SpecDock Privacy Policy

Last updated: August 12, 2026

SpecDock is a Confluence app published by Wyve ("we"). It renders OpenAPI and Swagger specifications inside Confluence pages. This policy describes what data the app handles and where it goes. The short version: your data stays inside Atlassian's Forge platform, and the only outbound traffic is the fetch of your API specification from the Git host you configure.

Data we store

• Macro configuration (source type, repository, file path, branch, display options) — stored in Forge app storage, hosted by Atlassian within your Confluence site's data residency.
• Access tokens you provide for private repositories — stored exclusively in Forge's encrypted secret storage. Tokens are used server-side only to fetch your specification. They are never sent to the browser, never embedded in page content, and never logged.
• Pasted specifications (if you use the paste source) — stored in Forge app storage.

Data we transmit

When a page containing a SpecDock macro is viewed, the app fetches the configured specification from one of the following hosts, and from no other destination: api.github.com, raw.githubusercontent.com, gitlab.com, api.bitbucket.org. The request contains the repository coordinates you configured and, for private repositories, your access token. Nothing else — no page content, no user identity, no Confluence data — is ever transmitted outside Atlassian.

Data we do NOT collect

• No analytics, telemetry, or usage tracking of any kind.
• No personal data about page viewers or macro editors.
• No Confluence content beyond the macro's own configuration.
• No third-party services, advertising, or data sharing.

Data retention and deletion

All stored data lives in Forge app storage and follows the Atlassian platform lifecycle: uninstalling the app from a site permanently deletes the app's stored data for that site, per Atlassian's Forge storage policies. You can also remove any macro's configuration and token at any time by deleting the macro from the page.

Security

SpecDock runs entirely on Atlassian Forge: code executes in Atlassian's sandboxed infrastructure, and we operate no servers of our own. We recommend configuring tokens with the minimum possible scope (read-only, single repository). See our documentation for per-provider guidance.

GDPR

For the limited data described above, Wyve acts as a processor and Atlassian as sub-processor (hosting). The legal basis is the performance of the service you configure. For any privacy request, contact us at the address below.

Contact

Wyve — [email protected]
Support: [email protected]