InboxGuard privacy notice

InboxGuard is a Forge app for Confluence Cloud. It turns inbound email into Confluence pages. This notice describes what is processed, what is stored, and what is not.

简体中文摘要：InboxGuard 通过 Cloudflare Email Worker 接收 inbound.teamsplay.net 邮件，经 HMAC 验签后由 Atlassian Forge webtrigger 处理；在客户的 Confluence Cloud 站点以应用身份建页。Forge KVS 仅保存配置与 Message-ID 去重元数据（不含正文）。发布方为汇科天下（hktx.cn），不是 Codeland。

Publisher

汇科天下 / hktx.cn (Marketplace vendor). Contact: lijianbao@hktxcn.com. This app is not published by Codeland.

Who processes data

Two components handle inbound mail:

Cloudflare Email Routing + Email Worker on zone teamsplay.net — receives mail only at *@inbound.teamsplay.net, signs the payload with HMAC-SHA256, and POSTs it to the Forge webtrigger. No mailbox password is stored.
Atlassian Forge — the inboxguard-inbound webtrigger verifies the signature, applies the sender whitelist, dedupes on Message-ID, and creates a Confluence page with asApp.

The customer is the data controller for Confluence content. Page bodies live under the site’s normal Confluence permissions.

Data processed in memory (not written to Forge KVS as content)

Email subject, text/HTML body, and attachment bytes (bytes are measured; binary upload to Confluence is stubbed in the current version)
Sender address for whitelist checks
Headers needed for Message-ID and authentication

Subject and body are used to build the Confluence page (title + storage XHTML). Attachment binaries are not persisted in Forge storage.

Data the app stores (Forge KVS, per installation)

Stored	Example	Why
Config document (`config:inbox`)	enabled, spaceId, parentPageId, whitelist, titlePrefix, maxAttachmentMb	Admin / env configuration until a settings UI ships
Message-ID dedupe record	normalized message id, page id, from, subject, receivedAt	Skip duplicate pages for the same inbound message

Dedupe records are metadata only. The email body is not written to Forge KVS. Keys use a hash of the Message-ID so raw ids with special characters are not used as KVS keys.

What this app does not do

No analytics or advertising cookies of its own
No Codeland-operated backend; publisher is hktx.cn
No storage of mailbox passwords
No Mailgun inbound verifier in the default path (Cloudflare Email Worker only)
Attachment upload to Confluence is not yet executed (roadmap); do not assume attachments appear on the page

Forge platform logs are operated by Atlassian and may contain invocation errors. Cloudflare may retain Worker request logs per their platform policies.

Retention

Config overwrites on save. Dedupe records remain until uninstall or manual clear. Uninstall removes Forge app storage for that installation. Confluence pages remain under the customer’s retention. Cloudflare Worker secrets (WEBHOOK_SECRET, FORGE_WEBTRIGGER_URL) are configuration, not customer email content.

Contact

Security / support: lijianbao@hktxcn.com