Sprint Autopilot — Privacy Policy

Last updated: 4 May 2026 Effective date: 4 May 2026 Vendor: FellowSheep Studios Contact: mrmateuszbaran+sprintautopilot@gmail.com

This Privacy Policy explains how Sprint Autopilot (“the App”, “we”, “us”) handles data. It applies to anyone using Sprint Autopilot inside their Atlassian Jira Cloud site.

TL;DR (the short version)

• Sprint Autopilot is a Bring-Your-Own-Key (BYOK) application. You provide your own Anthropic API key. AI calls go from Atlassian’s Forge runtime directly to Anthropic.
• We do not run any servers. We have no database. We do not collect, store, or have access to your Jira data, your prompts, your AI responses, or your API key in plaintext.
• Your encrypted API key is stored in Atlassian’s Forge KVS, scoped to your Jira site. It is automatically wiped when the App is uninstalled.
• Anthropic processes the prompts you send (Jira issue content for summaries / digests) under their own terms. We do not control that processing.

1. What data the App handles

When you use Sprint Autopilot, the following data is touched:

A. Jira issue data — read by the App, sent to Anthropic, not stored by us

• Issue summary, description, comments, status, assignee, priority, labels, sprint membership, status-change date.
• Used to generate AI summaries (per-ticket) and standup digests (last 24 hours of sprint activity).
• Sent over TLS to Anthropic’s API at api.anthropic.com.
• Not retained by Sprint Autopilot in any persistent storage.
• The AI output is rendered in your Jira browser session; for digests it is optionally posted as a new Jira issue inside your project.

B. Configuration data — stored encrypted in Atlassian Forge KVS, scoped to your Jira site

• Your Anthropic API key — stored as a Forge secret (kvs.setSecret). Encrypted at rest by Atlassian. Not visible to us.
• Your chosen risk-dashboard sensitivity (strict / balanced / relaxed).
• Per-month aggregate AI-call counters (number of calls + token totals) — used only to show cost transparency in the admin page. Contains no Jira data, no user identifiers, no prompt content.

C. Audit/diagnostic logs — Atlassian-managed

• Standard Forge runtime logs: timestamps, error stacks, function invocations.
• Stored in Atlassian’s logging infrastructure for the standard Forge retention window.
• We can view recent logs (via forge logs CLI) for support purposes; we do not export, archive, or aggregate them.

D. What we do NOT collect

• We have no analytics tracker.
• We do not collect user identifiers, IP addresses, browser fingerprints, or telemetry.
• We do not have a hosted backend; there is no Sprint Autopilot server outside Atlassian’s Forge runtime.
• We do not store any Jira issue content.
• We do not store, log, or proxy your prompts or AI responses.

2. Data flow (in words)

When you click “Summarize this ticket with AI”:

1. Your browser → Atlassian Forge function (using your Jira session, asUser scope).
2. Forge function → Jira REST API (/rest/api/3/issue/...) to read the issue and its comments.
3. Forge function → api.anthropic.com with your Anthropic API key + the ticket content as the prompt.
4. Anthropic → Forge function (structured JSON response).
5. Forge function → your browser (rendered in the AI Summary panel).

No step in this flow involves a Sprint Autopilot server. There is none.

3. Anthropic as a sub-processor

Sprint Autopilot’s AI features rely on Anthropic, PBC (the Claude API).

• Endpoint: api.anthropic.com.
• What is sent: the Jira issue content (description, comments, metadata) needed to generate the requested summary or digest.
• Who pays: you, on the Anthropic key you provide. We never see your usage.
• Anthropic retention: per Anthropic’s API data retention policy at https://www.anthropic.com/legal/privacy. As of May 2026, Anthropic retains API inputs/outputs for up to 30 days for trust & safety, then deletes them, unless you have a Zero Data Retention agreement directly with Anthropic.

Because Sprint Autopilot uses your Anthropic key, your relationship with Anthropic is direct. We are not a sub-processor of Anthropic on your behalf — Anthropic is your processor.

4. Atlassian as the platform

Sprint Autopilot runs on Atlassian Forge. Atlassian operates the Forge runtime, the encrypted KVS where your API key lives, and the logging system.

• Atlassian Privacy Policy: https://www.atlassian.com/legal/privacy-policy
• Atlassian Trust & Compliance: https://www.atlassian.com/trust

5. Data subject rights (GDPR, CCPA, similar)

Because we do not hold any of your data, the answer to most data-subject requests is: we do not have your data. For the encrypted API key and configuration that does exist in your Forge KVS:

• Right of access — visible in the Sprint Autopilot admin page (key preview, risk mode, usage counts).
• Right of erasure — click “Remove key” in the admin page, or uninstall the App; both wipe the relevant storage. Uninstall additionally wipes the risk-mode preference and per-month counters.
• Right to data portability — there is nothing to port; we do not hold your content.
• Right to object/restrict processing — stop using the App or uninstall it.

Requests about Jira content itself: contact your Jira workspace admin and Atlassian directly. Requests about prompt/output content already sent to Anthropic: contact Anthropic directly.

If you need help: mrmateuszbaran+sprintautopilot@gmail.com.

6. International transfers

Atlassian Forge runtime regions and Anthropic API regions are managed by their respective providers. Sprint Autopilot does not control where compute happens.

• Atlassian: data residency options at https://www.atlassian.com/software/data-residency
• Anthropic: regions per https://www.anthropic.com/legal/privacy

7. Children

Sprint Autopilot is a B2B developer tool. It is not directed at children under 16, and we do not knowingly collect data from them.

8. Security

• Your Anthropic API key is stored as a Forge secret (kvs.setSecret), encrypted at rest by Atlassian.
• We never log API keys, prompts, or AI responses.
• The App’s source is reviewed before each Marketplace release. We follow Atlassian Forge security guidelines and minimise permission scopes to those strictly required.
• We have no production database, web server, S3 bucket, or admin panel of our own — minimising the attack surface significantly.

9. Changes to this policy

Material changes will be posted here with an updated “Last updated” date and, where reasonably practical, surfaced in the App’s admin page or Marketplace release notes.

10. Contact

For privacy questions, GDPR/CCPA requests, or general support:

FellowSheep Studios mrmateuszbaran+sprintautopilot@gmail.com