SourceDocsPrivacy policy
Effective 12 October 2026. Applies to the Atlassian Marketplace app "SourceDocs for Confluence" and the website sourcedocs.dev.
Who we are
SourceDocs is published by Mesut Sözüer, a sole proprietorship registered in Türkiye ("we", "us"). Contact: [email protected]. For the purposes of data protection law, the Atlassian customer that installs the app is the controller of the content processed through it; we act as a processor to the limited extent described below.
What the app processes
| Data | Purpose | Where it is stored | Retention |
|---|---|---|---|
| Git provider access tokens entered by a Confluence administrator | Fetching files from private repositories | Atlassian Forge secret storage (encrypted), inside the customer's Atlassian site region | Until removed on the admin page or the app is uninstalled |
| Contents of files that page authors embed (Markdown, diagram sources, API specifications, code) and images they reference | Rendering them on Confluence pages | Transiently in the Forge backend; cached in Forge Key-Value Storage inside the customer's site for up to 10 minutes (files under 200 KB only); rendered in the reader's browser | Deleted automatically 10 minutes after the file was fetched |
| Pictures of diagrams (SVG drawn in the reader's browser, light theme) | Embedding diagrams in PDF and Word exports, which run on the backend where diagrams cannot be drawn | Forge Key-Value Storage inside the customer's site, keyed by a hash of the diagram source | Deleted automatically 30 days after the picture was stored; stored again the next time the page is viewed |
| Macro configuration (file link, diagram source, display options) | Showing the macro | Inside the Confluence page content, managed by Atlassian | With the page |
| Connection list (provider, host, optional label, date saved). No user or account identifiers. | Showing which providers are connected on the admin page | Forge Key-Value Storage | Until the credential is removed or the app is uninstalled |
Automatic deletion uses Forge storage expiry: an expired entry is never used again and Atlassian removes it from storage within 48 hours. When the app is uninstalled, Atlassian keeps its storage for the standard Forge retention period (so that a reinstall can recover it) and then deletes it.
The app does not read Confluence pages, users, groups or spaces, does not access any Atlassian content beyond the macros it renders, and does not store any data outside Atlassian's infrastructure.
What we do not do
- No analytics, tracking pixels, cookies or telemetry in the app.
- No transfer of customer content to us or to any third party. The only external recipient of a request is the Git provider the administrator connected (GitHub, GitLab, Bitbucket Cloud, Azure DevOps) or a Git server of your own that an administrator added and approved, which receives the file path and the credential as required to serve the file.
- No sale or sharing of personal data.
Data we hold about you as a customer
Atlassian handles Marketplace purchases, licensing and billing; we receive the information Atlassian provides to Marketplace partners (site identifier, license tier and status, and the contact details of the licensed site's technical contact where Atlassian shares them). If you write to us, we keep the correspondence for as long as needed to handle the request and for up to 24 months afterwards. Email is hosted by Zoho Corporation (EU data centre).
Website
sourcedocs.dev is a static site served by Cloudflare. We set no cookies and run no analytics scripts. Cloudflare may process connection logs (IP address, user agent) for security and performance under its own policies.
Legal bases and international transfers
We process the data above to perform the contract with the customer (providing the app) and on our legitimate interest in operating and supporting it. Customer content stays in the Atlassian region of the customer's site. Support correspondence is stored in the EU.
Your rights
Depending on your location you may have rights of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with a supervisory authority. Requests about content processed through the app should go to your Confluence administrator, who controls it; requests about correspondence with us go to [email protected].
Sub-processors
- Atlassian Pty Ltd: hosting of the app (Forge), storage, Marketplace billing.
- Zoho Corporation: email for support and privacy requests.
- Cloudflare, Inc.: hosting of this website and DNS.
Changes
We will post changes to this page and update the effective date. Material changes affecting app data handling will also be noted in the Marketplace release notes.