Truewright is an early-access Jira admin tool built by a single independent developer. This page describes, plainly, what the app touches and why — written to match the code, not a template.
Once installed, Truewright uses Jira's standard user-directory permission to read your site's user list — display name, email address, account type, and active status. This is used only to render the in-app user table.
Some features — last-active dates, billing status, and deactivating an account — require an Atlassian organization API key that you generate yourself and paste into the app. This is optional; the app works as a basic directory without it.
If you provide a key, it is stored using Forge's encrypted secret storage (kvs.setSecret), scoped to your installation. It is never sent to your browser or to any server other than Atlassian's own api.atlassian.com. You can remove it at any time with the "Remove key" button, which deletes it immediately.
With a key connected, the app calls Atlassian's Admin API on each page load to fetch managed-account data: name, email, status, last-active date, and billing flag. This data is displayed live and is not stored by the app beyond the request that fetched it.
The deactivate action only runs when you explicitly click to confirm it, twice. The app will not deactivate the account of whoever is currently using it, regardless of what is clicked — that check happens on the server, not just in the interface.
Exporting to CSV generates a one-time download link that expires after two minutes and stops working after its first use. No copy of the exported file is retained by the app once the link expires or is used.
Uninstalling the app removes its stored data, including any saved API key, from Forge's storage for your site.
Truewright is currently a one-person, early-access project. For questions about this policy or your data, reach out at [email protected].