ScriptFree.
Privacy Policy

ScriptFree — Privacy Policy

Last updated: 26 August 2026

This policy explains what ScriptFree ("the app") does with the scripts you paste into it and the data it touches on your Jira Cloud site. It's a single-tenant admin tool — nothing here is shared or compared across different customers' sites.

Jump to a section
  1. Data this app processes
  2. How input is protected
  3. What is sent to the AI model
  4. What we don't do
  5. Where data is stored
  6. Your rights
  7. Contact

01 Data this app processes

When you use the app's admin page, it processes:

  • The legacy Groovy script you paste in, capped at 20,000 characters.
  • An optional error log you paste in alongside it, capped at 8,000 characters.
  • Your Jira account ID and the site's cloud ID, read from Atlassian's own Forge request context — not collected through any form field, and used only to run the conversion, never stored beyond that.

Oversized input is rejected outright, before any processing begins.

02 How input is protected before it leaves your site

Before your script or error log is sent anywhere, the app scans both for anything that looks like a hardcoded credential — Basic Auth headers, Bearer tokens, API keys, PEM private keys, JWTs, GitHub and Slack-style tokens, and a few other common patterns — and replaces each match with a placeholder. You're shown how many were caught, so you can double-check the original.

This redaction is best-effort, not a guarantee. It's pattern matching, and creatively formatted or unusual secrets can slip past it. Please still review a script for sensitive values before pasting it in.

03 What is sent to the AI model, and why

Only the redacted version of your script and error log is sent to a model, along with a filtered list of your site's own custom-field names, IDs, and types (never field values or issue content) — this is what stops the conversion from inventing a field ID that doesn't exist on your site.

The model call runs entirely through Atlassian's own Forge LLM API, hosted inside the Forge platform itself. This app doesn't hold a separate API key or vendor relationship for it — there's no third-party AI vendor your data passes through outside of Atlassian's own infrastructure.

04 What we don't do

  • We don't store your Jira credentials, API tokens, or any authentication material.
  • We don't share your scripts, error logs, or field metadata with any third party.
  • We don't run analytics or tracking scripts inside the app.
  • We don't retain converted code, input scripts, or error logs beyond the short window described below.
  • We don't compare or aggregate data across different customers' Jira sites.

05 Where data is stored, and for how long

Everything is stored using Forge's own per-installation storage — never a database this app operates itself.

WhatRetention
Your site's custom-field names/IDs (cached to speed up repeat conversions)Up to 6 hours
A pending conversion's result, while you wait for itUp to 15 minutes, deleted right after you view it
An hourly usage counter (a single number, for rate limiting)1 hour

All of this expires automatically, whether or not the app is later uninstalled. Removing the app from your site stops any further processing immediately.

06 Your rights

Because the app doesn't retain your scripts or converted code beyond the short windows above, there's generally nothing to request deletion of after that point. If you'd like confirmation of what's currently held for your site, or have a question relevant to GDPR, UK GDPR, or another regional privacy framework, contact us using the details below.

07 Contact

Clipper IT Services Ltd
Email: privacy@clipperitservices.co.uk

This policy may be updated from time to time; the date at the top reflects the most recent revision.