Privacy policy: Burnrate
Last updated: 14 October 2026
This policy explains what data the app “Burnrate: Project Cost & Budgets for Jira” (the app), published by Kayabyte, the trading name of Caner Kaya, Stasjonsveien 64, Oslo, Norway, processes when it is installed on an Atlassian Cloud site.
What the app does
The app turns the time logged in Jira into costs, using hourly rates that the customer enters, and tracks that cost against budgets for projects, epics, fix versions or JQL queries.
Data the app stores
The app stores its data in Atlassian Forge hosted storage on the customer’s Atlassian site:
- Worklogs: for each worklog, its ID, work item ID, the author’s Atlassian account ID, the date, the time spent and billable time, and the cost and billing amounts the app calculated. Worklog comments are not stored.
- Work items with logged time, their parents, and open work items with a remaining estimate in a budget’s scope: ID, key, summary, project ID, work type name and level, parent and epic, status category, remaining estimate, labels and fix version IDs.
- Rate card: roles (name), and hourly cost and billing rates with their start dates, for the default rate, roles and people (by account ID).
- Budgets: name, scope (project, epic or version IDs and names, or a JQL query), amounts, dates, billing settings and, for JQL budgets, the IDs of the matched work items.
- Settings: currency, how much history to load, non-billable labels, Tempo connection settings, sync progress, and cached budget totals.
- Tempo API token: only if an admin connects Tempo Timesheets. It is kept in Forge secret storage, is only used for calls to Tempo and is never shown again.
The app does not store names, email addresses or avatars. Names are looked up from Jira when a page is shown.
Personal data and account closures
Account IDs are personal data. The app reports the account IDs it stores to Atlassian’s personal data reporting API every week. When Atlassian reports that an account has been closed, the app replaces that account ID with an anonymous key made with a secret kept on the customer’s site, and keeps a list of those anonymous keys so the account is not stored again. Past cost totals stay correct.
Who can see the data
Inside Jira, only people with the app’s “Burnrate: view budgets and reports” or “Burnrate: manage rates and budgets” global permission can see costs. The rate card, costs per person and billing amounts are shown only to people with the manage permission. Names of projects and work items are only shown to people who can browse them in Jira. Jira admins decide who has these permissions.
Where data is processed
Burnrate runs on Atlassian’s Forge platform. Without the Tempo connection, the app makes no calls to servers outside Atlassian. If an admin turns on the Tempo connection, the app reads worklogs (with their author account IDs and billable time) and the worklog deletion log from Tempo’s API (api.tempo.io, api.eu.tempo.io or api.us.tempo.io) using the token the admin provided. Worklogs read from Tempo are stored as described under “Data the app stores”. Nothing is sent to Tempo other than these read requests. No data is sent to Kayabyte or to any other third party.
Retention and deletion
Data is kept while the app is installed. Admins can choose how much worklog history is kept (3 to 24 months, or all); worklogs deleted in Jira or Tempo are removed by the app’s sync. When the app is uninstalled, its Forge storage is deleted by Atlassian in line with Atlassian’s Forge data retention rules. Customers can also ask us to confirm deletion by contacting support.
Logs
For troubleshooting, the app writes operational logs on the Forge platform containing error types and status codes, without account IDs, names or amounts. These logs are kept by Atlassian under its Forge log retention rules.
Your rights
For questions about this policy or about data the app processes, contact support@kayabyte.dev.
Changes
We will update this page if the app’s data handling changes. The date at the top shows the latest version.