Privacy & security
Last updated: 27 September 2026
OneView is built by Crosstown Tech, a software studio based in Toronto, Canada. It reads your work-management data so it can be reshaped — grouped, rolled up, re-columned — into a view the source tool cannot draw. This page says exactly what it reads, what it keeps, and for how long.
What OneView reads
OneView reads two sources, and you connect only the ones you use. Each is a separate grant, asked for separately, and either works on its own.
From Jira
You connect a Jira site with Atlassian's OAuth 2.0 (3LO). OneView requests three scopes and no others:
read:jira-work— issues, their fields, and the projects they live in.read:jira-user— the display names OneView needs to label rows and group by person.offline_access— a refresh token, so a scheduled refresh does not require you to sign in again.
From Microsoft Planner
You connect a Microsoft 365 tenant with Microsoft's identity platform (Entra ID). OneView requests these scopes and no others:
Tasks.Read— tasks, buckets and plan details from the plans you can already see. Read-only by design; there is noTasks.ReadWrite.User.Read— your own directory id, and your organization's name, so the connection can be labelled.User.ReadBasic.All—idanddisplayNamefor the people tasks are assigned to, so a row can be labelled with a person instead of a directory id.https://globaldisco.crm.dynamics.com/user_impersonation— the gateway Microsoft requires to reach Planner Premium plans, which live in Dataverse rather than in the Planner Graph API. Only Premium plans are read through it. If your tenant has no Premium, nothing is read here and OneView carries on with Basic plans.offline_access— a refresh token, so a scheduled refresh does not require you to sign in again.
Basic and Premium plans are read through the same connection, which is what lets both appear in one grid.
Signing in
You can also sign in with Microsoft or Google without connecting any data. Those sign-ins ask
for the scope openid and nothing else — not email, not
profile — and OneView keeps no token from them, because there is nothing to call
later.
Access is read-only, on both sources. No write scope is requested on either side, so OneView cannot create, change or delete anything in your Jira site or your Planner plans, whatever it is asked to do.
Refreshes can happen automatically, without you present. Besides refreshing when you open OneView, a background schedule also reads more often while you're actively using a connection, and at least once a day otherwise, using the same read-only access above. A connection left unused for an extended stretch instead gets only a periodic check that its token still works, with no data read, until you use it again.
What it stores
| What | Why |
|---|---|
| Work items from the projects and plans you load — for Jira, the issue key, summary, type, status, dates, estimates and the other fields on the issue, including your custom fields; for Planner, the task title, plan, bucket, labels, progress, dates and assignments | The grid is computed over stored rows rather than fetched live, so rollups are consistent and a large project or plan stays usable |
| People, as account ids only — the Atlassian account id, or the Microsoft directory object id | To show who work belongs to, and to group by person |
| Your identity, as an account id only — Atlassian, Microsoft or Google, whichever you signed in with | To recognise you when you sign in again |
| Connection details — for Jira, the site's cloud id, URL, name, granted scopes and time zone; for Planner, your Microsoft tenant id, your organization's display name and the granted scopes | To read the right site or tenant, and to read dates in the zone your Jira uses |
| Sign-in tokens for that connection | To refresh data without asking you to re-authorise |
What it deliberately does not store
No names. No email addresses. No avatars. Not yours, and not your colleagues'. People are recorded only by the opaque account id the source issues — Atlassian's account id, or Microsoft's directory object id. This holds identically for Jira and for Planner; the database has no column for a name on either side.
Names still appear throughout the app, because a grid of account ids would be useless. They are fetched from Jira or Microsoft Graph with your own token when a screen is drawn, held in your browser's memory for as long as the tab is open, and never written down. This follows Atlassian's own guidance to app developers — "do not store any user personal data and always retrieve current user data at the time of use" — and it is also simply more accurate: someone who changes their display name is correct on your next screen rather than at the next sync.
Where it is stored
Application data is held on Convex Cloud, in the United States. The marketing pages you are reading are hosted on Vercel and hold no customer data.
Credentials and sessions
- Atlassian and Microsoft tokens are held server-side and are never sent to your browser. They are stored encrypted at rest in the application database, on the terms above.
- Your browser session holds a random secret. The server stores only a SHA-256 hash of it, so reading the database does not let anyone sign in as you. Signing out revokes the session on the server, not only in your browser.
- No password is ever created or handled — sign-in is Atlassian's, Microsoft's or Google's.
Who can see what
Each person who signs in gets their own isolated workspace, and every stored record is keyed to it. Nothing queries across that boundary.
This also settles permissions structurally rather than by rule: every read runs with your token, so OneView can only ever hold work you can already see in Jira or in Planner. Two people on the same site or in the same tenant who can see different things get different data, because their tokens fetched it.
Sub-processors
- Convex — application database and scheduled jobs (United States).
- Atlassian — a source of the data, and an identity provider.
- Microsoft — a source of the data (Planner, and Dataverse for Premium plans), and an identity provider.
- Google — sign-in only; no data is read from Google.
- Vercel — hosts this site and the application front end; no customer data is stored there.
No data is sold, shared with advertisers, or used to train models.
Retention and deletion
Data is kept while your connection is active so the grid has something to draw. To have a workspace and everything in it deleted, email support@crosstowntech.com from the address on the account you signed in with; it will be deleted within 30 days. You can also revoke OneView's access at any time — from your Atlassian account settings, or from My Account → Privacy → Apps and services in Microsoft 365 — which stops all further reading immediately.
Changes
If this page changes materially, the date at the top changes with it. Continued use after a change means the updated page applies.
Contact
Crosstown Tech — support@crosstowntech.com. For privacy requests, please include the Atlassian site URL or the Microsoft tenant you connected.