Gherkit privacy policy

Last updated: 20 October 2026

Gherkit ("the app") is made by Roshan Jahangir, a sole trader in the United Kingdom trading as Gherkit ("we", "us"). Contact: support@gherkit.com.

The short version

• The app runs entirely on Atlassian's Forge platform, inside your Atlassian site's environment.
  • It has no servers of its own.
  • It sends no data outside Atlassian.
• We don't receive or store your Jira content.
  • Scenarios and test results are stored as properties on your own Jira issues.
  • App settings are stored in Atlassian-hosted Forge storage for your site.
• We don't use analytics, tracking, cookies or advertising.
• The only personal data we handle directly is what you send us when you contact support.

What the app processes

The app reads and writes only what it needs, using the permissions shown when you install it:

• Issue key, summary, status and parent: read, to show the living documentation.

• Issue properties: the app stores the scenarios you write (gherkit-feature) and test results (gherkit-results). These stay on your issues, inside Jira.

• Your Jira permissions: checked so the app only offers editing to people who can edit the issue.

• Your Atlassian account ID: stored with each saved version, so the history shows who changed it.

• Forge storage (inside Atlassian) holds:

  • app settings,
  • a list of step texts per project, used for suggestions,
  • up to 15 earlier versions of each issue's scenarios, for the history feature.

  When the app is uninstalled, Atlassian removes this storage under its Forge hosted-storage lifecycle. The data is first soft-deleted and kept for 28 days; reinstalling doesn't bring it back by itself, but if you reinstall within 21 days of uninstalling, it can be restored on request: email us and, with your consent, we'll ask Atlassian to relink it to the new installation. Issue properties stay on your issues until you remove them.

The optional CI helper script runs in your own pipeline with your own Jira API token. It talks only to your Jira site. We never see the token or the data.

Roles under UK GDPR / GDPR

• Data in your Atlassian site: your organisation is the controller, and Atlassian provides the hosting platform. The app processes that data on Atlassian's infrastructure and doesn't send it to us. If your organisation needs a data processing agreement for the app, email us and we'll provide one.
• Support emails: we are the controller. We use them only to help you and to keep a record of the conversation, and we keep them for up to 24 months unless the law requires longer.

Logs

Forge records technical logs when the app runs. The app is written so that it never logs the content of your issues or scenarios: it records only error types and HTTP status codes. Atlassian makes these logs available to app developers by default, and your site admin can turn that off in the Atlassian admin settings.

Sharing

We don't sell or share personal data. Support email is handled by our email provider (Namecheap, Inc. (Private Email)).

Your rights

You can ask for a copy of the personal data we hold about you, or ask us to correct or delete it, by emailing support@gherkit.com. You can also complain to the UK Information Commissioner's Office (ico.org.uk).

Changes

If we change this policy, we'll update the date at the top. If the app ever starts sending data outside Atlassian, we'll say so here and in the Marketplace listing before that version is released.