czech Republic, doing business as Flowsmiths ("Flowsmiths", "we"). Contact: info@flowsmiths.app · Security reports: security@flowsmiths.app
1. Summary
- The app runs entirely on Atlassian Forge. The data you enter is stored in Atlassian's Forge storage for your site.
- We do not operate servers that receive your data, and we do not sell or share it.
- The app does not use analytics, tracking or advertising.
- The only data the app sends outside Atlassian is a domain name, sent to that domain's registry to read its expiry date.
2. What the app stores
Stored in Atlassian Forge storage, separately for each Jira site where the app is installed:
| Data | Purpose |
|---|---|
| Items you create: type, name, host or domain name, port, expiry date, vendor, cost, currency, note | To show the items and to create reminder issues |
| Atlassian account ID of each item's owner | To assign the reminder issue |
| Settings: target project ID, issue type ID, reminder thresholds | To create issues where you want them |
| Reminder records: which reminder issue (issue key) was created for which item and date | To avoid duplicate issues |
| Result of automatic lookups: time of the last check and the last error message | To show whether data is current |
| Summary of the last daily check: counts and up to five problem messages (these can include item names) | To show administrators what happened |
| SSL agent: a SHA-256 hash of the agent token, the time of the last report, and the agent's name and version as sent by the agent (by default the host name of the machine it runs on) | To authenticate the agent and show whether it is working |
The app does not store names, e-mail addresses or passwords of users. It stores Atlassian account IDs only for item owners. The agent token itself is shown once and is not stored; only its hash is.
3. What the app reads from Jira
Using the permissions you grant at installation:
- the list of projects and issue types (to let an administrator choose where issues are created);
- user details needed to display and pick an item's owner (handled by Jira's own user picker and user display).
The app creates issues in the project you choose. It does not read your existing issues.
4. Data sent outside Atlassian
Domain registries. For items of type "domain", the app sends the domain name over HTTPS to the RDAP server of the responsible registry (for example Verisign for .com) and reads the expiry date from the answer. No other data is sent. The registries are independent organisations with their own privacy policies. The full list of servers the app may contact is published in the app's listing (20 RDAP hosts).
SSL agent. If you choose to use it, the agent script runs on your own machine. It receives from the app the list of hosts and ports you entered for SSL items, connects to those hosts from your network, and sends back to the app the certificate expiry date or an error message for each host, together with the agent's name and version. This exchange happens between your machine and Atlassian's Forge platform. We are not a party to it and receive none of it.
Nothing else. The app does not contact Flowsmiths servers or any third-party analytics, advertising or tracking service.
5. Our access to your data
We have no direct access to the data stored for your site. As the app's developer we can see technical logs in Atlassian's developer console. The app is written to log counts and technical error details, not the contents of your items; an unexpected error may nevertheless include fragments of the data being processed. Logs are retained by Atlassian according to its own retention rules.
If you contact support and send us data (for example a screenshot or an export), we use it only to help you and delete it when the request is closed, unless the law requires us to keep it.
6. Where data is stored and for how long
Data is stored and processed by Atlassian on the Forge platform. Atlassian acts as the hosting provider; see Atlassian's privacy policy and Forge documentation for locations, security and data residency.
Data is kept while the app is installed. You can delete any item in the app at any time; deleting an item also deletes its reminder records. When the app is uninstalled, Atlassian deletes the app's stored data according to the Forge platform's retention rules. Issues the app created are ordinary Jira issues and stay in your Jira site until you delete them.
7. Legal basis and your rights (EU/EEA, UK)
For the data the app stores, your organisation (the Jira customer) decides what is entered and is the controller. To the extent we process personal data on your behalf, we act as a processor. The personal data involved is limited to Atlassian account IDs of item owners and any personal data you choose to type into names or notes.
You can view, correct, export (CSV) and delete the data in the app yourself. For any other request regarding your rights of access, rectification, erasure, restriction, portability or objection, contact info@flowsmiths.app or your Jira administrator. You also have the right to lodge a complaint with your data protection authority.
8. Security
See the app's security statement in the Marketplace listing. In short: data is stored only in Forge storage, the app requests the minimum Jira permissions it needs, outbound connections are limited to a fixed list of registry servers, and the agent endpoint requires a secret token.
9. Changes
We will publish changes to this policy at this address and update the date above. Material changes to what data leaves Atlassian also require you to approve the app's updated permissions in Jira.
10. Contact
Tomas Bindac (Flowsmiths) · info@flowsmiths.app · https://flowsmiths.app