Data handling

This page is for admins, security teams and legal reviewers. It explains what PDF Exporter for Confluence reads, what it stores and for how long, and what happens to your data when you stop using the app.

In short

The app runs on Atlassian Forge, inside Atlassian's infrastructure. Yamuno runs no servers or databases of its own.
A single-page export, and any export run in This browser, is built in the person's browser and saved straight to their device. The app keeps no copy.
Background, scheduled and API exports are built on Forge and kept in Forge storage for a limited time, 7 days by default, then deleted automatically.
The app has no access to the internet outside Atlassian. Nothing it reads or produces is sent to Yamuno or anyone else.
Yamuno staff have no access to your pages, your exports or the app's stored data.

Where data is stored

Data	Where it lives	How long
Exports made in the browser	The person's device, as a downloaded file	The app keeps nothing
Background export files (PDF or ZIP)	Forge object storage on Atlassian's infrastructure	The site's retention period: 7 days by default, 1 to 90 days as admins set it. Admins can also delete any export earlier
Working files while a background export runs (the list of pages with their titles, parts of a large export)	Forge object storage	Parts: 24 hours. Page list: 7 days
Export records: name, owner's account ID, status, file names and sizes, error messages, the page a file was attached to	Forge app storage	30 days after the files are deleted or the export fails
Templates: settings, custom CSS, logos and cover images, and the account ID of who created and last changed each	Forge app storage	Until deleted
Schedules: owner, name, what to export, the page to deliver to, people to notify (account ID and display name), last run result	Forge app storage	Until deleted
API tokens: label, owner, expiry, and a SHA-256 hash of the secret (never the secret itself)	Forge app storage	Until deleted. Tokens expire after at most 365 days
API call log: the last 25 calls per token, with time, result, page or space IDs, file names and errors	Forge app storage	Until the token is deleted
Usage statistics: daily counts of exports and pages, by output and by where the export started	Forge app storage	Counts only, no user or page names

Each site has a storage limit for background exports: 1 GB by default, which admins can set in Exports & storage. When the limit is reached, the oldest finished exports are deleted first.

Forge storage supports data residency. It stays in the same location as your Confluence site and moves with it if your admin changes the location. See Atlassian's hosted storage data lifecycle.

What the app reads

The app asks Atlassian for these permissions, and uses them only for the features listed:

Permission	Used for
Read pages, page trees, spaces and space details, and search content	Choosing what to export and reading the pages to put in the PDF
Read attachments	Putting a page's images in the PDF, and attachments in ZIP exports
Read users	The last editor's name where a header or footer uses `{lastEditedBy}`, and owners' names in the admin lists
Write attachments	Attaching the file of a scheduled or API export to the page its owner chose
Write comments	Telling the people a schedule or API call names that a file is ready, with a comment on that same page
App storage	Templates, schedules, API tokens, export records and files

Atlassian grants an app's permissions as one set, so a single permission can't be switched off on its own.

Whose permissions an export uses

Exports people start themselves only include pages that person can view. A browser export reads pages as that person. A background export checks every page against that person's permissions before it starts, then the app reads only those pages.
Scheduled and API exports run for their owner. Every page is checked against the owner's permissions at the time of the run, and the owner must be able to edit the page the file is delivered to. The app's own, wider access never decides what is exported.

When data leaves Atlassian

It doesn't. The app has no permission to reach any site outside Atlassian: no external servers, fonts, analytics or tracking. The fonts used in PDFs are bundled with the app.

Files leave Atlassian only when a person downloads them. Download links for background exports work for one hour and only for the export's owner.

Debug export. The export dialog can build a debug ZIP for Yamuno support. It is built in the browser and saved to the person's device; nothing is uploaded. It contains the pages' text and structure, but not their images. Yamuno only sees it if you send it to us.

Who can access your data

Your users: people can export only what they can already view in Confluence. My exports shows each person their own exports only.
Admins: Confluence admins manage templates and see every export in Exports & storage, every schedule and every API token, and can delete them.
Yamuno: our staff can't see your pages, exports or the app's stored data. We only see what you send us in a support request.
App logs: the app writes errors to Atlassian's Forge logs, sometimes with an Atlassian account ID, the site ID or the IDs of the pages involved. Logs never contain page content. A site admin can stop sharing these logs with Yamuno under Atlassian Administration → Apps → Connected apps → the app → Details → Logs access. See Atlassian's production logs page.

Subprocessors and transfers

Atlassian is the only subprocessor for the app. Yamuno doesn't transfer your data anywhere, inside or outside the EEA. Hosting is covered by your agreement with Atlassian. See our Data Processing Agreement.

Leaving the app

Files you already have stay where they are: downloaded PDFs on people's devices, and files that schedules or API calls attached to Confluence pages, which are ordinary Confluence attachments.

Templates: copy any custom CSS from the template editor if you want to keep it.

Uninstalling:

The Export to PDF button and the exporter disappear, and schedules stop running.
Atlassian removes the app's stored data (templates, schedules, API tokens, export records and files) and then keeps it only for the rest of its retention period. If you reinstall within 21 days, Atlassian can link the new installation to the old data on request. After that, the stored data can't be recovered.