Data Retention

What Rainbook keeps, for how long, and what happens when a person leaves, when you erase someone, and when you uninstall or reinstall. The same schedule applies on every edition unless a line says otherwise.

1. Where the data is

Storage	What it holds
Jira work items in your site	Deals, leads, accounts, contacts, conversations, meetings and their fields, comments, attachments and properties
Forge SQL for your site	The people index, email index, previews and search terms, reporting tables, activity history, AI working state, usage days; for Rainbook Mail Sync, daily capture counts
Forge key-value storage for your site	Settings, flags, saved views and job progress; for Rainbook Mail Sync, mailbox connections and the message ledger, with tokens as encrypted Forge secrets
Forge Object Store for your site	Older activity history, AI traces and the 30-day copies of removed messages; for Rainbook Mail Sync, files and message bodies waiting to be written, for at most 7 days
The Rainbook Archive work item	A nightly copy of Rainbook's own storage, as attachments

Everything is stored per Jira site, in your site's data residency region, and moves with your site. Rainbook can't read another site's data. Rainbook Mail Sync keeps its mailbox connections and tokens, sync progress, the capture ledger and the messages and files waiting to be written in Forge storage for your site, and writes captured email and meetings into your Jira work items, so all of that follows your site's location too. Mail Sync itself isn't pinned to a location: it reads mail and calendars through Google's or Microsoft's services, which handle that content under your own tenant's settings.

2. Normal operation

Data	Kept
Captured email and meetings	Until someone deletes, removes or erases them; they are Jira work items
Records deleted in Rainbook and removed messages	30 days, with Undo, then purged. Work items deleted in Jira's own screens are deleted at once
People index and email index	Until the person is erased; capped and pruned
Ask history and AI drafts	13 months from last use; the creator can delete any thread or choose Clear my history
AI traces: the prompt, sources and output of each AI result	30 days, for Show sources, feedback and diagnostics
Agent runs: who started each run and who it worked with, quoted customer text and answers	400 days from the run's start. Nightly Archive copies made before then keep them until those copies are replaced
Activity history	Searchable for 13 months on every edition, with filters and CSV export; on Advanced, as long as an admin chooses (13 months, 2, 3 or 5 years, or forever)
Activity history older than its searchable period	Kept as monthly archive files members of rainbook-admins can download; never deleted
Usage days	13 months
Failed-capture summaries	Until someone retries or discards them, at most 30 days
Rainbook Mail Sync's message ledger: which messages were captured, by hash, so none is captured twice	18 months
Rainbook Mail Sync's daily capture counts	400 days
Rainbook Mail Sync's files and message bodies waiting to be written	At most 7 days
Nightly Rainbook Archive copies	On paid sites, the latest 7 daily, 4 weekly and 12 monthly copies, attached to the Rainbook Archive work item; on Jira Free, the latest copy only, attached to the Archive work item. On sites where Jira attachments are switched off, copies are kept for download instead, for 30 days (7 days where Forge Object Store isn't available)
Addresses in an open privacy request	Until the request completes, then replaced by one-way hashes and counts
App logs	30 days in Atlassian's Forge logs; account IDs, the cloud ID, site host and record keys only

3. Erasing a person

Admins erase a person by email address, including people who never used Rainbook. One screen shows what will change, grouped by place with counts; Show items lists each item. Then one click:

the person's Contact work item is deleted;
on threads they wrote to, only their messages and files are removed by default, and their name and address in the rest of the thread read "[erased]"; an admin can choose to delete a whole thread instead;
on threads and meetings where they only received or attended, their name and address read "[erased]";
Rainbook's indexes, previews and search terms about them are deleted, their entries in the activity history read "[erased]", and AI traces and removed-message copies that include them are deleted within 24 hours;
copies in the Rainbook Archive are rewritten without them within 30 days;
their address can be blocked from future capture; erased people are kept only as one-way hashes, so the block works without keeping the address.

On sites with Atlassian Guard Premium, Rainbook also redacts the person from Jira's change history; elsewhere the erasure report lists each entry for you to remove, with everything that was deleted. Atlassian keeps deleted app data for a limited recovery period before destroying it, and Jira backups follow your site's backup schedule.

4. When a person leaves

When an Atlassian user leaves your site, Rainbook reports the account IDs it stores to Atlassian each week and, for closed accounts:

Data	What happens
Activity history entries	Kept, with the person shown as "Former user"
Their reports, dashboards and Ask threads	Passed to your Rainbook admins under From former users; nothing is deleted
Their place on account teams and record owners in Rainbook's storage	Cleared, then refilled from Jira
Their usage days and cached Jira profile	Deleted
Their work items in Jira	Unchanged; Atlassian manages the account's display

5. When you uninstall

Data	What happens
Work items, fields, comments, attachments, properties and links	Stay in Jira
The Rainbook Archive work item and the nightly copies attached to it	Stay in Jira, ready for a restore after you reinstall
Rainbook fields (Account, People, Revenue impact, Health)	Disappear from Jira; Jira restores their values if you reinstall within 30 days, and their values also stay in work item properties
Forge SQL, key-value storage and Object Store	Deleted by Atlassian after its recovery period; Atlassian can reconnect them to a reinstall requested within 21 days
Nightly copies kept for download (sites where copies can't be attached in Jira)	Deleted with Rainbook's Forge storage after Atlassian's recovery period
Rainbook Mail Sync's tokens and sync progress	When you uninstall Rainbook Mail Sync, capture stops and Mail Sync revokes the Google sign-in tokens of people who connected their own Google mailbox, most recently used first. Atlassian deletes the app's Forge-hosted data 28 days after uninstall; a reinstall requested within 21 days can be relinked to that data.

Nothing in Rainbook deletes your records on uninstall; when you uninstall Rainbook Mail Sync, capture stops and Mail Sync revokes the Google sign-in tokens of people who connected their own Google mailbox, most recently used first. If your copies are kept for download, download the newest one from Settings › Export and backups › Nightly copies before you uninstall; Download all data on the same page saves everything Rainbook keeps outside your work items. After uninstalling, remove the Rainbook approval validator from the Approval request workflow, or Approve stays blocked.

6. When you reinstall

Within 21 days of uninstalling, Atlassian can reconnect the apps' previous storage on request: email support@rainbook.humanr.ai before you run setup.

After that, or on a site restored from your Jira backup, open Jira Settings › Apps › Rainbook before you run setup. Rainbook finds the newest copy on the Rainbook Archive work item and offers Restore this copy; setup waits until you restore it or choose Set up without restoring. If the copy was made on another site, Rainbook names that site and asks first. The restore brings back settings, saved views, reports, the people index, the activity history and AI work in progress. Then:

run setup again;
press Fill the fields to refill Account, People, Revenue impact and Health from the work items' properties;
update the saved filters and dashboard gadgets Rainbook lists, so they use the new fields;
reconnect the mailboxes.

Rainbook rebuilds its indexes and reporting tables from your Jira work items. Work items, email and properties are already in Jira, so nothing captured is lost.

If your copies are kept for download, choose Moving Rainbook from a downloaded copy? on the same page and pick the files of the newest copy. For a daily copy, also pick the daily copies before it, back to the most recent Sunday or first-of-the-month copy. Rainbook checks every file before it restores anything.

If you erased anyone after the copy was made, erase them again once the restore finishes.

7. Backup and recovery

Back up Rainbook with the Jira backup you already use.

Records in Jira follow Atlassian's backup for your site.
Every night at 2:00 in your site's time zone, Rainbook attaches a copy of its own storage to the Rainbook Archive work item, so a Jira backup that includes attachments includes Rainbook too. Each copy is checked part by part before an older one is removed.
The most Rainbook's own storage can lose is one day; after a restore, its indexes are rebuilt from Jira within 8 business hours.
Members of rainbook-admins can download any copy, or make one now, from Settings › Export and backups › Nightly copies.
On Jira Free, the Rainbook Archive work item keeps the newest copy only, to leave room in the site's file storage.
On sites where copies can't be attached in Jira, nothing is attached: each nightly copy is kept for members of rainbook-admins to download for 30 days (7 days where Forge Object Store is not available). Download copies into your own backups before they expire.
Download all data, on the same page, saves everything Rainbook keeps outside your work items, for your own records or another tool.
Members of rainbook-admins can export activity history as CSV at any time, and on Advanced the full history in one file.

Step-by-step help: Backup and export.

8. Data minimisation

Usage analytics, error reports and app logs never carry names, email addresses, record content or prompts.
Rainbook sends an AI model only what the request needs, and only what the person asking can see.
Small logos and repeated signature images are not captured; files over the size limit stay in the mailbox.
Payment card numbers and US Social Security numbers are masked wherever Rainbook writes text: captured and logged email, calendar events, imports, Rainbook's forms and AI output. Attached files, file names, images and text typed directly in Jira's own screens are not scanned.
The people index keeps only addresses and names seen on threads, and is capped and pruned.
Completed privacy requests keep hashes and counts, never the person's address.

9. Contact

Questions about data retention: privacy@rainbook.humanr.ai.