Privacy & security
Last updated: 31 August 2026
OneView is built by Crosstown Tech, a software studio based in Toronto, Canada. It reads your work-management data so it can be reshaped — grouped, rolled up, re-columned — into a view the source tool cannot draw. This page says exactly what it reads, what it keeps, and for how long.
What OneView reads
You connect a Jira site with Atlassian's OAuth 2.0 (3LO). OneView requests three scopes and no others:
read:jira-work— issues, their fields, and the projects they live in.read:jira-user— the display names OneView needs to label rows and group by person.offline_access— a refresh token, so a scheduled refresh does not require you to sign in again.
Access is read-only. There is no write scope, so OneView cannot create, change or delete anything in your Jira site, whatever it is asked to do.
What it stores
| What | Why |
|---|---|
| Issues from the projects you load — key, summary, type, status, dates, estimates and the other fields on the issue, including your custom fields | The grid is computed over stored rows rather than fetched live, so rollups are consistent and a large project stays usable |
| People, as Atlassian account ids only | To show who work belongs to, and to group by person |
| Your identity, as an Atlassian account id only | To recognise you when you sign in again |
| Connection details — the site's cloud id, URL, name, granted scopes and time zone | To read the right site, and to read dates in the zone your Jira uses |
| Sign-in tokens for that connection | To refresh data without asking you to re-authorise |
What it deliberately does not store
No names. No email addresses. No avatars. Not yours, and not your colleagues'. People are recorded only by the opaque account id Atlassian issues, which Atlassian does not treat as personal data.
Names still appear throughout the app, because a grid of account ids would be useless. They are fetched from Jira with your own token when a screen is drawn, held in your browser's memory for as long as the tab is open, and never written down. This follows Atlassian's own guidance to app developers — "do not store any user personal data and always retrieve current user data at the time of use" — and it is also simply more accurate: someone who changes their display name is correct on your next screen rather than at the next sync.
Where it is stored
Application data is held on Convex Cloud, in the United States. The marketing pages you are reading are hosted on Vercel and hold no customer data.
Credentials and sessions
- Atlassian tokens are held server-side and are never sent to your browser. They are stored in the application database, on the terms above.
- Your browser session holds a random secret. The server stores only a SHA-256 hash of it, so reading the database does not let anyone sign in as you. Signing out revokes the session on the server, not only in your browser.
- No password is ever created or handled — sign-in is Atlassian's.
Who can see what
Each person who signs in gets their own isolated workspace, and every stored record is keyed to it. Nothing queries across that boundary.
This also settles permissions structurally rather than by rule: every read runs with your Atlassian token, so OneView can only ever hold issues you can already see in Jira. Two people on the same site who can see different things get different data, because their tokens fetched it.
Sub-processors
- Convex — application database and scheduled jobs (United States).
- Atlassian — the source of the data and the identity provider.
- Vercel — hosts this site and the application front end; no customer data is stored there.
No data is sold, shared with advertisers, or used to train models.
Retention and deletion
Data is kept while your connection is active so the grid has something to draw. To have a workspace and everything in it deleted, email support@crosstowntech.com from the address on your Atlassian account; it will be deleted within 30 days. You can also revoke OneView's access at any time from your Atlassian account settings, which stops all further reading immediately.
Changes
If this page changes materially, the date at the top changes with it. Continued use after a change means the updated page applies.
Contact
Crosstown Tech — support@crosstowntech.com. For privacy requests, please include the Atlassian site URL you connected.