This policy explains what data Ngaio collects, how it is used, and how it is stored. Current Ngaio apps include Pull Request Viewer, a developer tool for reviewing Bitbucket Cloud, GitHub, and Azure DevOps pull requests inside IntelliJ IDEA; HAProxy Config Support, a local JetBrains IDE language plugin for HAProxy configuration files; SuiteScript Pro, a local JetBrains IDE plugin for SuiteScript and SuiteCloud Development Framework projects; and Property Change Audit, a HubSpot Marketplace app that records who changed which CRM property, on which record, from what value to what, and when. Automation Governance for Jira is a development preview and is not currently offered on the Atlassian Marketplace.
Who we are. Ngaio is operated by Sonny Graystone ("Ngaio", "we", "us", or "our"), based in New Zealand. For the purposes of the EU and UK General Data Protection Regulation (GDPR), we act as the data controller for personal data we determine the purposes and means of processing, and as a data processor for Customer Data we process on your behalf to provide the Services. You can reach us about any privacy matter at support@ngaio.dev.
The short version
- We collect only the data needed for the app or plugin to function.
- We do not sell, rent, or share your personal data with third parties.
- We do not run third-party advertising or analytics trackers on this site.
- Bitbucket, GitHub, and Azure DevOps credentials are stored locally through IntelliJ's secure credential store.
- The Pull Request Viewer plugin talks to Bitbucket Cloud, GitHub, Azure DevOps, and Microsoft's identity platform, and, for Bitbucket OAuth only, Ngaio's lightweight token exchange proxy.
- HAProxy Config Support collects no personal data, has no telemetry or analytics, and makes no runtime network calls.
- SuiteScript Pro keeps project analysis local, has no Ngaio account or backend, and sends no source code, project contents, credentials, telemetry, or analytics to Ngaio.
- For Property Change Audit, we store your CRM property-change history on our Cloudflare backend as a processor on your behalf, isolated per HubSpot account, and delete it when you uninstall.
- The Automation Governance for Jira development preview stores its credentials and audit data in the app installation's Atlassian Forge storage and does not use a Ngaio-operated backend.
Information Pull Request Viewer uses
Bitbucket OAuth sign-in. If you connect through Atlassian OAuth, the plugin receives your Bitbucket display name, account ID, access token, and refresh token from Bitbucket.
Bitbucket repository access tokens. If you connect with a repository, workspace, or project access token, the token value is stored locally. The plugin does not request your Bitbucket display name or account ID for repository-scoped token auth.
GitHub personal access tokens. If you connect to GitHub, the personal access token you provide is stored locally and used to read pull request data for the repositories you add. The plugin attaches the token only to requests to GitHub.
Azure DevOps credentials. If you connect to Azure DevOps, the personal access token you provide or the Microsoft Entra tokens issued through interactive sign-in are stored locally through IntelliJ PasswordSafe. They are used only with Microsoft's identity platform and the Azure DevOps organization you configure.
Pull request data. The plugin reads PR titles, descriptions, diffs, comments, reviewers, participants, CI runs, and available activity from Bitbucket Cloud, GitHub, or Azure DevOps on your behalf. This data is displayed in IntelliJ IDEA and is not persistently stored by Ngaio.
How credentials are stored
Pull Request Viewer credentials are stored on your local machine using IntelliJ's PasswordSafe API, which delegates to your operating system's secure credential store, such as macOS Keychain, Windows Credential Manager, or a compatible Linux secret store.
Pull Request Viewer credentials are not written to plain text files by the plugin.
OAuth token exchange
For Bitbucket OAuth sign-in, Pull Request Viewer uses a lightweight OAuth proxy operated by Ngaio to perform the authorization code exchange. This keeps the OAuth client secret out of the distributed plugin binary. GitHub uses personal access tokens, which do not go through the proxy.
The proxy receives the short-lived authorization code from Bitbucket, exchanges it with Bitbucket for access and refresh tokens, and returns Bitbucket's response to the plugin. The same proxy is used to keep you signed in: when your access token expires, the plugin sends your refresh token through the proxy to obtain a new one, which happens roughly every two hours of active use. Tokens pass through in memory for the duration of that single request. The proxy does not log, store, or reuse them.
The proxy runs on Cloudflare Workers, accepts only the two token requests the plugin needs, and rebuilds each request from a fixed list of permitted parameters before forwarding it to Bitbucket. It applies a per-IP rate limit to protect the endpoint from abuse, which means your IP address is processed transiently for that check; it is not stored by us or used for any other purpose.
External services
Pull Request Viewer communicates with Bitbucket Cloud through api.bitbucket.org and Bitbucket's OAuth token endpoint, with GitHub through api.github.com, and with Azure DevOps through dev.azure.com. Microsoft Entra sign-in communicates with Microsoft's identity platform. Atlassian's, GitHub's, and Microsoft's own privacy policies apply to data stored in those services.
Images in pull request descriptions
Pull request descriptions and comments can embed images. Opening a pull request loads an image automatically only when it is served over HTTPS by the provider that pull request came from — Bitbucket's or GitHub's own attachment and content hosts — using the connection you have already authorized.
Images hosted anywhere else, including any image served over plain HTTP, are never fetched by the plugin. They are shown as a link you can choose to open in your browser instead. This means that simply opening a pull request cannot cause your IDE to contact a third-party host, and cannot disclose your IP address or the fact that you are reading a particular pull request to whoever controls that host.
HAProxy Config Support
Data and network access. HAProxy Config Support reads HAProxy configuration files you open in your JetBrains IDE and stores its target-version and validator settings in that IDE's per-project settings. It does not collect personal data, credentials, source code, configuration contents, telemetry, or analytics, and it makes no runtime network calls.
Optional local validation. The default validator mode can start a locally installed haproxy process to detect its version or validate an owner-only temporary copy of the current editor text. If you explicitly select Docker validation, the plugin starts a local Docker container with networking disabled and a read-only temporary-file mount. It never pulls a Docker image. Validation can be turned off in Settings -> Tools -> HAProxy Config Support.
Retention and removal. The plugin's settings stay in your local JetBrains project configuration. Ngaio receives no copy. You can remove those settings through the IDE or by deleting the project's plugin settings after uninstalling.
SuiteScript Pro
Local project analysis. SuiteScript Pro reads the JavaScript, TypeScript, and SDF XML files in projects you open so it can provide completion, documentation, inspections, navigation, structure views, templates, and project-readiness information. It combines those local files with an API model bundled inside the plugin. It does not collect or transmit personal data, source code, project contents, credentials, telemetry, or analytics; it has no Ngaio account, backend, or runtime network connection.
Marketplace licensing and payment. JetBrains Marketplace manages the 30-day evaluation, paid licenses, checkout, payment, tax, renewal, and activation under JetBrains' terms and privacy policy. The IntelliJ Platform may obtain Marketplace licensing data and make a signed license confirmation available locally to the plugin. SuiteScript Pro verifies that local confirmation only to determine whether it is licensed; it does not send source code, project contents, or credentials to Ngaio, and Ngaio operates no separate checkout, license-key service, or trial database.
Optional SuiteCloud CLI commands. If you explicitly create and run a SuiteCloud configuration, the plugin starts the separately installed suitecloud executable found on the IDE process's PATH. It runs Oracle's project:validate or project:deploy command in the local SDF root you selected. Oracle's CLI owns authentication, account selection, credentials, configuration, network activity, and project hooks; Ngaio receives none of them. Project hooks can execute local code and the CLI inherits the IDE console environment, so use this integration only with projects and CLI installations you trust. The plugin asks for confirmation before every Deploy command.
Local storage and removal. JetBrains stores any SuiteCloud run configuration, including its Validate/Deploy action and selected local project path, in local IDE or project configuration. JetBrains also maintains ordinary indexes and caches for opened project files. The plugin stores no SuiteCloud credentials or onboarding preference. Ngaio receives no copy of this local state. Uninstalling the plugin may leave IDE-managed run configurations, project metadata, indexes, or caches on your machine; remove saved SuiteCloud configurations or clear the relevant IDE project data and caches if you want to remove that local residue.
Property Change Audit (HubSpot app)
What it is and our role. Property Change Audit is a HubSpot Marketplace app that records a filterable history of who changed which CRM property, on which record, from what value to what, and when. Unlike Pull Request Viewer, it runs a Ngaio-operated backend that stores this history on your behalf. For the data it processes from your HubSpot account ("Customer Data"), Ngaio acts as a data processor; you, the HubSpot account owner, are the controller.
Information it processes. After you install the app and authorize it, Property Change Audit reads and stores property-change events for the objects and properties you choose to monitor (contacts, companies, and deals). Each event records the object type and record ID, the property name, the previous and new values, the change timestamp, and the identity of the HubSpot user or integration that made the change (resolved to an owner display name for the dashboard). It also stores your app configuration — which properties you monitor, saved filter views, bulk-change alert settings, and retention preferences — and the OAuth access and refresh tokens HubSpot issues for your account.
Where it is stored. Customer Data is stored in a Cloudflare D1 (SQLite) database operated by Ngaio on Cloudflare's platform. Every record is keyed to your HubSpot account ID and isolated per account on every read and write. OAuth tokens are encrypted at rest with AES-256-GCM; secrets are held server-side and are never exposed to the browser or the app card.
HubSpot permissions we request, and why. The app requests read access to contacts, companies, deals, and owners to build the change history and resolve who made each change. It also requests write access to contacts, companies, and deals solely to power the optional rollback feature: when you choose to undo a specific change, the app writes a previously-recorded value back to that one property on that one record, on your explicit instruction. The app never writes to your CRM except when you trigger a rollback.
How changes are captured. The app receives near-real-time change notifications through HubSpot webhooks for the standard properties it subscribes to, and periodically polls HubSpot for the other properties you monitor. It reads change history through HubSpot's CRM APIs using the token you authorized.
Retention and deletion. Change history is retained for the retention window configured for your account and pruned automatically after that; you can shorten the window in the app's settings. When you uninstall the app — or when HubSpot notifies us that a record was deleted or that a GDPR erasure was requested — we delete the associated data: uninstalling triggers a full purge of your account's stored history, tokens, and configuration from our database. You can also email support@ngaio.dev to request deletion. We do not sell, rent, or share this data, and we run no advertising or analytics trackers in the app.
Automation Governance for Jira (development preview)
What it is and our role. Automation Governance for Jira is a Forge development preview for Jira Cloud administrators and is not currently offered on the Atlassian Marketplace. It reads Jira automation rule summaries and configuration through Atlassian's Automation Rule Management API, using an Atlassian account email and API token supplied by a site administrator. For the rule data it processes on your organization's behalf, Ngaio acts as a data processor; your organization is the controller.
Credentials and token metadata. The administrator's email address and API token are stored together in Forge KVS secret storage. The email address is not copied into ordinary KVS metadata or Forge SQL. Token status, validation timestamps, and the administrator-supplied expiry date are stored in ordinary Forge KVS metadata.
Rule and finding data. Rule snapshots, scan state, and findings are stored in the installation's Forge SQL database. Scan history and its related rule and finding data are retained for the newest ten scans; older scans are deleted when a scan reaches a terminal state. A secret finding stores the rule identifier and name, a sanitized configuration location, the finding type, and a short keyed HMAC fingerprint. It never stores the detected credential value or a masked fragment.
Access and visibility. The app page and every backend operation are restricted to Jira administrators through both module display conditions and a live server-side Jira permission check. Inventory, findings, counts, project names, and exports are filtered to projects the invoking administrator can browse. Project-name decoration is requested as that Jira user and is not cached.
Hosting and network access. Credentials and app data remain in Atlassian Forge storage for that app installation. Backend network access is limited to Atlassian's api.atlassian.com; the app has no Ngaio-operated database or non-Atlassian backend. Because it declares this egress, the app does not claim the Runs on Atlassian badge. The app contains no advertising or analytics trackers.
Uninstall and deletion. Uninstall triggers best-effort deletion of the stored credentials, token metadata, any legacy project-name cache, fingerprint salt, scan queue, rule snapshots, scan history, and findings. If deleting one data store fails, the app continues attempting the remaining stores and surfaces the failure to Forge monitoring. You can also email support@ngaio.dev with a privacy or deletion request.
Service providers and sub-processors
We use a small number of service providers to run our apps and website. They process data only on our instructions and to the extent needed to provide their service:
- Cloudflare — hosts and serves the ngaio.dev website; runs the Bitbucket OAuth token-exchange proxy described above, through which authorization codes and refresh tokens pass in transit; and hosts the Property Change Audit backend and the database in which that app's Customer Data (property-change history and encrypted HubSpot OAuth tokens) is stored.
- Atlassian — hosts the Automation Governance for Jira app on Forge, provides that installation's secret and SQL storage, and operates the Jira and Automation APIs the app calls.
The connected services and marketplaces you choose to use — Atlassian, Bitbucket, GitHub, Microsoft Azure DevOps, HubSpot, JetBrains Marketplace, and Oracle's SuiteCloud CLI — are independent controllers of the data held in their own platforms, governed by their own privacy policies. Pull Request Viewer runs locally inside your IDE; it has no Ngaio-operated backend other than the Bitbucket OAuth token-exchange proxy described above.
International data transfers
We are based in New Zealand, and our service providers may process data in other countries, including the United States and the European Union. Where personal data is transferred across borders, we rely on the safeguards offered by those providers (such as Standard Contractual Clauses or equivalent mechanisms) and take reasonable steps to ensure your data remains protected to the standard described in this policy.
Legal bases for processing (EU/UK)
If you are in the European Economic Area or the United Kingdom, we process personal data on the following legal bases under the GDPR:
- Performance of a contract — to provide the app or service you have installed and to operate the sync and review functionality you request.
- Legitimate interests — to secure, maintain, debug, and improve our apps, and to respond to your support requests, where those interests are not overridden by your rights.
- Consent — where you have given it, for example by connecting an optional third-party service; you may withdraw consent at any time.
- Legal obligation — where we must process or disclose data to comply with applicable law.
Data sharing
We do not sell, rent, or share your personal data with third parties. We may disclose information if required by law.
Data retention and deletion
For Pull Request Viewer, credentials are stored locally, so you control their retention. To remove credentials, open Settings -> Tools -> Pull Request Viewer and sign out or clear the stored token. You can also revoke access in Bitbucket's authorized applications, GitHub's token settings, or your Microsoft/Azure DevOps account.
Pull request content read to display in the apps is processed transiently and is not stored persistently by Ngaio beyond what is described above.
What uninstalling does and does not remove. Uninstalling Pull Request Viewer does not by itself erase what it saved on your machine. Your credentials remain in your operating system's credential store, and the review state the plugin keeps locally — review ledger progress, checklist state, and your comment snippets — remains in your IDE's configuration directory. To clear everything, sign out or remove the stored token under Settings -> Tools -> Pull Request Viewer before uninstalling, and revoke the plugin's access with the connected provider. Because all of this stays on your own machine and none of it is transmitted to Ngaio, there is no copy held by us to delete.
Your privacy rights
Depending on where you live, you may have rights over your personal data, including the rights to access, correct, delete, or receive a copy of it, to restrict or object to certain processing, and to withdraw consent. Where we act as a processor on behalf of a host platform or your organization, we will direct requests to the relevant controller or assist them in responding. To exercise any right, email support@ngaio.dev; we will respond within the time required by applicable law. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority. We do not sell your personal data, and we do not use it for cross-context behavioral advertising.
Cookies and fonts
The ngaio.dev website does not set advertising or analytics cookies, does not run third-party trackers, and serves its fonts from our own domain, so browsing it makes no third-party requests. Within the apps themselves, any cookies or local storage used are limited to what is necessary for the app to function.
Security
We apply reasonable technical and organizational measures to protect personal data, including encryption in transit, encryption of stored credentials, per-account data isolation, and server-side handling of secrets. More detail, and how to report a vulnerability, is in our Security Policy. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Support messages
If you email us, we receive your email address and whatever information you include in the message. We use that information only to respond and provide support.
Children
Our apps are business and developer tools that are not intended for or directed at children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
Changes to this policy
We may update this policy when our apps or data-handling practices change. The last updated date above will reflect any changes.
Contact
Questions about privacy? Email support@ngaio.dev.