VibeTest Privacy Policy
VibeTest by AppDash · Last updated: June 24, 2026
This policy explains what data the VibeTest app for Jira and its desktop companion, AppDash AI Link, collect, how that data is used, and the choices you have. We keep it short and honest, and we designed VibeTest so there is as little of your data to handle as possible. This is the app-specific policy for VibeTest; the broader AppDash privacy policy and Terms of Service also apply.
The short version
- There is no external AppDash backend. Your tests run on your own machine, with your own AI agent and logins. The Jira app stores its data inside your Atlassian site.
- Your code, credentials, and browser sessions never leave your machine. Only the test definition, the pass/fail verdict, per-step outcomes, and screenshots travel to and from Jira.
- Secret values stay in your operating-system keychain, write-only. Only secret names reach Jira, for autocomplete in the test editor.
- The only personal data the app stores is Atlassian account identifiers, kept in Atlassian’s own storage and reported and erased under the Atlassian GDPR personal-data API.
- We do not sell your personal information, ever.
The VibeTest Forge app declares no remotes, no external.fetch, and no configurable egress in its manifest. The only egress is the bridge returning each test job to your own paired desktop, authenticated per pairing over HTTPS — never to a server AppDash operates. There is no third-party backend in the path of your data.
Who this policy covers
VibeTest has three parts. Knowing where each one runs is the easiest way to understand where your data lives.
| Component | Where it runs | What it does with data |
|---|---|---|
| VibeTest Forge app | Atlassian cloud (Forge-hosted) | Stores your test definitions and run results in Atlassian’s storage; presents the issue panel and project settings page; dispatches jobs to your paired desktop. |
| AppDash AI Link (free desktop app) | Your own macOS machine | Polls Jira for jobs, runs them through your AI agent, and streams results and screenshots back to Jira. Holds your secret values locally. |
| Your AI agent (Claude Code or a BYO CLI agent) | Your own machine | Executes the test steps against your environment. AppDash operates no sub-processor for test execution — your own agent runs the tests. |
Data VibeTest stores in your Atlassian site
The Forge app keeps its data in Atlassian’s app storage (Forge KVS), inside your Atlassian site and under your Atlassian data controls. That data is:
- Test definitions — the plain-English or BDD tests you write on a Jira issue.
- Run history and results — verdicts, per-step outcomes, durations, and links to the screenshots attached to the issue.
- Device-pairing records — the public key and metadata for each desktop you pair, so jobs only go to devices you explicitly trust.
- An audit log of test and pairing activity.
- Atlassian account identifiers (
accountIds) for the people who create tests, trigger runs, and pair devices — used for attribution and permission checks. - Secret names only. When you reference a secret in a test, the app stores its name for autocomplete. The secret value is never sent to Jira and never stored by the app.
Data on your own machine
The desktop companion runs locally and keeps the sensitive material on hardware you control. It holds:
- Secret values — stored write-only in your macOS Keychain. They are resolved in memory at run time to fill
{{secrets.NAME}}references, then discarded. The app never reads them back or uploads them. - Pairing keysand the device’s signing keypair, used to authenticate with Jira.
- Your AI agent configuration— which agent to use and how to run it. Your agent’s own API keys are managed by your agent, not by VibeTest.
- Local run logs for the tests executed on that machine.
What crosses the boundary — and what never does
| Crosses your perimeter | Never leaves your machine |
|---|---|
| The test definition (text) sent from Jira to your desktop. | Your source code. |
| The pass/fail verdict, per-step outcomes, and duration. | Your credentials and secret values. |
| Screenshots attached to the Jira issue. | Your browser sessions and internal URLs. |
Secret values are scrubbed from agent output before anything posts back to Jira. The result comment contains the verdict, duration, per-step outcomes, and screenshots — nothing more.
Personal data and GDPR
The only personal data VibeTest stores is the Atlassian account identifiers described above. The app implements the Atlassian Personal Data Reporting API (the report:personal-data scope and the first-party privacy.reportPersonalData()helper): the identifiers it holds are reported to Atlassian on a recurring basis, and are erased in response to Atlassian’s GDPR close-account and app-uninstall requests. We do not enrich these identifiers, profile you, or use them for advertising.
Your AI agent
VibeTest executes through an AI coding agent that youchoose and configure — Claude Code by default, or any compatible CLI agent. You control the model, its costs, its API keys, and the environment it runs in. Your relationship with your agent provider (for example Anthropic, when you use Claude Code) is governed by that provider’s own terms and privacy policy. AppDash is not a party to it and operates no execution sub-processor on your behalf.
The AppDash website
Separately from the app, the AppDash website (appdash.ai) collects what you give it: support tickets, optional email sign-ups, and basic, privacy-respecting usage analytics. We use that data only to respond to you, send updates you explicitly requested, and understand site usage in aggregate. See the AppDash privacy policy for the full website details.
Third parties and sub-processors
We keep the list of parties that touch your data deliberately small:
- Atlassian— operates the Forge platform and the storage your app data lives in, under Atlassian’s own terms and data controls.
- Your AI agent provider — runs on your machine, under your account, chosen and controlled by you. Not an AppDash sub-processor.
- GitHub — hosts the public download of the desktop companion. No account is required to download it.
- Our website hosting and database providers — process website data (support tickets and sign-ups) on our behalf. They do not touch your app, code, or credentials.
We do not use third-party advertising trackers, and we do not sell or rent your personal information.
Data retention
Test definitions, run history, and pairing records live in your Atlassian site and are governed by your own Atlassian data controls; they are removed when you uninstall the app and through the GDPR erasure flow above. Data on your machine — secret values, keys, and local logs — stays local and is removed when you delete the relevant keychain entries or uninstall the desktop app. Website support tickets and sign-ups are kept only as long as needed to provide support and the updates you asked for, then deleted or anonymized.
Data residency
Because the app stores its data only in Atlassian’s app storage and operates no external backend, your app data follows Atlassian’s data-residency controls for your site. There is no separate AppDash data store to pin or move.
International data transfers
Your app data is processed wherever Atlassian hosts your site, and test execution happens wherever your own machine is located. Your AI agent processes data locally under your chosen provider’s terms. Because there is no separate AppDash backend or data store, we make no additional cross-border transfer of your app data.
Your rights
You can ask us to access, correct, or delete the personal information you have given us, and we will action your request. Because VibeTest has no external backend, most of your data is already under your direct control — in your Atlassian site and on your own machine.
Security
We design for security by architecture: no external backend to breach, Ed25519-signed device pairing, short-lived per-job tokens, OS-keychain secrets, and five least-privilege Atlassian scopes (read:jira-work, write:jira-work, storage:app, read:jira-user, and report:personal-data — no admin scopes). See the VibeTest security model for the full picture.
Children
VibeTest is a developer tool intended for use in a professional setting. It is not directed to children, and we do not knowingly collect personal information from children under 16.
Changes to this policy
We may update this policy as VibeTest evolves. We will revise the “last updated” date above and, for material changes, give notice through the site.
Contact
Questions about privacy? Email contact@appdash.ai or contact us through support and we will get back to you.