Bitbucket
- The documents do not say whether your data trains AI.
- Your data is used to target ads at you; you can opt out.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
Atlassian collects account, usage, and device data, uses ads with opt-outs, and you own your repos; product content is mainly handled for your org.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account info, your content, usage, device IDs, cookies, and sometimes partner data.
Read the exact line
Privacy policy
“Atlassian collects information directly from you when you provide it to us, automatically when you use our Services, and from other sources including other users of the Services, other services you link to your account, other Atlassian companies, partners, and third-party providers.”
Training
They use it to run the service, improve it, market to you, and show targeted ads.
Read the exact line
Privacy policy
“We use information about you and how you use the Services for analysis, research and communications relating to marketing (including targeted advertising of products that may interest you), promotional activities, and business development.”
Sharing
Service providers, partners, ad companies, other users, and your org’s admins may see data.
Read the exact line
Privacy policy
“We disclose information to third parties that help us operate, provide, improve, integrate, customize, support, and market our Services.”
Kept
They keep account data while you are active and a while after; some team content stays.
Read the exact line
Privacy policy
“We retain your account information for as long as your account is active and a reasonable period thereafter in case you decide to re-activate the Services.”
Controls
You can update profile info, delete an account, and opt out of ads and promo emails.
Read the exact line
Privacy policy
“You may opt out of receiving promotional communications from us by using the unsubscribe link within each email, updating your email preferences within your Service account settings menu, or by contacting us”
Fine print
You own your data; plans auto-renew; fees are mostly non-refundable; they can change the rules with notice.
Read the exact line
Terms of service
“As between the parties, Customer owns all intellectual property and other rights in Customer Data and Customer Materials provided to Atlassian or used with the Products.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Opt out of targeted ads and sale/sharing
Privacy policy: click Manage Preferences; they also honor Global Privacy Control
Turn off promotional emails
Unsubscribe link in emails, or email preferences in your Service account settings
Delete or update your account info
Profile settings in the service, or the account deletion / access request links in the privacy policy
Stop auto-renewal before the term ends
Account settings in the Products, Atlassian support, or other notice to Atlassian
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They can use how you use Bitbucket and related sites to aim ads and marketing at you.
Read the exact line
Privacy policy
“We use information about you and how you use the Services for analysis, research and communications relating to marketing (including targeted advertising of products that may interest you)”
For example, visiting pricing pages could lead to Atlassian ads on other sites.
U.S. rules treat some sharing of identifiers with ad companies as a sale or share of your data.
Read the exact line
Privacy policy
“Recipients of “Sales” or “Sharing” Identifiers, such as name, email address, unique identifiers associated with user or user account, IP Address”
For example, an ad partner could get an ID tied to your account or IP for ads.
Closing your account does not always wipe what you posted for teammates.
Read the exact line
Privacy policy
“If your account is deactivated or disabled, some of your information and the content you have provided will remain in order to allow your team members or other users to make full use of the Services.”
For example, a comment you left on a repo can still show after you leave.
Paid plans keep renewing at the then-current price unless you cancel in time.
Read the exact line
Terms of service
“Unless otherwise specified in an Order and subject to the Product, Support or Advisory Services continuing to be generally available, a Subscription Term will automatically renew at Atlassian’s then current rates”
For example, a yearly Bitbucket Cloud plan can charge again unless you turn off renewal first.
You usually cannot get money back after you pay, except for a short first-order return window.
Read the exact line
Terms of service
“All fees and expenses are non-refundable, except as otherwise provided in this Agreement.”
For example, if you cancel mid-year after the first 30 days, leftover months are typically not refunded.
They mostly do not promise the product will always work, and they cap what they pay if things go wrong.
Read the exact line
Terms of service
“Except as expressly provided in this Section 11 (Atlassian ), the Products, Support and Advisory Services and all related Atlassian services and deliverables are provided “AS IS.””
For example, if an outage costs you work time, they may only owe a limited amount under the contract.
They list AI model training as a use of personal information they control, such as support and usage data.
Read the exact line
Privacy policy
“To develop and improve the Services, including machine learning and artificial intelligence model training”
For example, a support ticket you send could be used to help train their help tools.
You can turn off some ad-related sharing and targeted ads using their preference tools.
Read the exact line
Privacy policy
“You may also opt out of “sales” of personal information to third parties, “sharing” of personal information for purposes of cross-context behavioral advertising, and “targeted advertising” by clicking here and following the instructions.”
For example, you can use Manage Preferences or a Global Privacy Control browser setting.
Your company (or you) owns the code and files you put in the product.
Read the exact line
Terms of service
“As between the parties, Customer owns all intellectual property and other rights in Customer Data and Customer Materials provided to Atlassian or used with the Products.”
For example, your Bitbucket repositories stay yours; they do not take ownership of the code.
They say outside auditors check their security program.
Read the exact line
Terms of service
“Atlassian will also maintain a compliance program that includes independent third-party audits and certifications, as described in its Security Measures.”
For example, you can look at their Trust Center for those audit claims.
Words to know
Legal words from the lines above, in plain English.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- targeted advertising
- Ads chosen for you based on what you have done across other apps and websites, not just this one. For example, you look at shoes in one app and see shoe ads in a totally different app the next day.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- opt out
- Something is on by default and stays on until you find the setting and turn it off. For example, your chats may be used for training unless you go into settings and switch it off.
- device identifiers
- Codes that single out your phone or computer, used to recognise you across apps and sites. For example, the advertising ID on your phone lets two unrelated apps know they are seeing the same person.
- auto-renewal
- Your subscription keeps charging you at the end of each period until you cancel it. For example, a free trial turns into a paid monthly plan unless you cancel before it ends.
- warranty
- A promise that a product will work as described; most apps say they make no such promise at all. For example, if a paid feature never works on your phone, a no-warranty clause says that is your problem.
- model training
- Using your content and conversations as examples to teach an AI system, which can then echo them in future answers. For example, a story you write in a chatbot may be studied by the company to make the next version of the bot.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
How we got here · grade C · score 48/100 · 15 of 15 policy answers backed by a verified quote · 5 not stated
What does the app collect beyond what it needs to work?
They collect account and profile details, content you provide, usage of the services, device IDs, IP address, cookies, and some partner data. Location is approximate from IP, not a full extra grab of contacts or your photo library.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They use targeted advertising and third-party ad partners, and they describe an opt-out including Manage Preferences and Global Privacy Control.
Do they sell or share your data, and can you opt out?
They share with service providers, Atlassian partners, and ad providers. disclosures treat some of that as sale or sharing, with an opt-out.
What rights do they take over what you type and what the AI makes?
The customer agreement says you (the customer) own Customer Data such as what you put in the products.
How long do they keep your data after you delete it, and can you delete it in the app?
Not stated in the documents.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe industry-standard safeguards and, in the customer agreement, independent third-party audits and certifications.
Is there a real age gate, and are teens protected?
Services are not for anyone under 16, and the customer must make sure users are at least 16. There is no extra age-check described.
Will they tell you when the rules change, and is the policy specific?
The privacy policy is dated. They post changes and give a more prominent notice or email for significant changes. Paid terms generally take effect at the next order or renewal, with about 30 days’ posting.
Can they close your account without warning, and can you get your data out first?
They can limit or suspend access for legal or security issues, and when practicable they let you fix it first. Docs describe retrieving Customer Data, and they delete it after the term ends as described in documentation.
If something goes wrong, who pays?
Products are provided AS IS except limited performance warranties, and their payout is generally capped at fees paid in the prior 12 months (higher only for some security breaches).
Do subscriptions renew on their own, and can you get a refund?
Subscriptions auto-renew at then-current rates. Fees are non-refundable except a 30-day return on an initial product order and some termination cases.
The privacy policy is 8,861 words at a professional or legal expert level (Flesch reading ease 27.2); the terms are 6,563 words at a professional or legal expert level.
