Space Analytics — Privacy

At a glance

Scope & roles

This page covers Space Analytics for Confluence, built and hosted on Atlassian Forge. It also describes the one-time import of historical data from the earlier Atlassian Connect version of the app.

The organisation that installs the app is the controller of the page view data: it decides whether to track, on which legal basis, and for how long. Vico is the processor and handles the data only to provide the app. Atlassian, which operates the Forge platform, and the providers listed under Sub-processors act on our behalf.

Under the GDPR, consent is often not the appropriate legal basis between an employer and its staff, so many organisations rely on legitimate interest instead; in some jurisdictions, such as Vietnam, consent may be required. The app supports both approaches (see Administrator controls & consent). Choosing the right one for your organisation is the controller's decision.

What is recorded

A page view is recorded each time a signed-in user opens a Confluence page or blog post on a site where tracking is enabled. Each page view contains:

Pseudonymous reader identifier

A keyed hash (HMAC-SHA256) of the site's cloud ID and the reader's Atlassian account ID. It lets the dashboard count unique users without storing the account ID itself, and it cannot be reversed without a secret key held only in the app's encrypted configuration.

Content and space

The space ID and key, the page or blog post ID and type, and the path part of the page URL (for example /wiki/spaces/DOC/pages/123/Title). Query strings and page content are not recorded.

Time and duration

When the page was opened, and how long it was visible in the reader's browser tab (capped at 24 hours).

Device type

One of Desktop, Tablet or Mobile, derived from the browser's user agent at the moment of the view. The user agent string itself is not stored.

Country (optional)

The country name and ISO code, derived from the reader's IP address as described in How country is determined. Administrators can switch this off.

The app also stores a small amount of configuration in Forge hosted storage:

Site settings

Tracking on/off, consent mode and notice text, country collection, retention period and excluded spaces.

Settings change log

The latest 100 changes to the settings, each with the time, the changed values and the Atlassian account ID of the administrator who made the change, so that administrators can audit who changed privacy settings.

Consent answers

When consent mode is on: each reader's answer (allowed or not allowed), the notice version it applies to and the time, keyed by the same pseudonymous identifier.

What is not recorded

• Names, email addresses, avatars or any other profile information.
• The content of pages, comments or attachments.
• Views by anonymous (not signed-in) visitors, views of pages being edited or created, and views in spaces an administrator has excluded.
• IP addresses, precise location, city or region.
• Anything stored on the reader's device: the app sets no cookies and uses no browser storage.

The dashboards show aggregated figures (users, sessions, durations, countries, devices, top pages). They do not show what an individual person has read.

How country is determined

Atlassian does not give Forge apps the reader's IP address, so when country collection is on, the reader's browser asks Vico's lookup service directly:

1. After a page view is recorded, the app issues a signed, single-use token that is valid for that view only and expires after 5 minutes.
2. The browser sends the token to geo-ip.vico.work. The request necessarily carries the reader's IP address, as any web request does.
3. The service looks the address up in a local copy of the MaxMind GeoIP country database. The IP address is not sent to MaxMind or any other third party.
4. Only the country is returned, signed so that it cannot be altered in the browser, and saved on that page view.

The service keeps no record of which person or page a lookup was for. To avoid repeating lookups it caches the country per network prefix: the first three octets of an IPv4 address (for example 203.0.113) or the first three groups of an IPv6 address, never the full address. Its application logs record only the request path, status and timing. Like any web service, our load balancer keeps standard access logs, which include IP addresses, for a short period for security and troubleshooting.

If country collection is turned off, no request is made to the lookup service at all.

How data is used

• To show analytics to the people your site allows to see them.
• To apply your settings: consent, exclusions and retention.
• To keep the app secure and reliable, for example to diagnose an error you report.

We do not sell page view data, use it for advertising or profiling, combine it with data from other customers, or use it to train AI models. Vico staff do not browse customer analytics; we look at an installation's data only when you ask us to investigate a problem.

Who can see analytics

• Space Analytics (space dashboard): people with Confluence's View analytics permission on that space, and Confluence administrators.
• Page Analytics (button on a page): space administrators, with the same permission check.
• Privacy & consent settings: Confluence administrators only.

Permissions are checked by the app's server-side code on every request, with the signed-in user's own Confluence permissions, so hiding a link is never the only protection.

Where data is stored

Page views, settings and consent answers are stored in Forge hosted storage (Forge SQL and the Forge key-value store), which Atlassian operates. Data is isolated per installation and follows Atlassian data residency: it is stored in the same location as your Confluence site and moves with it.

Two parts of the service run on infrastructure Vico operates on DigitalOcean in Singapore:

• The country lookup service described above. It processes the IP address in memory and stores only the prefix-to-country cache.
• The legacy Connect backend, which holds page views recorded by the earlier Connect version of the app in a managed MongoDB database. When a site moves to the Forge version, its history is copied into Forge hosted storage once. During that copy the Atlassian account IDs held by the legacy system are replaced by the same pseudonymous identifier described above, and full page URLs are reduced to their path.

Administrator controls & consent

Confluence administrators manage the app in Confluence settings → Space Analytics – Privacy:

Collect page views

Turns tracking on or off for the whole site.

Collect country

When off, no country lookup takes place and new page views have no country.

Retention

How long raw page views are kept: from 1 to 25 months, 13 months by default.

Excluded spaces

Spaces in which nothing is recorded.

Consent mode

Off: the organisation relies on another legal basis, such as legitimate interest, and confirms this when switching consent off. Required: readers are tracked only after they choose Allow.

Notice text

The message readers see when asked. Changing it asks everyone again.

When consent is required, readers see a Page analytics notice with two equal choices, Allow and Don't allow. Until a reader chooses Allow, nothing about their views is recorded and no country lookup is made. A reader who chooses Don't allow is not asked again unless the notice changes. Every settings change is written to the change log shown on the same page.

Retention

Rights & deletion

Because your organisation is the controller, requests about page view data — access, deletion, objection or withdrawal of consent — should normally go to your Confluence administrator first. We help administrators fulfil them.

• Readers can ask their administrator, or contact us with their site URL, to change a consent answer or to delete the page views recorded for them. We locate them through the pseudonymous identifier, without needing anything else.
• Administrators can stop collection at any time, exclude spaces, shorten retention, or ask us to delete all of the site's data, including any history still held by the legacy Connect backend.

Send requests to [email protected] or through our support portal. We respond within 30 days and confirm when deletion is complete. A Data Processing Agreement consistent with Article 28 GDPR is available on request.

Sub-processors

MaxMind supplies the country database, which we download and use locally; no personal data is sent to MaxMind.

International transfers

Page views stored in Forge hosted storage stay in your site's data residency location. The country lookup and the legacy backend run in Singapore, and Vico is based in Vietnam. Where personal data from the EEA, UK or Switzerland is processed there, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable) and the safeguards described on this page.

Security

• Pseudonymisation: readers are stored only as keyed hashes; the key is kept in Forge's encrypted configuration.
• Signed tokens: country lookups and results are signed and expire after 5 minutes, so the browser cannot inject a country or reuse a token for another view.
• Server-side permission checks on every request, using the signed-in user's own Confluence permissions.
• Encryption: HTTPS in transit; Forge hosted storage and our managed database are encrypted at rest by their providers.
• Least privilege: the app requests only the scopes it needs. In the reader's browser it can contact a single external address, geo-ip.vico.work; its server side calls the legacy Connect backend only to import a site's history.

To report a security issue, email [email protected].

Changes to this page

We update this page when the app or legal requirements change. The "Last updated" date shows the current version. For material changes, such as collecting a new kind of data, we give notice through the Marketplace listing and in the app before the change applies.

Contact

Questions or requests about Space Analytics and your data: