Privacy and security

Last updated 9 October 2026.

Documentation · Why it forecasts · Privacy and security · Support

This policy covers Gantt Forecast for Jira, an app published on the Atlassian Marketplace by Second Tiger (두번째호랑이, business registration 670-56-01033, Republic of Korea).

The short version: the app stores nothing and writes nothing. It reads the issues your JQL selects, draws them in your own browser, and keeps no copy. It holds two read permissions, so it cannot change anything in your Jira site even if it tried.

What the app processes

When you open the chart, the app reads from the Jira site it is installed on:

the issues your JQL selects — key, summary, type, status, assignee, parent link
their dates: created, resolved, due date, and whichever field your site uses for start date
their change log, but only when you switch to History mode — this is what lets the chart be rewound to a past day

It reads this as you, using your own Jira permissions. It cannot see an issue you cannot already see.

What the app stores

Nothing.

No Forge storage, no database, no cache, no cookies of our own.
No copy of your issues or change history survives the page load. Leaving History mode discards the history; closing the tab discards everything.
No analytics, no telemetry, no usage tracking.
No personal data is collected, and none is shared with anyone.

This is a design constraint, not a promise we re-check by hand: the app's test suite fails if the code ever imports Atlassian's storage API or adds a write method.

Where the processing happens

The chart is drawn in your browser. Reading Jira happens inside the Atlassian-hosted Forge runtime and the result goes straight to your browser frame.

The app makes no requests to any host outside Atlassian. It declares no external egress, which is what qualifies it for Atlassian's Runs on Atlassian programme.

Data residency

Not applicable. Because the app stores no data, there is no data to hold in any region. Your content stays in the Atlassian region your site is already hosted in.

Permissions the app requests

Scope	Why
`read:jira-work`	Read the issues your JQL selects, their dates and their change log
`read:jira-user`	Show assignee names on the chart

The app requests no write access. It cannot create, change, move or delete anything in your Jira site, and Atlassian enforces that at the platform level — it is not a matter of our code behaving well. One read endpoint is called with POST because a list of issue ids is too long for a query string; it changes nothing, and the app's tests name it explicitly as the single allowed exception.

Licensing data

Atlassian tells the app whether your site holds an active subscription, so that the app can stop serving data when it does not. That status is a flag; it carries no personal data, and the app does not store it.

Sub-processors

None. Atlassian hosts the app as part of the Forge platform; no other party is involved and no third-party service receives your content.

Your rights

Because no personal data is collected or retained, there is nothing to access, correct, export or erase. If you believe that is wrong in some case we have not thought of, write to us and we will investigate and answer.

Security reporting

If you find a security problem in this app, please report it privately to support@secondtiger.com rather than in a public issue. We aim to acknowledge within one business day, and to describe a fix or a mitigation within five.

Changes

If this policy changes in a way that affects what the app processes or stores, the change will be published here with a new date and described in the app's release notes.

Contact

Second Tiger (두번째호랑이)
183-32 Chungnyeong-ro, Sang-myeon, Gapyeong-gun, Gyeonggi-do 12448, Republic of Korea
support@secondtiger.com