Built on Atlassian Forge, this app is read-only by design. It cannot edit, archive, move, or delete anything in your Confluence site — not as a policy we promise to keep, but because the permissions required to do so were never requested. This page explains, plainly, what data the app touches and where it goes.
What the app is
Content Coherence for Confluence scans a Confluence Cloud site and produces a report of pages that are stale, orphaned, empty or thin, contain broken internal links, appear to duplicate one another, or appear to contradict one another. It requests only the following permissions from Atlassian, listed in the app's manifest:
read:page:confluence — read page content to run the checks below.read:space:confluence — read space metadata needed to organize the report.read:content-details:confluence — read page metadata (timestamps, links,
authorship), and check whether the person opening the report is a Confluence administrator.
The report covers every space on the site, so it is shown to administrators only; this is
the least-privileged way to make that check, and it reads nothing about any other user.storage:app — store scan results using Forge's own per-installation storage.There are no write, delete, or archive scopes anywhere in the app, on any tier, at any time. This is a deliberate and permanent product rule, not a current limitation we intend to lift — it is the reason the app can be trusted with a wiki it did not create.
What data we access
Page titles and body text, read via the Confluence REST API, used to compute staleness, detect empty or thin content, extract and check internal links, and generate short excerpts for duplicate/contradiction detection.
Last-updated timestamps, space and page identifiers, and link structure — used to rank pages by recency and build the link graph that identifies orphaned pages.
We do not request Confluence's Analytics API, so we never see real page-view counts. We do not request user/profile scopes beyond what Forge exposes automatically for the admin running the report. We do not access attachments, comments, or page history.
What we do with it
Page content and metadata are used exclusively to compute the findings shown in your Content Health report: staleness, orphan status, empty/thin content, broken links, duplicate candidates, and — only while we have semantic scanning enabled — contradictions between pages. Deterministic checks (staleness, broken links, orphans, empty pages, and duplicate-candidate detection) run entirely inside the Forge environment against your data. No page content leaves Confluence to perform them.
Scan results (the findings themselves, plus lightweight content hashes used to skip re-scanning
unchanged pages) are written to @forge/kvs, Forge's built-in storage product. This
storage is hosted by Atlassian, scoped privately per app installation, and is not a database we
operate or can browse across customers.
Third-party sharing
Detecting duplicate or contradictory pages reliably requires more than keyword matching — it requires reading what two pages actually claim. For that one check, the app can use Atlassian's Forge LLMs API, a first-party capability of the Forge platform itself, to compare two excerpts using Claude (Haiku 4.5) — a model Atlassian hosts and runs, on Atlassian's own infrastructure. It is not a call to Anthropic's public API: this app has no Anthropic account, no API key, and no permission in its manifest to contact any external service at all.
This semantic scanning path is controlled by us, the app developer, through a platform-level setting — not by you, and not per site. It is not a toggle in the app you can switch on or off, and it applies to the app as a whole rather than to one installation. It is currently on. If we ever switch it off, no page content of any kind would be sent to any model at all and the app would run its six structural checks and nothing else; those six never call a model in either case.
When it is on, the app first narrows your whole page set down to a small number of candidate pairs using free, local similarity checks that never leave Forge. Only short excerpts from those pre-filtered candidate pairs — not full pages, and not your whole site — are sent through the Forge LLMs API for a duplicate/contradiction judgement. A monthly spend ceiling and a hard cap on the number of pairs judged per scan bound how much content this can ever involve.
Because it goes through the Forge LLMs API, this path stays inside the boundary Atlassian certifies with its Runs on Atlassian badge: no such request ever leaves Atlassian's environment, none touches a server we run, and it undergoes the same moderation checks as Atlassian's own AI and Rovo features. We do not operate a separate integration with any model provider, and the app has no outbound network permission that would let us build one.
Zero retention, no training. The models Atlassian uses operate under zero data retention — providers do not store inputs or outputs for any purpose — and Atlassian's data policies and contractual controls prohibit providers from storing or training models on those inputs and outputs. See Atlassian's Trust Center on AI.
We do not share, sell, rent, or otherwise disclose your data to any other third party. We do not use your content for advertising, profiling, or model training. We do not run our own servers, so there is no infrastructure of ours that your content passes through beyond the Forge platform itself.
Data retention
Scan results and content-hash/verdict caches are retained in Forge storage only for as long as needed to display your most recent report and to avoid re-scanning or re-judging content that has not changed. Nothing else is retained for backups or any purpose beyond serving the report back to your site's admins.
Operational telemetry. To understand whether the app is working and which checks are useful, it writes aggregate counters to Atlassian's own Forge application logs: how many pages a scan considered, how many findings of each kind it produced, cache and cost counters, and which category of finding (structural vs AI) was expanded in the report. These are numbers only — never a page title, page body, URL, or the identity of any person — and like everything else in this app they never move outside Atlassian's infrastructure. For the same purpose, the app also keeps two aggregate feature-usage counters in its own per-installation storage.
Uninstalling the app removes the app's access to your site going forward. Forge storage is scoped to the installation; Atlassian's platform-level data handling on removal follows Atlassian's own Forge documentation and Marketplace policies.
Your rights
If you are an admin of a site running this app and want to know exactly what data has been processed, request deletion of cached scan results, or have any other question about how this app handles your data, contact us at [email protected]. We will respond as soon as we reasonably can.
Content Coherence for Confluence is a one-person product: one developer builds it and supports it, with no company or dedicated support staff behind it. Response times will be as prompt as one person can make them, and we'd rather be upfront about that than imply a support team that doesn't exist.
Changes to this policy
Any revision to this policy will be posted at this same address with a new effective date at the top of the page. Material changes — anything that expands what data is accessed or who it is shared with — will not be applied retroactively without notice on the Marketplace listing.