Privacy & security
Last updated: 31 August 2026
OneView is built by Crosstown Tech, a software studio based in Toronto, Canada. It reads your work-management data so it can be reshaped — grouped, rolled up, re-columned — into a view the source tool cannot draw. This page says exactly what it reads, what it keeps, and for how long.
What OneView reads
You connect a Jira site with Atlassian's OAuth 2.0 (3LO). OneView requests three scopes and no others:
read:jira-work— issues, their fields, and the projects they live in.read:jira-user— the display names OneView needs to label rows and group by person.offline_access— a refresh token, so a scheduled refresh does not require you to sign in again.
Access is read-only. There is no write scope, so OneView cannot create, change or delete anything in your Jira site, whatever it is asked to do.
What it stores
| What | Why |
|---|---|
| Issues from the projects you load — key, summary, type, status, assignee, dates, estimates and the other fields on the issue, including your custom fields | The grid is computed over stored rows rather than fetched live, so rollups are consistent and a large project stays usable |
| People — Atlassian account id and display name | To show who work belongs to, and to group by person |
| Your identity — Atlassian account id, and the name and email address on that account | To recognise you when you sign in again |
| Connection details — the site's cloud id, URL, name, granted scopes and time zone | To read the right site, and to read dates in the zone your Jira uses |
| Sign-in tokens for that connection | To refresh data without asking you to re-authorise |
OneView does store personal data — names, email addresses and Atlassian account ids, as listed above. It stores no payment details and no credentials of yours other than the tokens Atlassian issues to it.
Where it is stored
Application data is held on Convex Cloud, in the United States. The marketing pages you are reading are hosted on Vercel and hold no customer data.
Credentials and sessions
- Atlassian tokens are held server-side and are never sent to your browser. They are stored in the application database, on the terms above.
- Your browser session holds a random secret. The server stores only a SHA-256 hash of it, so reading the database does not let anyone sign in as you. Signing out revokes the session on the server, not only in your browser.
- No password is ever created or handled — sign-in is Atlassian's.
Who can see what
Each person who signs in gets their own isolated workspace, and every stored record is keyed to it. Nothing queries across that boundary.
This also settles permissions structurally rather than by rule: every read runs with your Atlassian token, so OneView can only ever hold issues you can already see in Jira. Two people on the same site who can see different things get different data, because their tokens fetched it.
Sub-processors
- Convex — application database and scheduled jobs (United States).
- Atlassian — the source of the data and the identity provider.
- Vercel — hosts this site and the application front end; no customer data is stored there.
No data is sold, shared with advertisers, or used to train models.
Retention and deletion
Data is kept while your connection is active so the grid has something to draw. To have a workspace and everything in it deleted, email support@crosstowntech.com from the address on your Atlassian account; it will be deleted within 30 days. You can also revoke OneView's access at any time from your Atlassian account settings, which stops all further reading immediately.
Changes
If this page changes materially, the date at the top changes with it. Continued use after a change means the updated page applies.
Contact
Crosstown Tech — support@crosstowntech.com. For privacy requests, please include the Atlassian site URL you connected.