Team backlog estimation inside Jira Cloud — user guide, privacy policy and support.
App: Planning Poker for Jira Cloud
Last updated: 14 August 2026
This policy describes how Planning Poker Free - Best Planner (“the app”), developed and maintained by Vudia, protects your data and manages security risk. It complements our Privacy Policy.
The app is built on Atlassian Forge and runs entirely on Atlassian’s infrastructure. It has no servers of its own, stores no data outside Atlassian, and makes no outbound network calls — the Forge platform blocks them entirely, and the app declares no external permissions in its manifest.
Because of this, most of the infrastructure-level controls a traditional SaaS vendor would have to build and operate themselves — TLS termination, HSTS, DDoS protection, encryption of data at rest, physical security, and platform patching — are provided directly by Atlassian under its shared responsibility model, and are covered by Atlassian’s own SOC 2 Type II and ISO 27001 certifications. We do not operate any infrastructure of our own that would fall outside that model.
Full detail is in the Privacy Policy; in summary:
The app has no login or credential system of its own. Every request is authenticated and scoped by Atlassian’s Forge platform using the installing site’s own Jira session — we never collect, transmit, or store Atlassian usernames, passwords, or API tokens.
Within the app, permissions map directly onto Jira: to participate in a game, a user needs Browse Projects on the relevant project; to save an estimate as facilitator, they need Edit Issues. The app does not grant any access beyond what a user already has in Jira.
The app’s declared scopes are limited to what the product needs: read access to projects, work items, JQL and users; write access to work items; board read access; and Forge storage. No external or outbound permissions are declared.
uvd020-tech) and the Atlassian Developer Console is limited to the people who need it.We follow OWASP Top 10 guidance during development and rely on Dependabot to flag vulnerable dependencies as they’re disclosed.
We are evaluating enrollment in the Atlassian Marketplace–managed security bug bounty program (via Bugcrowd), which Atlassian provides to partners at no cost, ahead of Atlassian’s requirement that such programs be public by June 30, 2026.
Vulnerabilities reported to us — whether by Atlassian, a researcher, or a customer — are triaged and fixed within Atlassian’s Marketplace SLA timeframes for cloud apps (currently 10 days for Critical severity, 28 days for High severity).
If we identify or are notified of a security incident affecting the app:
To report a suspected vulnerability or security incident, email security@vudia.site. For general support, use info@vudia.site (response within two business days); security reports are prioritized ahead of general support requests.
Because the app has no infrastructure of its own, its availability depends on Atlassian Forge’s own SLAs and uptime — we do not operate servers, databases, or backups that could independently fail. There is no customer data to back up outside of Forge storage, which Atlassian operates and protects as part of the platform.
The only third party in our data flow is Atlassian itself, which hosts, encrypts, and operates the Forge storage the app uses, under its own SOC 2 Type II, ISO 27001, and other certifications. We do not use any other subprocessor, analytics service, or external API.
We do not hold independent security certifications (e.g., SOC 2, ISO 27001) at this time; as a Forge app, we inherit the corresponding infrastructure, storage, and hosting controls from Atlassian’s certified platform. We comply with Atlassian’s Marketplace security requirements for cloud apps.
This policy is reviewed at least annually, and whenever we make a material change to the app’s architecture, data handling, or team.