Starlie
Security
This page describes how Starlie protects your data. In short: Starlie is a native macOS app that talks to your Jira instance directly from your Mac. Your Jira content never reaches our servers.
To report a security issue, email david@starlie.app. We aim to acknowledge reports within 3 business days.
1. Architecture
- Starlie is a local desktop client. It is not a cloud service that stores your data on our infrastructure.
- All Jira data — issues, boards, comments, attachments, user names/avatars — is requested directly between your Mac and Atlassian over TLS and rendered on your device.
- Our only server, auth.starlie.app, performs the OAuth token exchange with Atlassian. It handles only the authorization code and tokens for that exchange and never receives your Jira business data.
2. Authentication
- Sign-in uses Atlassian OAuth 2.0 (3LO). We do not ask you for Personal Access Tokens, account passwords, or other shared secrets.
- The OAuth client secret is kept server-side on auth.starlie.app and is never embedded in the distributed App.
- Access and refresh tokens are stored on your device in the macOS Keychain.
3. Data storage
- Cached Jira data, your settings, starred issues, notes, and reminders are stored locally on your Mac (Keychain for tokens, a local database for the rest).
- Nothing is stored on Starlie servers. Local data is removed when you sign out or uninstall the App.
- Data-at-rest protection on the device relies on macOS (FileVault, Keychain). We recommend enabling FileVault.
4. Logging
The App keeps a transient diagnostic buffer in memory only (capped at 3000 lines) to help troubleshoot. It is never written to disk, never transmitted off your device, and is cleared when the App closes. We do not collect, retain, or have any access to it. There is no remote logging, analytics, tracking, or crash reporting in the App.
5. Data in transit
All connections — to Atlassian, to our authentication service, and to our website — use TLS encryption.
6. Sub-processors
| Provider | Purpose | Data |
|---|---|---|
| Atlassian | Your Jira data source (you connect your own instance) | Processed directly between your Mac and Atlassian |
| Apple | App distribution, payments and billing | Purchase and subscription data (handled by Apple) |
| Starlie auth service (auth.starlie.app, EU) | OAuth token exchange only | Authorization code and tokens (transient) |
7. Vulnerability reporting
Found a vulnerability? Email david@starlie.app with steps to reproduce. Please give us reasonable time to remediate before public disclosure. We do not currently run a paid bug bounty program.
8. Contact
Starlie — David Zukhbaia (individual entrepreneur, Georgia)
david@starlie.app