Data handling

This page is for admins, security teams and legal reviewers. It explains what HTML Macro+ for Confluence stores, what it reads, and what happens to your data when you stop using the app.

In short

The app runs on Atlassian Forge, inside Atlassian's infrastructure. Yamuno runs no servers or databases of its own.
Your HTML, CSS and JavaScript are stored in the Confluence page itself.
Everything else the app creates is kept in Forge app storage, on Atlassian's infrastructure, in your site's data residency location.
Yamuno staff have no access to your pages or to the app's stored data.
Content only comes from outside Atlassian when a macro loads it from another website, and admins control that.

Where data is stored

Data	Where it lives
Macro code (HTML, CSS, JavaScript)	In the Confluence page, as the macro's configuration
App settings, version history and the shared library (components, variables, brand, uploaded images)	Forge app storage on Atlassian's infrastructure

Forge app storage supports data residency. It stays in the same location as your Confluence site and moves with it if your admin changes the location. See Atlassian's hosted storage data lifecycle.

Version history keeps up to 20 saved versions per macro, with the account ID of whoever saved each one. History for a macro is deleted after 6 months without a save.

What the app reads

The app asks Atlassian for these permissions, and uses them only for the features listed:

Permission	Used for
Read pages, blog posts and spaces, and search content	The macro usage report and finding macros to migrate
Write pages and blog posts	Migration only. The app changes a page only when someone runs a migration, and it acts as that person, with their own Confluence permissions
Read users and groups	The editor permission picker, and checking whether someone may edit
App storage	Settings, version history and the library

Atlassian grants an app's permissions as one set, so a single permission can't be switched off on its own.

When content leaves Atlassian

The app itself sends no page content, user data or settings outside Atlassian. Content comes from outside only in these cases:

A macro loads something from another website, such as an image, script, font, video or embed. The reader's browser fetches it from that site, as it would on any web page. Admins control this with Block all, Whitelist only or Allow all in the security settings.
A legacy HTML Include macro fetches the page it points to from inside Atlassian's cloud, and only from domains the security settings allow.
Google Fonts. If an admin picks a Google font in the brand settings, readers' browsers load that font from Google. The app's Getting started page also loads its own fonts from Google Fonts.

With Block all, macros load nothing from outside.

Who can access your data

Your users: people see macros on pages they can already view in Confluence. Only the people and groups your admins allow can edit macros, and only Confluence admins can change the app's settings and library.
Yamuno: our staff can't see your pages or the app's stored data. We only see what you send us in a support request.
App logs: the app writes error messages to Atlassian's Forge logs, sometimes with an Atlassian account ID. Logs never contain page content. A site admin can stop sharing these logs with Yamuno under Atlassian Administration → Apps → Connected apps → the app → Details → Logs access. See Atlassian's production logs page.

Subprocessors and transfers

Atlassian is the only subprocessor for the app. Yamuno doesn't transfer your data anywhere, inside or outside the EEA. Hosting is covered by your agreement with Atlassian. See our Data Processing Agreement.

Leaving the app

Without a subscription: if the app becomes paid for your site and you don't subscribe, pages keep showing their content. Editing and the app's settings stop until someone subscribes.

Exporting: you can copy any macro's code from the editor at any time. If pages use library components, the page only holds the component's tag, so copy the components' code from the library too.

Uninstalling:

The macro code stays in your pages, but Confluence shows a placeholder instead of the content until the app is installed again.
Atlassian removes the app's stored data (settings, version history, library) and then keeps it only for the rest of its retention period. If you reinstall within 21 days, Atlassian can link the new installation to the old data on request. After that, the stored data can't be recovered.