Privacy Policy — MR Dashboard for GitLab

Summary

MR Dashboard for GitLab is a Jira app that displays GitLab merge request statistics inside Jira. It runs entirely on Atlassian's Forge platform — we (SK Labs) do not operate any servers, databases, or infrastructure of our own. The only external network call the app makes is to the GitLab instance your administrator configures; we do not send your data to any other third party, and we do not run analytics or tracking of any kind.

What the app is built on

The app is a native Atlassian Forge app: its UI runs inside Jira as a Forge Custom UI page, and its backend logic runs as a Forge function, both hosted entirely on Atlassian's infrastructure. We never see, receive, or store your data on any system outside of Atlassian Forge.

Data we process

To show merge request statistics, the app's backend function calls the GitLab REST API (of the GitLab instance your admin points it at — either gitlab.com or a self-hosted instance) and reads:

• Project/group membership (names, usernames, avatarless profile info)
• Merge request metadata: titles, authors, assignees, timestamps, comment counts, and other fields needed for the dashboard's classification
• Merge request activity notes (for the per-MR timeline view), fetched only when you open a specific merge request's history

This data is used exclusively to render the dashboard inside Jira. It is:

• Never sent to SK Labs or any third-party server. The single external HTTP call the Forge function ever makes is to the GitLab base URL your admin configured in the app's Settings screen.
• Cached briefly, not stored. Successful results are cached in Forge KVS (Atlassian's managed key-value store, scoped to your Jira site's app installation) for up to 2 minutes, purely to avoid re-querying GitLab on every reload and to go easier on GitLab's own rate limits. After that window, the cache expires and the next request fetches fresh data. We keep no long-term database of your merge requests, comments, or activity.

Your GitLab access token

The GitLab personal access token you enter in the app's Settings screen is stored using Forge Secret Storage (kvs.setSecret), Atlassian's encrypted-at-rest secret store built into the Forge platform. The token:

• Is never exposed to the app's frontend (browser) — only the backend Forge function reads it, to make authenticated calls to GitLab.
• Is never logged, transmitted to us, or shared with any party other than the GitLab instance it authenticates against.
• Can be rotated or removed at any time from the app's Settings screen.

We recommend using a token scoped to read_api only, since the app never writes to GitLab.

What we don't do

• We don't collect usage analytics, telemetry, or tracking data of any kind.
• We don't store personal data (yours or your GitLab collaborators') on any infrastructure outside Atlassian Forge.
• We don't share, sell, or otherwise disclose your data to any third party.
• We don't have access to your Jira or GitLab data ourselves — being built entirely on Forge means SK Labs has no backend to receive it even if we wanted to.

Data retention and deletion

• The GitLab token and connection settings (base URL, project/group ID) are stored in Forge storage scoped to your app installation for as long as the app is installed.
• Cached statistics expire automatically after 2 minutes and are not retained beyond that.
• Uninstalling the app removes its Forge-managed storage (including the saved token) for your site, per Atlassian's standard Forge app lifecycle.

Changes to this policy

If this policy changes, we'll update the "Last updated" date above and the copy published at this URL.

Contact

Questions about this policy or how the app handles data: sklabs.support@gmail.com.