Privacy notice

This webpage

This page is served by Cloudflare Pages. Cloudflare may process technical request information, such as IP addresses and browser or device information, to deliver and secure the page. The page itself has no contact form, scripts or tracking.

Version of October 21, 2026.

Who we are. Checktide is operated by an individual operator established in the People's Republic of China (contact: support@checktide.app). This notice explains what Checktide reads, keeps and shares when you install the app from the Atlassian Marketplace and ask for a verification: Checktide testing, on your running site, what an issue describes.

What Checktide reads in Jira

The app asks for these permissions, by the names your Jira administrator sees: View Jira issue data; Create and update comments and Create and update comment properties; View comments, View comment properties, View groups, View projects, View project roles, View users, View avatars and View application roles; and storage for its own records on your site. Jira requires the "View" permissions of any app that adds a comment. Checktide has no permission to create, edit or delete your issues. View application roles lets the app read how many users Atlassian bills Checktide for on your site, which sets the credits each month of your subscription brings; it reads that count with the app's own access, keeps only the credits, and sends the count nowhere.

Comment properties are two small labels the app puts on its own comments and on nothing else: one keeps the comment internal on a service-desk project, so your own customers never see it; the other holds a random reference, so the app never posts the same comment twice. Neither holds anything from your Jira.

It changes nothing in your Jira except one thing: on an issue where a verification was started, it adds a short comment that mentions the person who started it — when it has a question, when the report is ready, when a report is corrected, or when it cannot take the request on. Those comments are part of the issue: they stay if you later ask us to delete our records or uninstall the app, and you can delete them like any other comment.

Checktide reads an issue's summary and description — and counts its comments, which it reads only when it takes the verification on — to propose what it can check only when someone opens Checktide on that issue and your site can start a verification (it has credits or a free verification), or when they choose to verify it on our demo shop. It reads each version of that text once, within the allowance we keep for these readings; nothing is tested and nothing is charged at that point. When you start a verification, it also reads, for that issue only:

Anything you write in those places may contain personal data. Its home page also lists, for the person viewing it, the issues in progress they can see that changed in the last 14 days: key, summary, status and when each changed, read as that person, shown only to them and kept nowhere. To show times in your own time zone, it also reads the time zone set on your Jira profile, for the pages you open; it is used only to format those times and is kept nowhere.

What you provide directly

Environment details: a name for the environment and, optionally, for each website; the websites' addresses and whether each is on a private network; the test accounts you give us for a website that needs a sign-in — a label of your own choosing and either the account's username and password, or an invitation to Checktide's test address, for which we set our own password so that you never send one; and an optional note on the request. The password is stored encrypted in Checktide's storage on your own Atlassian site. For each verification that needs it, the Checktide operator running that verification takes one copy and deletes it when the verification ends; the deletion is recorded with the request. Checktide keeps the password nowhere else, and you can change or remove the account on the environment's page at any time. Checktide never asks for credentials in Jira: please do not write passwords into environment notes or Jira issues, because text written there is stored like any other content.

Where the work happens

Checktide's rule is simple: Checktide keeps no copy of your information outside your own Atlassian site. Everything the app records lives in the app's storage on your site, under your Atlassian agreements; the proposal of what can be checked is drafted with the AI service Atlassian provides inside its platform: the issue's summary and description do not go to any third-party AI service and stay within Atlassian cloud, though that processing may take place outside your site's data residency region. Each reading also writes a line to the app's log on Atlassian's platform — the day, the AI model and the token counts, or the kind of failure — and no line holds the issue's words or an identifier of your site, issues or people. Atlassian makes these logs available to us for 30 days. The app makes four kinds of outbound call from Atlassian's platform. Three carry none of your information: a read-only status query to Cloudflare about Checktide's own network tunnels; an alert to Checktide's own relay when a request needs our operator — a random reference and a due time, nothing from your Jira; and, when your Jira admin clicks Connect for a private website, a request to the same relay to create or renew that environment's network tunnel at Cloudflare — the request carries only a keyed hash that names nothing, the relay keeps the tunnel's id, and the token that runs the tunnel passes to your admin's page once and is kept nowhere. The fourth tells the same relay when your subscription's credits, or your site's free verifications, are added for a period, or could not be: your site, your subscription and which period it was, the site and the subscription each as a keyed hash that names nothing, and the reason when nothing was added. The relay keeps those, with the months your site was given a free verification and whether it was given its first two, so that none of these is given twice. It never carries issue content. The number of credits never leaves the platform. The one exception is an operational backup of the credits ledger the operator may keep for recovery, which holds balances and identifiers, never issue content.

Delivery does leave Atlassian: to test your running application, the operator copies the request material (the issue content above, your environment details and the frozen scope) into an execution environment operated by Checktide in the United States, and runs the agreed checks there with a browser, API calls and AI-assisted tooling. That copy, the one in the execution environment, exists for the request only. When the request is closed, the operator must record what became of it, deleted and when, or never created, and that record is part of the request's history. The request record and the evidence published with the report stay in the app's storage on your site, as described under Retention. The machine is disk-encrypted, and traffic between it and Checktide's own services uses TLS.

While checking, Checktide notes a summary of the requests your page sends to your servers — the address, the status and the values the check is about — never cookies, tokens or whole responses. That summary is part of the report’s evidence and is kept and deleted with it.

While checking, Checktide also records the browser's screen as it works — a recording each time we check, so that the report can show the work step by step. We sign in for you; nothing is recorded while we type the password, and it is never written in the report. Nothing is recorded while we wait on our own side either. The recording is part of the report's evidence and is kept and deleted with it.

AI tooling is an internal tool of the operator, not a recipient of your information for its own purposes. Checktide uses such tooling only where the provider does not use your material to train models. The current provider is Anthropic, PBC (terms: https://www.anthropic.com/legal/consumer-terms); model training is turned off for Checktide's account. If a provider cannot honour that, Checktide changes provider, and this notice changes first.

Where information goes

Checktide does not sell data, does not use advertising or analytics scripts on this site, and shares material only with the recipients listed here.

How information is protected

Retention

Request records, scope revisions and clarification questions stay with the issue in app storage while the app is installed. The proposal of what can be checked, with a note of when it was read and how many checks it proposed, is kept with the issue and replaced when a new one is drafted; it is deleted when you ask us to delete our records, or with the app's storage after an uninstall. Uninstalling the app removes its storage on your site under Atlassian's rules (Atlassian retains it for a limited period in case of reinstall). Environment names and the test-account labels you choose are kept, even for a retired environment, until the app is uninstalled. Support tickets are retained in Jira Service Management. What happens to material in the execution environment is stated in "Where the work happens" above.

How long reports stay available

A report and its evidence, recordings included, stay available on your site for at least the 14 days in which you can ask for its retest, and for as long as Checktide remains installed, unless you ask us to delete the request's records.

Your rights and contact

Write to support@checktide.app to ask what Checktide holds about a request, to have it deleted, or with any question about this notice. When you ask us to delete a request, we delete its records from the app's storage on your site once it, and any other request on the same issue, has ended, together with the evidence its report cited, except what is listed next; deleting it also ends its included retest. What we keep holds nothing you wrote: a note that we deleted it, naming your support ticket; what the request was charged and which of your users' accounts authorized it; the log of when test accounts were handed to us for it and when our copy was deleted; and our readings of your private network's connection taken during its runs. Deletion is from the app's storage on your site; Atlassian's own backups of that storage are kept on Atlassian's terms, which Checktide does not control.

Changes

If where the work happens, what is stored, or who receives information changes, this notice changes first, and the version date at the top changes with it.