Legal
Privacy Policy
This policy explains how Novari Software processes personal data on this website and in Harvest Two-Way Sync for Jira.
Controller and contact
The controller is named in the Legal notice. For privacy questions or requests, contact support@novarisoftware.com.
This website
This website is hosted by ALL-INKL.COM – Neue Medien Münnich in Germany. When you visit, the host processes technically necessary access data such as IP address, time, requested address, browser identification and referring page. This processing is necessary for the reliable and secure operation of the website and is based on Art. 6(1)(f) GDPR.
We do not use analytics, advertising services, external font services, embedded third-party content or marketing cookies on this website. The interactive product demo runs entirely in your browser and does not send its sample data to Jira, Harvest or Novari Software. If you contact us by email, we process your message and the information it contains to answer your request.
Harvest Two-Way Sync for Jira
Harvest Two-Way Sync synchronizes time entries between the Jira site and the Harvest account that the individual user connects through OAuth. The app runs in Atlassian Forge. Novari Software operates no application server, database or log backend of its own.
As a persistent personal identifier, the app stores the Jira account ID only. It does not persist names, email addresses, avatars or other profile data. Persistent app data is held in Atlassian Forge Key-Value Storage associated with the relevant Jira site.
The app needs the Jira site context, issue key, summary and URL, worklog details, cloud ID, locale and technical synchronization identifiers to create and reconcile a matching worklog. A Jira worklog created by the app contains the duration, date and issue key only. The user’s Harvest note is not copied into the Jira worklog. Technical properties stored on the worklog link the corresponding Harvest entry and account with the synchronization operation, checksum and time of sync.
While the app is in use, it reads the Harvest data required to present and synchronize time tracking: account identity, profile and timezone information, project and task assignments, client name, and time-entry details including date, duration, notes, timer times and external reference. This data is used in the active request and interface; it is not retained by the app except for the Jira account ID and the technical synchronization records described here.
Transfer to Harvest
When the user creates or synchronizes a booking, the app sends the project and task IDs, date, duration and a note to the Harvest account authorized by that user. By default, the note includes the Jira issue key, issue summary and the user’s own note; the external reference includes the issue key and Jira issue URL. Harvest is an independent service in the United States. The user initiates this transfer and can choose the key-only note format in the app settings to omit the issue summary.
Harvest is not infrastructure operated by Novari Software. Its processing is governed by the Harvest Privacy Policy. The app communicates with Harvest only through its OAuth and API endpoints.
Security, diagnostics and retention
Harvest access and refresh tokens are held in Atlassian Forge External Authentication storage. They are not exposed to the app interface, written to the app’s Key-Value Storage or intentionally included in diagnostics. Diagnostic redaction removes credentials, authorization data, cookies and tokens before data is logged or included in a diagnostics download.
Synchronization records are retained for three months from the booking date. Diagnostics are retained for 24 hours. These limits are applied by scheduled cleanup even when a user does not return to the app. Diagnostics are held in Atlassian Forge application logs and contain a pseudonymized account reference, cloud ID, module key and technical events. Novari Software receives diagnostics only when a user downloads and voluntarily sends them to support.
Atlassian’s personal-data reporting mechanism reports stored Jira account IDs and deletes all associated app keys when Atlassian marks an account as closed. Users can disconnect via Settings → Log out completely and revoke the authorization in their connected-app settings.
Atlassian Marketplace and Jira
Atlassian and Harvest are independent providers. Atlassian’s processing of data in Jira, Forge and the Marketplace is governed by the Atlassian Privacy Policy. If the app is obtained through the Atlassian Marketplace, Atlassian processes Marketplace account, licensing and billing information under its own terms and privacy policy.
Novari Software may receive the limited licensing, contact, reporting and analytics information that Atlassian makes available to Marketplace vendors. We use it only to operate, support and improve the app and website, and to contact a listed technical contact about service-related matters where appropriate. We do not control analytics or other data collection carried out by Atlassian on Marketplace listing pages.
Legal basis and your rights
Where the app is used under an agreement with a customer organization, processing is carried out as necessary to provide the requested synchronization features. Technical website processing is based on our legitimate interest in a secure and functioning website. Subject to the applicable conditions, you may request access to, correction or deletion of your personal data, restriction of processing, portability of data, or object to processing. You may also lodge a complaint with a supervisory authority.
Contact support@novarisoftware.com to exercise your rights. For data controlled by your employer or another Jira-site administrator, please contact that organization first.
Changes to this policy
We will publish material changes on this page. Last updated: 11 November 2026.