Privacy Policy¶

MassMod LLC — MassMod applications and related services

Effective Date: June 30, 2026 Last Updated: August 5, 2026

1. Introduction¶

This Privacy Policy explains how MassMod LLC ("MassMod," "we," "us," or "our") collects, uses, discloses, and protects information when you (a) visit our website at massmod.app and any related subdomains, (b) install or use any of MassMod's applications distributed through the Atlassian Marketplace (each, an "Application"), or (c) communicate with us by email or other means. Collectively, the website and the Applications are referred to as the "Services."

We are committed to handling your information responsibly and transparently. This Privacy Policy describes our practices in plain language wherever possible, with formal terms used only where legal precision requires.

By using the Services, you agree to the collection, use, and disclosure of information as described in this Privacy Policy. If you do not agree, please do not use the Services.

2. Who We Are¶

MassMod LLC is a California limited liability company with its principal place of business in California, United States. We develop and distribute software products for the Atlassian Marketplace.

Contact:

General inquiries: hello@massmod.app
Privacy inquiries: privacy@massmod.app
Support: support@massmod.app
Security reports: security@massmod.app
Mailing address: MassMod LLC, 2108 N St, Ste N, Sacramento, CA 95816

3. The Information We Collect¶

3.1 Information from Visitors to massmod.app¶

massmod.app is a static informational website. When you visit it:

We run no analytics and set no cookies. We do not use any analytics service (first- or third-party), tracking pixels, web beacons, fingerprinting, or session recording, and we do not measure your behavior or build visitor profiles. The site is hosted on Cloudflare, which as our host and CDN processes standard connection data (such as IP addresses) transiently to deliver the site and protect it from abuse; we do not use that data for analytics and do not receive it in a form that identifies you.
Information you voluntarily submit if you email us or use a contact link: your name, email address, company name, and the content of your message. We do not operate a marketing mailing list or newsletter and do not collect email addresses for marketing purposes.

3.2 Information from Users of the Application¶

When the Application is installed in your Atlassian organization and used:

The Application runs entirely within Atlassian's Forge infrastructure. It accesses the Atlassian data it needs through Atlassian's official APIs, using authentication managed entirely by the Atlassian Forge platform. The Application does not use, store, request, or transmit customer API keys, tokens, or passwords. This data resides in Atlassian's infrastructure and is not transmitted to MassMod's servers.
Any data an Application stores is held in Atlassian's Forge storage, which is part of Atlassian's infrastructure and not ours. Depending on the Application and the features you use, this may include: application configuration, settings, and per-user preferences; operational caches; records of actions taken through the Application; and, for our agile-ceremony tools, the content your teams create during those ceremonies, including estimates and votes, prioritization scores, retrospective cards and comments, team rosters, per-person capacity and availability, and time-off entries recording the dates on which an individual is unavailable. A fuller description of these categories is in our Data Processing Agreement for the relevant Application.
The Application may access and display personal data that already resides in your Atlassian organization — such as the names, email addresses, and account identifiers of your users. This data is read from Atlassian's own APIs and shown within the Atlassian interface to authorized users; MassMod does not receive, copy, or retain it on its servers.
We receive no customer data on our servers from operation of the Applications. The Applications reach Jira and Confluence exclusively through Atlassian's own product APIs, via the Atlassian Forge runtime's managed request mechanism, and make no calls to non-Atlassian systems: no MassMod-controlled API, no analytics endpoint, no logging service, no third-party CDN, and no AI or machine-learning service.
We do receive aggregate usage telemetry from Atlassian Marketplace as part of their analytics dashboard for app developers — install counts, license counts, country distribution, version distribution. This data is provided by Atlassian and is not personally identifiable to end users of the Application.

3.3 Information from Customers (Billing and Account)¶

When you license MassMod through the Atlassian Marketplace:

Atlassian handles all customer billing, payment processing, and license management as merchant of record. We do not collect, store, or process payment card information.
We receive license and customer information from Atlassian including: organization name, primary contact name and email, license tier, license count, billing region, and license status (active, trial, lapsed).
We use this information solely for license administration, customer support, and as required by tax and accounting obligations.

3.4 Information from Communications¶

When you email us, submit a support request, or report a bug, we collect the content of your communication, your email address, and any contact information you provide. We use this solely to respond to and resolve your request.

We ask that you not include personal data about your own users or other individuals — such as names, email addresses, or screenshots showing user records — in support or bug-report communications, and we design our intake to avoid requesting it (account and group identifiers and reproduction steps are sufficient for us to help). If such personal data is nonetheless included, we minimize it: once we have understood or reproduced the issue, we redact or delete any personal data that is not necessary to resolve your request. We never use information from communications for marketing or to train machine-learning models.

3.5 Information We Do NOT Collect¶

For clarity, we want to be explicit about what MassMod does NOT do:

We do not access or collect data from inside your Atlassian organization. Data an Application stores in Atlassian's Forge infrastructure stays there; we have no admin panel, no operator console, and no support tool that lets MassMod staff view your organization's data.
We do not solicit end-user personal data through support or bug reports. Our intake asks for non-identifying reproduction details and Atlassian account/group identifiers, not names or email addresses of your users.
We do not operate a marketing mailing list and do not collect personal information for marketing or advertising.
We do not sell, rent, or share your personal information with third parties for marketing or advertising purposes, ever.
We do not use analytics, cookies, or tracking pixels on our marketing website.
We do not run third-party advertising trackers on our website (no Facebook Pixel, no Google Ads tags, no LinkedIn Insight Tag).
We do not use AI/ML training on your data. Customer data is not used to train models — ours or anyone else's.

4. How We Use Information¶

We use information for the following purposes:

Purpose	Information Used	Legal Basis (GDPR)
Providing and operating the Application	License information from Atlassian	Contract performance
Customer support and communications	Contact information, support request content	Contract performance / legitimate interest
Billing and accounting	License information, business contact info	Legal obligation / contract performance
Legal compliance	All information as needed	Legal obligation
Security and abuse prevention	All information as needed	Legitimate interest

We do not process personal data for marketing, and we do not rely on consent as a lawful basis, because we do not run consent-based processing such as marketing email.

We share information with third parties only in the following limited circumstances:

5.1 Service Providers (Sub-Processors)¶

We use a small number of third-party service providers to operate our business. Each is contractually bound to confidentiality and to process information only as needed for the services they provide:

Service Provider	Purpose	Data Shared	Location
Atlassian (Forge platform + Marketplace)	Application hosting, billing, merchant of record	Customer license info, customer business contact info	United States
Fastmail	Email infrastructure for `@massmod.app`	Email content sent to or received from us	Australia / United States
Cloudflare	Website hosting and CDN for massmod.app	Standard connection data (e.g., IP address) processed transiently for site delivery and security; not used for analytics	United States / global edge network

We do not currently use any other third-party processors, and we do not use a marketing CRM or email-marketing platform. This list will be updated as our business evolves; material changes will be reflected in updated Privacy Policies.

5.2 Legal Requirements¶

We may disclose information when we believe in good faith that disclosure is necessary to:

(a) comply with a legal obligation, court order, subpoena, or similar legal process; (b) protect the rights, property, or safety of MassMod, our customers, or others; (c) investigate fraud or violations of our Terms of Service; (d) respond to a government request consistent with applicable law.

We commit to notifying affected customers of any legal demand for their data, unless legally prohibited from doing so.

5.3 Business Transfers¶

If MassMod is acquired, merged with another company, or undergoes a similar transaction, customer and personal information may be transferred to the acquiring party as part of the transaction. We will provide notice before such a transfer affects this Privacy Policy.

5.4 What We Do NOT Do¶

We do not sell personal information.
We do not share personal information for cross-context behavioral advertising.
We do not exchange personal information for monetary or other valuable consideration.

6. Data Retention¶

We retain information only as long as needed:

Customer license records: For the duration of the license plus seven (7) years for tax and accounting purposes.
Customer support communications: The communication thread and your own contact details are retained for up to two (2) years from the last communication. Any personal data relating to third parties or your end users that is incidentally included in a communication is redacted or deleted promptly once the relevant issue is resolved, and in any event within thirty (30) days of receipt.
Application-generated data stored in your Atlassian organization's Forge storage: retained per your organization's settings and the Application's configuration, which you control. In our agile-ceremony tools, live session data (in-progress ceremonies, presence, and working state) expires automatically within approximately 12 hours, and completed-session history records are retained for approximately 90 days; configuration you have saved, such as team rosters and access settings, persists until you change or remove it. All of this data is removed when you uninstall the Application, in accordance with Atlassian's data-handling for Forge apps. MassMod will not access or extract this data.

When information is no longer needed, we delete it.

7. Your Rights¶

7.1 California Residents (CCPA / CPRA)¶

If you are a California resident, you have the following rights regarding personal information:

Right to Know: You may request information about the personal information we have collected, used, disclosed, or sold (we do not sell personal information).
Right to Delete: You may request deletion of your personal information, subject to legal exemptions.
Right to Correct: You may request correction of inaccurate personal information.
Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information beyond what is necessary to provide services.
Right to Opt Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising. MassMod does not sell or share your personal information.
Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.

To exercise these rights, email privacy@massmod.app with a clear description of your request. We will respond within 45 days as required by CCPA (with a possible 45-day extension if necessary).

If you are in the EEA, UK, or Switzerland, you have the following rights regarding personal data:

Right of Access (Article 15) — request a copy of the personal data we hold about you
Right to Rectification (Article 16) — request correction of inaccurate data
Right to Erasure (Article 17) — request deletion ("right to be forgotten")
Right to Restriction of Processing (Article 18)
Right to Data Portability (Article 20) — receive your data in a structured, machine-readable format
Right to Object (Article 21)
Right to Lodge a Complaint with your local supervisory authority

To exercise these rights, email privacy@massmod.app. We will respond within 30 days as required by GDPR.

EU Representative (GDPR Article 27). MassMod has not appointed an EU representative. Based on the nature of its processing — occasional, limited to business-contact and reactive support data, including no special categories of data, and unlikely to result in a risk to individuals' rights and freedoms — MassMod relies on the exemption in GDPR Article 27(2). EEA, UK, and Swiss data subjects may contact us directly at privacy@massmod.app.

Lawful Bases for Processing. We process personal data on the following lawful bases under GDPR:

Performance of a contract (providing the Services to customers)
Legitimate interests (improving products, security, customer support)
Legal obligations (tax, accounting, responding to legal demands)

We do not rely on consent as a lawful basis, as we do not conduct consent-based processing such as marketing.

International Data Transfers. Personal data we process may be transferred to and stored in the United States. When we transfer personal data outside the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms. Personal data of your end users handled by the Application does not leave Atlassian's infrastructure as a result of the Application's operation; the transfers described here relate to the limited business-contact and support data MassMod holds on its own systems.

7.3 All Other Residents¶

We respect privacy laws globally. If you reside in a jurisdiction with specific privacy laws (e.g., Canada's PIPEDA, Brazil's LGPD, Australia's Privacy Act), we honor the rights provided by those laws. Email privacy@massmod.app to exercise your rights.

8. Security¶

We take security seriously and implement appropriate technical and organizational measures:

The Applications run on Atlassian's Forge platform, which is SOC 2 Type II, ISO 27001, and ISO 27018 certified. The Applications communicate only with Atlassian's own product APIs through the Forge runtime and make no calls to non-Atlassian systems. Your data does not leave Atlassian's infrastructure as a result of an Application's operation.
Authentication is managed entirely by the Atlassian Forge platform. The Application does not use, store, request, or transmit customer API keys, tokens, or passwords.
Access is enforced on the server, not by hiding elements in the interface. Every privileged operation is checked at the resolver layer before it is performed, and administrative functions are restricted to administrators of your Jira site. By default the Applications are available to the users you have licensed; your administrators can narrow access further by configuring an allowlist of users and groups, application-wide and, where supported, per module.
Our own systems (email, banking, website hosting) are operated by reputable providers with industry-standard security certifications, listed in Section 5.1.
Access to our systems is limited to authorized personnel (currently the founder), with 2FA enforced.
Email correspondence is delivered over TLS where supported by the recipient mail server.
Suspected vulnerabilities can be reported to security@massmod.app. We aim to acknowledge reports within two (2) business days and to provide an initial assessment within five (5) business days.

Important limitations:

No method of transmission or storage is 100% secure. We cannot guarantee absolute security.
If we become aware of a personal data breach affecting data we process on a customer's behalf, we will notify the affected customer without undue delay and, where feasible, within 48 hours of becoming aware, as committed in our Data Processing Agreement. Because our customers are the controllers of that data, notification to supervisory authorities and to affected individuals is the customer's responsibility under applicable law, including the 72-hour deadline in GDPR Article 33, and we will cooperate with and assist our customers in meeting it. Where MassMod holds personal data as a controller in its own right, such as customer business-contact and support records, we will meet our own notification obligations under applicable law.

9. Cookies and Tracking Technologies¶

massmod.app does not use cookies, tracking pixels, web beacons, fingerprinting, session recording, or analytics of any kind. We do not place cookies and we do not run any analytics service, first- or third-party.

If we add functionality that requires cookies in the future (e.g., a customer login portal), we will update this Privacy Policy and request consent where required by law.

The Application runs within Atlassian's interface and does not set cookies independently. Cookies used by Atlassian when you access your Jira instance are governed by Atlassian's privacy policy.

10. Children's Privacy¶

The Services are intended for use by business administrators in B2B contexts. They are not directed to children. We do not knowingly collect personal information from anyone under 13 years of age (or under 16 in the EEA). If you believe a child has provided personal information, contact privacy@massmod.app and we will delete it.

11. Do Not Track¶

Our website does not respond to "Do Not Track" browser signals because we do not track visitors at all — we run no analytics and set no cookies. We treat all visitors equivalently; none are tracked across sites.

12. Third-Party Links¶

Our website and Application may contain links to third-party websites (e.g., Atlassian's documentation, USPTO trademark records, code repositories). We are not responsible for the privacy practices of those third parties. Review their privacy policies before providing personal information.

13. Changes to This Privacy Policy¶

We may update this Privacy Policy from time to time. When we make material changes, we will:

(a) Update the "Effective Date" and "Last Updated" dates at the top. (b) Notify customers by email at least 30 days before the changes take effect, if the changes materially affect customer rights. (c) Maintain a version history (below) so you can see what has changed.

Version History:

Version	Effective Date	Summary of Changes
1.0	June 23, 2026	Initial publication.
1.1	July 30, 2026	Generalized the policy to cover all MassMod applications distributed through the Atlassian Marketplace, rather than a single app, and to describe MassMod's Runs-on-Atlassian model: apps run entirely on Atlassian's Forge platform, use no customer API keys or credentials, and result in no customer end-user data being received or stored on MassMod's servers.
1.2	August 5, 2026	Corrected the description of application network behavior: applications reach Atlassian product APIs through the Forge runtime and make no calls to non-Atlassian systems (Sections 3.2 and 8). Expanded the description of data stored in Forge storage to name agile-ceremony content, capacity and availability data, and time-off entries (Section 3.2), and added retention periods for live session and history data (Section 6). Aligned the breach-notification statement with the 48-hour commitment in the applicable Data Processing Agreement, and clarified the respective roles of controller and processor in notifying supervisory authorities (Section 8). Restated the access-control description in Section 8 to match the actual model: server-side enforcement at the resolver layer, available by default to licensed users, with administrator-configurable allowlists to narrow access.

14. How to Contact Us¶

For privacy-related questions, requests, or complaints:

Email: privacy@massmod.app
Security reports: security@massmod.app
Mail: MassMod LLC, 2108 N St, Ste N, Sacramento, CA 95816

We aim to respond to all privacy inquiries within five (5) business days.