Privacy Policy: Secret Scrubber

How Secret Scrubber handles data, and what we receive.

Effective date: 13 November 2026. Vendor: Noam Apelfeld. Contact: support@secretscrubber.com. Website: secretscrubber.com.

1. Summary

Secret Scrubber runs inside Atlassian Forge on your Atlassian site. We do not operate servers that receive your attachments, comments or audit data.

2. What the app processes

Attachment content, issue descriptions and comments, for the time a job runs, in memory of the Forge function, to find and redact sensitive data and to repoint file links.
Attachment metadata: id, name, type, size, author, issue key.

3. What the app stores, in your Atlassian site

An audit log in Forge SQL: time, issue key, attachment id, file name (or its hash if you enable hashing), file type, status, number of redactions, rule names with counts, error code. No sensitive values.
Settings, a random per-installation secret used for redaction tokens, locks and progress records in Forge key-value storage.
Retention: audit rows are deleted after the period you set (default 12 months, 1 to 120).

4. What we receive

We do not receive attachments, comments or audit data. We receive what you send us, for example a support email: your email address and what you write. We use it to answer you and keep it as long as needed to handle the request. We keep support emails for 24 months.

No sub-processors beyond Atlassian, which hosts the app and your data under its own terms. We do not sell data.

6. Security

Processing stays inside Forge; the app declares no external network access. See Security and data handling.

7. Your rights

You can export the audit log from the admin page and control retention. You can contact support@secretscrubber.com for any request. A data processing addendum is available on request: support@secretscrubber.com.

8. Changes

We will post changes on the listing and update the effective date.