Privacy Policy

Checklist All HQ Trello Power-Up

What the Power-Up Accesses

When you authorize Checklist All HQ inside Trello, Trello issues a token that lets the Power-Up act as you, limited to boards you can already access. Using that token, the Power-Up reads board names, lists, cards, checklists and checklist items (including their due dates and assignees), and board member names — and writes only one thing: checklist item completion state, when you check an item off in the console.

Where Your Data Goes (and Doesn't)

• Card and checklist data: fetched by your browser directly from Trello's API, displayed in the console, and discarded when you close it. It is never transmitted to Macon Apps servers, never stored by us, and never shared with anyone.
• Your authorization token: stored by Trello's official Power-Up client in your own browser's local storage. We cannot read it from our servers, and it never leaves your browser except in direct calls to Trello's API.
• Settings: your board selection and an authorized-yes/no flag are kept in Trello's own Power-Up storage (managed by Atlassian, removed when the Power-Up is removed).
• CSV exports: generated in your browser and saved to your own device. Nothing is uploaded.

What We Do Store

To operate paid subscriptions, our license service (hosted on Cloudflare) stores one small record per subscribed workspace:

• the Trello workspace (organization) ID — an identifier for the workspace, not any person;
• a Stripe customer ID and subscription ID — opaque references into our payment processor;
• a timestamp.

That's the whole record. It contains no names, no emails, no board or card content. When a subscription is canceled and its paid period ends, the record is deleted automatically.

Payments

Checkout and billing are handled entirely by Stripe. Your card number and billing details go to Stripe, not to us; we never see or store them. You can view, update, or cancel your subscription anytime through the billing portal.

Cookies, Analytics & Tracking

Checklist All HQ sets no cookies of its own, embeds no analytics, and does no ad tracking. The only network calls the Power-Up makes are to Trello's API, to our license check (which receives your workspace ID and nothing else), and — during checkout only — to Stripe.

Data Retention & Deletion

• Card data: never retained by us in the first place.
• Token & settings: use Trello's "Remove personal settings" on the Power-Up, or remove the Power-Up from your board, to clear them. You can also revoke the token anytime from your Trello account's application settings.
• License record: deleted automatically when your subscription ends. To request earlier deletion, email [email protected] and we will remove it within 30 days (this also ends the paid plan for that workspace).
• Stripe records: retained by Stripe per its own policy and legal requirements (e.g., tax and accounting).

Third Parties We Rely On

• Atlassian / Trello — hosts your boards and the Power-Up platform (Atlassian privacy policy).
• Stripe — payment processing (Stripe privacy policy).
• Cloudflare — hosts the Power-Up's static files and the license service (Cloudflare privacy policy).

Your Rights

Because we hold no personal data about you beyond what's described above, most privacy-law requests (access, correction, portability, deletion) are satisfied either by Trello/Atlassian (for your board content and account) or by a quick email to us for the license record. See Part I, Section 12.

↑ Back to index

Audit Log & Board History Trello Power-Up

What the Power-Up Accesses

When an admin connects a board, Trello asks them to authorize the Power-Up. The token Trello issues is read-only, expires after 30 days, and is used transiently — to register the board's activity listener and to verify admin permissions — then discarded. It is never stored on our servers. After that, board activity reaches us through Trello's webhook system: Trello sends each action to our server as it happens, and our server keeps only the reduced record described below.

What We Store

For each recorded action on a connected board, our server stores:

• the action type (e.g. "card created", "card deleted", "card moved");
• the acting member's Trello member id — a pseudonymous identifier, never their name;
• the card and list ids involved, and their titles (also checklist, check-item, and label titles where relevant);
• the timestamp;
• a restricted summary of which fields changed — old/new values for dates, positions, and flags; free text (descriptions, comments) is reduced to a character count.

Explicitly never stored:

• card or board descriptions and comment text (lengths at most);
• attachments — contents, URLs, and even filenames;
• member display names, usernames, emails, or avatars. The names you see in the timeline are looked up by your own browser from the board you're viewing — they never reach our database.

Alongside the timeline we keep small operational records: which boards are connected and which admin switched recording on or off; a per-workspace billing record (Stripe customer and subscription references, plan — never card details); and permanent deletion records ("who deleted how much history, when" — never the deleted content itself).

Who Can See the Timeline

Every member of a connected board can read that board's whole timeline, including filtering it by person. That matches Trello's own activity feed and the product's purpose — a shared record the whole team can trust — but it does mean a searchable, per-person history of activity on that board. Because of that:

• turning recording on requires a board or workspace admin, verified against Trello — not just anyone who can open the board;
• who turned it on (and who turned it off) is shown to every board member in settings;
• a workspace that doesn't want a colleague-filterable activity history should not enable this Power-Up.

How Long We Keep It

How Deletion Works

• Delete a board's history (settings → admin only): offers a CSV export first, requires typing the board id to confirm, then permanently deletes the board's recorded events. A deletion record — who, when, how many events, covering which date range, and whether an export was taken — remains visible to every board member.
• Erase everything for a workspace (settings → workspace admin): shows a summary of what we hold, then deletes all recorded events and board records for the workspace, and anonymises the workspace's existing deletion records.
• Individual erasure (GDPR): we poll Trello's member-privacy compliance API at least every 14 days. When a member deletes their Atlassian account or revokes the Power-Up's access, every reference to their member id in our data — as actor, as target, as the admin on a record — is removed. The timeline rows remain (an audit log with holes is worse than useless) but no longer identify anyone.
• "Remove personal settings" in Trello clears your own per-member state. It deliberately does not stop the board's recording — that is an admin action — because an audit log any single member could switch off would not be an audit log.
• You can also email [email protected] with any erasure request and we will honor it within 30 days.

Payments

Checkout and billing are handled entirely by Stripe. Your card number and billing details go to Stripe, not to us; we never see or store them. A workspace admin can view invoices, switch between monthly and annual, update the payment method, or cancel anytime via settings → Manage billing.

Cookies, Analytics & Tracking

The Power-Up sets no cookies of its own, embeds no analytics, and does no ad tracking. Its pages talk only to Trello's API and to our own service — and, during checkout only, to Stripe.

Security

• All traffic is encrypted in transit (TLS, with HSTS).
• Every request to our service is authenticated with a Trello-signed token verified on our servers, pinned to this specific Power-Up and to the specific board being viewed.
• Destructive and billing actions additionally verify board/workspace-admin status live against Trello, under the caller's own credential.
• Authorization tokens are never stored; credentials never appear in URLs or logs.

Third Parties We Rely On

• Atlassian / Trello — hosts your boards, the Power-Up platform, and delivers board activity to us (Atlassian privacy policy).
• Stripe — payment processing (Stripe privacy policy).
• Cloudflare — hosts our service and its database (US/global edge) (Cloudflare privacy policy).

Your Rights

For your Trello account and board content, contact Atlassian. For the data this Power-Up holds: access and portability are served by the CSV export; deletion by the settings described above or by email. See Part I, Section 12.

↑ Back to index

Find and Replace + Banned Term Watch Trello Power-Up

What the Power-Up Accesses

The Power-Up works entirely through your own Trello authorization. When you authorize it (read and write), it reads card titles, card descriptions and checklist items on the boards you point it at, and — when you run a rewrite — edits those same fields under your own Trello permissions. It cannot change anything you could not change by hand, and a card you cannot edit is reported as refused rather than modified.

Board and workspace membership is read with Trello's member=false option, which returns member identifiers and roles only — names, usernames, email addresses, avatars and bios are never requested from the Trello API, so they never enter the service at all.

What We Store

Most of what the Power-Up touches is read, matched in memory, and discarded within the same request. It stores a small, deliberate set of data outside Trello, because preview and undo are impossible without it:

• Match snippets — roughly 30 characters of card text on either side of each match, so the results list and the before/after preview can show you what you are about to change. Kept 7 days.
• The undo journal — the complete before and after text of every field a rewrite changed, including full card descriptions. This exists so undo can restore a field exactly, and so a field a colleague edited afterwards is detected and left alone rather than overwritten. Kept 7 days, after which undo for that job is no longer offered.
• Your search and replacement strings, including saved and watched terms — user-authored text, kept with the records they belong to (see the schedule below).
• Identifiers and bookkeeping — card, board and checklist ids, card short links, board titles, match counts and job statuses, which make up the change logs and progress reporting.
• Trello member ids on the rows recording who ran a search or rewrite or saved a term. These are pseudonymous but re-identifiable through Trello, so we treat them as personal data (see Your Rights below).
• Billing records — your workspace's Stripe customer id, plan and subscription status.

Who Can See What

Search results and their snippets are visible to the member who ran the search and, for a single-board search, to members of that board. Rewrite change logs are scoped the same way. A workspace admin can see the workspace's rewrite history. The banned-term watch list and its alerts are visible to subscribed members of the workspace, but an alert carries references only — which card, which field, which term — and the card itself is fetched live under the viewer's own Trello permissions, so a member who cannot open a board sees nothing beyond an identifier.

How Long We Keep It

These periods are enforced automatically by a nightly job. Trello does not notify Power-Ups when they are removed from a board, so removal is not an event we can act on — but nothing further is written after removal, and the schedule above applies from that point: all card content is gone within 7 days, and everything except the billing record within 365 days.

How Deletion Works

1. Self-service, immediate: a Trello workspace admin opens the Power-Up and uses the data deletion action, which erases every record we hold for that workspace. The request must echo the workspace id as confirmation, so a mis-click cannot destroy data. Billing records are retained as described above; cancel the subscription in the billing portal to end that relationship.
2. Automatic, per member: we poll Trello's member privacy endpoint nightly and honour account-deleted, account-updated, token-revoked and token-expired events by removing that member's identifier from every record that holds it.
3. Automatic, time-based: the retention schedule above.
4. On request: email [email protected] and we will run the workspace purge for you.

Payments

Subscriptions are processed by Stripe. Card details are entered on Stripe's hosted checkout page and managed in Stripe's customer portal — they never reach us and we never see them. We store only the Stripe customer id, plan and subscription status needed to know what your workspace is entitled to.

Cookies, Analytics & Tracking

The Power-Up sets no cookies and uses no analytics, advertising or tracking of any kind. There is no analytics provider, no advertising provider, and no sub-processor beyond the two named below. No customer data is sold, shared, or used for training.

Security

• All traffic is HTTPS with HSTS (one-year max-age, including subdomains). Data at rest is encrypted by Cloudflare D1 and KV.
• Every request is authenticated with the Trello-signed token for this specific Power-Up, verified server-side against Trello's public keys and pinned to this Power-Up's own id — a token issued for a different Power-Up is rejected.
• Your Trello REST token is additionally checked to belong to you, used within the request, and never stored or logged.
• Billing, data deletion and workspace-wide rewrites additionally require Trello workspace admin, verified live against Trello.
• The Power-Up iframe is served with a Content-Security-Policy containing no unsafe-inline, unsafe-eval or unsafe-hashes, and can only be framed by trello.com.

Third Parties We Rely On

• Cloudflare (Workers, D1, KV) — application hosting and data storage (Cloudflare privacy policy).
• Stripe — payment processing (Stripe privacy policy).

No other sub-processor is used.

Your Rights

The only personal data we hold is your Trello member id on records of actions you took. You can have it removed at any time: through a Trello account deletion or token revocation (honoured automatically, nightly), through your workspace admin running the data deletion action, or by emailing us. See Part I, Section 12.

↑ Back to index

Board Merge & Split Trello Power-Up

What the Power-Up Accesses

The Power-Up works entirely through your own Trello authorization. When you authorize it, it reads the structure of the boards you point it at — lists, labels, and card counts — to build a merge or split preview, and when you execute one, it moves lists and cards under your own Trello permissions. It can never change anything you could not change by hand, and an operation Trello refuses under your permissions is recorded as refused rather than performed.

Board and workspace membership is read with Trello's member=false option, which returns member identifiers and roles only — names, usernames, email addresses, avatars and bios are never requested from the Trello API, so they never enter the service at all.

What We Store

Most of what the Power-Up reads is used to answer the request and discarded. It stores a small, deliberate set of data outside Trello, because a previewed, resumable, undoable merge is impossible without it:

• Merge/split plans — board ids and names, the ordered operations (list ids, list names, label names and colours, positions, card counts), so execution runs exactly what you previewed.
• Job receipts — one row per operation performed, with its outcome, forming the audit history and CSV export.
• The undo record — the inverse of every destructive operation, including the card ids a drained list held before its cards were merged into another list. This is what makes a merge reversible; without the id set the cards are indistinguishable afterwards.
• Trello member ids on the rows recording who created each plan and job. These are pseudonymous but re-identifiable through Trello, so we treat them as personal data (see Your Rights below).
• Billing records — your workspace's Stripe customer id, plan and subscription status.

Who Can See What

You see the merges and splits you ran. A Trello workspace admin — verified live against Trello, never assumed — can see the workspace's job history and receipts. Receipts carry board and list names and operation outcomes; they never carry card content. Running, executing or undoing a merge requires admin rights on both boards involved, verified against Trello at the time of the request.

How Long We Keep It

These periods are enforced automatically by a nightly job. Trello does not notify Power-Ups when they are removed from a board, so removal is not an event we can act on — but nothing further is written after removal, and the schedule above applies from that point: everything except the billing record is gone within 365 days of its creation.

How Deletion Works

1. Self-service, immediate: a Trello workspace admin opens the Power-Up and uses the data deletion action, which erases every plan, job, receipt and undo record we hold for that workspace. The request must echo the workspace id as confirmation, so a mis-click cannot destroy data. Billing records are retained as described above; cancel the subscription in the billing portal to end that relationship.
2. Automatic, per member: we poll Trello's member privacy endpoint nightly and honour account-deleted, account-updated, token-revoked and token-expired events by removing that member's identifier from every record that holds it.
3. Automatic, time-based: the retention schedule above.
4. On request: email [email protected] and we will run the workspace purge for you.

Payments

Subscriptions are processed by Stripe. Card details are entered on Stripe's hosted checkout page and managed in Stripe's customer portal — they never reach us and we never see them. We store only the Stripe customer id, plan and subscription status needed to know what your workspace is entitled to. Undoing a merge is deliberately never gated on an active subscription: a lapsed plan can always put a board back the way it was.

Cookies, Analytics & Tracking

The Power-Up sets no cookies and uses no analytics, advertising or tracking of any kind. There is no analytics provider, no advertising provider, and no sub-processor beyond the two named below. No customer data is sold, shared, or used for training.

Security

• All traffic is HTTPS with HSTS (one-year max-age, including subdomains). Data at rest is encrypted by Cloudflare D1 and KV.
• Every request is authenticated with the Trello-signed token for this specific Power-Up, verified server-side against Trello's public keys and pinned to this Power-Up's own id — a token issued for a different Power-Up is rejected.
• Your Trello REST token is additionally checked to belong to you, used within the request, and never stored or logged.
• Merging, splitting and undoing require admin rights on both boards involved, verified live against Trello; billing and data deletion require workspace admin.
• Destructive actions sit behind a typed confirmation (the source board's name), enforced on the server — and closing a source board only ever happens because someone explicitly chose it.
• The Power-Up iframe is served with a Content-Security-Policy containing no unsafe-inline, unsafe-eval or unsafe-hashes, and can only be framed by trello.com.
• CSV exports neutralise spreadsheet formula injection, so a hostile list name cannot execute when an admin opens the audit export.

Third Parties We Rely On

• Cloudflare (Workers, D1, KV) — application hosting and data storage (Cloudflare privacy policy).
• Stripe — payment processing (Stripe privacy policy).

No other sub-processor is used.

Your Rights

The only personal data we hold is your Trello member id on records of actions you took. You can have it removed at any time: through a Trello account deletion or token revocation (honoured automatically, nightly), through your workspace admin running the data deletion action, or by emailing us. See Part I, Section 12.

↑ Back to index

ConfigMonitor Jira Cloud app

What ConfigMonitor Accesses

ConfigMonitor reads your Jira site's configuration: workflows, custom field definitions, field configurations, screens and screen schemes, permission schemes, notification schemes, and issue type schemes. To show who made a change, it also reads Jira's built-in audit log records. All reads use the app permissions a site admin approves at install — Atlassian's Forge platform enforces that boundary.

ConfigMonitor does not read the content of your issues, comments, attachments, or user directories, and it writes nothing to your Jira configuration — it is a read-only observer.

What ConfigMonitor Stores, and Where

To detect and display changes, ConfigMonitor keeps the following in Forge storage — Atlassian-hosted storage that lives inside Atlassian's cloud, alongside your Jira data:

• Configuration snapshots: the current shape of each tracked configuration object, used to compute the next diff.
• Change events: the history you see in the timeline — timestamps, object names, before/after diffs, and plain-language summaries.
• Actor names: where Jira's audit log identifies the admin who made a change, that display name is stored on the change event. This is the only personal data ConfigMonitor holds, and it never leaves Atlassian's platform.

Because storage is provided by Atlassian's Forge platform, it inherits Atlassian's hosting, security, and data-residency arrangements for your site. Macon Apps has no independent copy and no way to access your site's data outside the app itself.

No API Tokens, Ever

ConfigMonitor authenticates through Forge's built-in app identity, granted once at install by your site admin. It has no setup screen requesting an email-plus-token, no credential field of any kind, and it does not collect, transmit, or store Atlassian user API tokens — in line with Atlassian Marketplace security requirements. If any screen ever appears to ask you for a credential, it is not ours: stop and contact us.

Payments

ConfigMonitor is sold through the Atlassian Marketplace. Billing, invoicing, and payment details are handled entirely by Atlassian on your existing Atlassian bill — Macon Apps never sees your payment information. Atlassian shares standard sales reporting with us (site-level license status), not personal payment data.

Cookies, Analytics & Tracking

ConfigMonitor sets no cookies of its own, embeds no analytics, and does no tracking of any kind. The app's user interface is served by Atlassian inside Jira, and the app makes no network egress to any non-Atlassian destination.

Data Retention & Deletion

• While installed: snapshots and change history are retained so the timeline and compliance exports keep working.
• On uninstall: the app's Forge storage is removed under Atlassian's platform rules for uninstalled apps. Nothing persists with Macon Apps, because nothing was ever sent to Macon Apps.
• Earlier deletion: to clear history while keeping the app installed, contact us at [email protected] and we'll walk you through it or ship it as a supported action.
• CSV exports are generated on demand and saved to your own device; you control those copies.

Third Parties We Rely On

• Atlassian — hosts Jira, the Forge platform the app runs on, the app's storage, and Marketplace billing (Atlassian privacy policy).

That's the whole list. ConfigMonitor uses no other processor, host, or service.

Your Rights

The only personal data ConfigMonitor holds is admin display names on change events, stored inside your own Atlassian environment and visible only to your site's admins. Requests about your Atlassian account and its data are handled by Atlassian; for anything about ConfigMonitor's stored history, see Part I, Section 12.

↑ Back to index