Rowduet privacy policy

Last updated October 30, 2026.

Rowduet is a Google Sheets add-on that syncs Jira Cloud issues with a spreadsheet. It is made by Affine LLC("we"). This policy explains what the add-on and our servers do with your data. The policy for our marketing website is here.

The short version

• Your spreadsheet stays in your Google account. Rowduet works only in the spreadsheet you open it in.
• Jira issue data passes through our servers on its way to your sheet, and is never stored there.
• We keep your Jira sign-in, encrypted, so scheduled refreshes can run. Disconnecting deletes it.
• We do not sell your data, use it for advertising, or use it to train AI models.

Google user data

When you install and use Rowduet, it asks Google for these permissions:

• See, edit, create and delete only the spreadsheet you use Rowduet in (spreadsheets.currentonly): to write Jira issues into the sheet, read the cells you edit, and keep its own sync tabs. Rowduet cannot open your other files.
• Your email address and Google account ID (userinfo.email, openid): to identify your Rowduet account, match it to your subscription, and send you refresh alerts.
• Connect to an external service (script.external_request): to talk to Rowduet’s servers, which talk to Jira for you.
• Run when you are not present (script.scriptapp): for scheduled refreshes you turn on.
• Send email as you (script.send_mail): only to send you, and no one else, an alert when a scheduled refresh fails.
• Display content in Google Sheets (script.container.ui): for the sidebar.

Spreadsheet contents are read and written inside Google Apps Script, in your Google account. When you push edits to Jira, the changed values (issue key, field and value) are sent to our servers so they can be applied in Jira; they are not stored. Rowduet’s use and transfer to any other app of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.

Jira data

You connect Jira with your own Atlassian account through Atlassian’s OAuth sign-in. Rowduet can only see and change what your Jira account can. We store your Atlassian access and refresh tokens encrypted (AES-256-GCM) and the list of Jira sites you can access. The queries you run, and the issues they return, pass through our servers in memory and are not written to disk or logs.

What we store

• Account: your Google account ID, email address and sign-up date.
• Jira connection: encrypted Atlassian tokens and your accessible Jira sites.
• Subscription: plan, status and Stripe customer reference.
• Sync health: spreadsheet ID, schedule and the time of the last successful refresh, kept for 90 days.

Service providers

Cloudflare hosts our servers and database. Stripe processes payments; we never see your full card number. Google and Atlassian provide the APIs Rowduet uses. We share data with them only as needed to run Rowduet.

Retention and deletion

Disconnecting Jira in the Rowduet sidebar deletes your Atlassian tokens immediately. To delete your Rowduet account and everything above, write to hello@affinehq.com; we do it within 30 days. Payment records are kept as long as the law requires. You can also revoke Rowduet’s Google access at any time atmyaccount.google.com/permissions and its Atlassian access atid.atlassian.com.

Security

All traffic uses TLS. Tokens are encrypted at rest. Rowduet asks for the narrowest Google and Atlassian permissions that let it work, and staff access to production data is limited to what support requires.

Changes and contact

We will post changes here and update the date above; material changes are also emailed to account holders. Questions:hello@affinehq.com.