Legal
Comment Alerts for Jira. Last updated 31 August 2026.
Comment Alerts for Jira (“the app”) is published by Adam Abubaker (trading as Signalpost). This policy describes what the app reads, what it stores, and what leaves Atlassian.
When someone comments on a Jira issue, the app receives the issue and comment from the event Atlassian sends it. It then looks up the display names and email addresses of that issue’s assignee and reporter, so it has somewhere to send the notification.
It does not search, browse or index your issues, and it does not enumerate your user directory. It reads only the two people already associated with the issue that was commented on.
Everything the app stores lives in Forge storage, which is hosted by Atlassian. Specifically:
| Stored | Detail |
|---|---|
| Settings | Your From address and whether sending is enabled |
| Template | The subject and HTML body an administrator wrote |
| Rules | Which projects each rule covers, and who it notifies. People are stored as Atlassian account IDs, never as names or addresses |
| Delivery log | The last 100 attempts: time, issue key, rule, status, how many people it reached, subject, duration, and any error. Recipients are recorded as account IDs; the settings page looks their names up from Jira each time it is opened and stores nothing |
| Provider API key | Encrypted at rest. Never displayed again after saving — the page can only tell whether a key exists |
The app does not store anyone’s name or email address. Addresses are resolved from Jira at the moment a notification is sent, used to send it, and then discarded. The one exception is an address an administrator types into a rule themselves — a shared inbox, say — which is kept because it is their own configuration and there is no Jira account behind it.
Account IDs the app stores are reported to Atlassian every week through Forge’s personal data reporting API. When Atlassian replies that an account has been closed, that account is erased from every rule and every log row automatically.
Adam Abubaker (trading as Signalpost) operates no servers and stores nothing on its own infrastructure, because it has none. There is no vendor-side database, queue or log holding your data.
One thing: the email itself. The app makes an HTTPS request to api.resend.com carrying the recipient addresses, your From address, and the rendered subject and body. The body contains whatever your template references — by default the issue key, summary, status, project, assignee and reporter names, a link to the issue, and the comment text.
That request is made with your Resend API key, through your Resend account, under a sending domain you verified. We receive no copy of any message and have no access to that account.
The app contacts no other external service. It collects no analytics and sends no telemetry or error reports.
Application logs record deliveries as counts, never as addresses — a delivery appears as SENT ENG-412 to 1 recipient in 153ms. Error messages returned by the email provider are stripped of your API key before they are stored or displayed.
The settings page, the message template and the delivery log are restricted to Jira administrators. The restriction is enforced on every request to the app, not only in the interface, so it cannot be bypassed by calling the app directly.
The delivery log holds 25 entries and discards older ones as new attempts arrive. Uninstalling the app removes its stored data, including the encrypted API key. To request deletion sooner, contact us at the address below.
| Party | Role |
|---|---|
| Atlassian | Hosts the app and all of its stored data |
| Resend | Delivers your email, under your own account and your own agreement with them |
Data residency is not supported in this version of the app.
Questions about this policy, or requests relating to personal data, go to support@signalpostapps.com.