Last updated: October 16, 2026
Axon ("Axon", "we", "us") is a project management platform at axonjira.com that helps teams manage their projects, tasks and time. This Privacy Policy explains which personal data we process when you use Axon, for what purposes and on which legal bases we process it, who we share it with, how long we keep it, and the rights you have over it.
This text is provided to meet our duty to inform under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and Articles 13 and 14 of the EU General Data Protection Regulation ("GDPR"). It covers the axonjira.com website, the Axon app, the Axon API and the command-line tool.
The data controller for the personal data described in this policy is Axon, which provides the Axon service at axonjira.com. You can reach us about anything concerning your personal data at info@axonjira.com.
When a project in Axon is created on behalf of a team or organization, the project owner and admins decide who joins the project and what information goes into it. Content you add to a project is visible to that project's members and is handled according to the settings its admins choose.
Which of your data we process depends on how you use Axon:
• Account data - your email address, username, display name and password. We never see your password; it is stored only by our authentication service provider, in an irreversibly hashed form. If you sign in with a third-party account, we receive your name, email address and profile photo from that provider, and, if you signed in with a code hosting account, that account's username as well.
• Profile and preference data - your profile photo, language and theme preference, time zone, email notification preferences, starred projects, dashboard layout, running timer and saved searches.
• Workspace content - projects, tasks, comments, tickets, sprints, epics, versions, time entries, estimation session votes, and uploaded files and images created by you and your teammates. This content also records who created an item, who it is assigned to and who last changed it.
• Activity and notification records - the history of actions in projects (for example, who changed a task's status), the in-app notifications shown to you, and project invitations.
• Email delivery records - for notification emails sent to you: the recipient address and name, the task or comment the email is about, the delivery status, and information about addresses that bounced or reported an email as spam.
• Integration data - information from services you choose to connect: your user ID, display name and email address in a team chat tool; and, from connected code repositories, commit messages, pull request titles, branch names, and the usernames and profile photos of commit authors. The tokens used to access these services are stored encrypted.
• API keys and webhooks - the name, permissions, last four characters and last-used time of API keys you create; the webhook addresses you set up and the records of deliveries to them.
• Communication data - when you email us, your email address, your name and the content of your message.
• Technical data - records our hosting infrastructure keeps automatically when you access Axon: IP address, browser and operating system information, the page or address requested, time, and response status. Application error logs may include user and project IDs. When you create a ticket, its environment field is pre-filled with your browser and operating system; you can change or clear it.
• Data kept in your browser - see "Cookies and local storage".
We do not ask for special categories of personal data such as health information, religion or political opinions; please do not enter such information into Axon. We do not collect or store your payment card details.
We collect personal data electronically, partly by automated means, in the following ways:
• From you directly - information you provide when you sign up, edit your profile, create content in Axon or write to us.
• From your teammates - when they invite you to a project, assign you a task or mention you in a comment.
• From connected services - information a service passes to us when you sign in with a third-party account or when an integration is connected to a project.
• Automatically - through server and error logs created while you use Axon, and through cookies and storage entries kept in your browser.
We process your personal data for the purposes below. Next to each purpose we list the legal basis under Article 5 of the KVKK and Article 6 of the GDPR:
• To create your account, keep you signed in and provide Axon's features (projects, tasks, comments, time tracking, reports, integrations and the API). Legal basis: establishing and performing a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
• To send in-app notifications, the notification and digest emails you turn on, and emails about account actions such as password resets. Legal basis: performance of a contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
• To keep the service secure, limit abuse and excessive requests, and find and fix errors. Legal basis: our legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)).
• To answer your support requests and questions. Legal basis: performance of a contract and our legitimate interests (KVKK Art. 5(2)(c) and (f); GDPR Art. 6(1)(b) and (f)).
• To meet our legal obligations, respond to lawful requests from competent authorities and protect our rights in possible disputes. Legal basis: legal obligation and the establishment, exercise or defense of a right (KVKK Art. 5(2)(ç) and (e); GDPR Art. 6(1)(c) and (f)).
We do not sell your personal data or use it for advertising or profiling. Axon contains no analytics, advertising or behavioral tracking tools.
• Your profile - your profile information, in particular your name, username, profile photo and email address, can be seen by other signed-in Axon users so that they can find you, invite you to projects and recognize you within a team. Whether a username is taken can be checked by anyone during sign-up.
• Project content - tasks, comments, time entries and other content you add to a project are visible to that project's members. Project owners and admins can also see the project's email delivery records and integration settings.
• Files - files and images you upload are served through long, random links that are extremely hard to guess. Anyone who has such a link can open the file, so share file links only with people you trust.
You and your teammates decide who joins a project and what content is added to it.
To run Axon we work with service providers that carry out certain tasks on our behalf and on our instructions. These providers may process your data only to provide their services to us and may not use it for their own purposes. The categories of recipients we share personal data with are:
• Cloud hosting, database, file storage and authentication service providers - run the Axon app and its background jobs, and host your account data, workspace content, uploaded files and server logs. The same infrastructure's key management service is used to encrypt integration tokens.
• A transactional email delivery service provider - sends password reset, notification and digest emails, and processes your email address, name and the email's content to do so.
• Domain name, DNS and email forwarding service providers - manage the axonjira.com domain and deliver the emails you send to Axon addresses to us.
• An avatar image service - if you pick a ready-made avatar as your profile photo, the image is loaded from this service. To generate it, your display name is sent to the service together with the IP address of whoever views the image.
• A content delivery network (CDN) - the API documentation page loads its interface files from a content delivery network, which receives your IP address and browser information.
• Competent public authorities and courts - only where there is a lawful request or a legal obligation, and only to the extent required.
• Parties to a possible merger, acquisition or sale of assets - in that case we will inform you before your data becomes subject to a different privacy policy.
In addition, data is shared with the services that you or project admins choose to connect; see "Services you connect" for details.
You can request the current list of our service providers by writing to info@axonjira.com.
Some features work with third-party services that you or project admins choose to connect. These services are not providers working on our behalf; they process data under their own privacy policies. We recommend reading a service's policy before connecting it.
• Signing in with a third-party account - if you choose to sign up or sign in with a third-party account, that provider verifies your identity and passes us your name, email address and profile photo. Your profile photo is then loaded from that provider's servers.
• Team chat integration - when a project is connected to a team chat tool, the task key and title, status changes, the display names of the people involved, short excerpts from comments, and sprint and version details are sent to the chosen channel. When an Axon task link is shared in the chat, a summary of the task is shown. If you link your chat account to your Axon profile, your user ID, display name and email address are stored for in-chat commands and your personal digest messages.
• Code repository integration - when a project is connected to a code repository, the repository's commits, pull requests and branches (their messages and titles, and the usernames and profile photos of their authors) are imported into Axon and linked to tasks. A token given for access to private repositories is stored encrypted and decrypted only on our servers.
• Webhooks and the API - project admins can set up webhooks that send project events to addresses they choose. These deliveries contain the content of the task or comment involved and the user ID of the person who made the change. Anyone holding an API key can access project data within that key's permissions.
You can remove these connections at any time from the project settings or your profile. Once a connection is removed no new data is sent; data sent earlier stays with that service under its own rules.
Our service providers process data in data centers outside Turkey. Your data is stored and processed in the following regions:
• European Union - the Axon database (account and profile records and workspace content) and transactional email delivery.
• United States - authentication, uploaded files, application servers, background jobs and server logs.
These transfers are necessary for us to provide the service. For transfers from Turkey we rely on the appropriate safeguards provided for in Article 9 of the KVKK (such as the standard contracts announced by the Turkish Personal Data Protection Board), and for transfers from the European Economic Area on the European Commission's adequacy decisions or standard contractual clauses. Transfers to third-party services you connect are subject to those services' own safeguards.
You can request a copy of the safeguards we rely on for these transfers at info@axonjira.com.
We keep personal data only for as long as needed for the purpose it is processed for, and as far as our legal retention obligations require:
• Account and profile data - while your account is open. What happens when you delete your account is described in the next section.
• Workspace content, activity history, notifications and email delivery records - there is no fixed time limit; these records are kept while the project and account they belong to are in use, so that the project's history can be followed.
• Webhook delivery records - 30 days; deleted automatically when that period ends.
• Server and error logs - 30 days; deleted automatically by the hosting infrastructure when that period ends.
• Copies of API responses kept to prevent the same API request from being processed twice - 24 hours.
• Session cookie - at most 7 days; deleted when you sign out.
• Emails you send us - until your request is resolved, and afterwards for a reasonable period needed for possible disputes.
When a retention period ends or the purpose of processing no longer applies, we delete, destroy or anonymize the personal data. Deleted data is also removed from our service providers' systems in line with their technical processes.
You can delete your account at any time from your Profile settings. When you delete your account:
• Your sign-in account, profile record and username are deleted immediately.
• You are removed from the projects you belong to. Ownership of projects you own that have other members passes to an admin or another member; projects where you are the only member are deleted.
• Tasks, comments, time entries and activity history you created in projects with other members stay in those projects as part of the team's work, and may continue to appear with your display name.
Project owners can delete a project from the project settings. A deleted project and its content are no longer shown to any user in the app.
For data that deleting an account or project does not remove automatically (for example files you uploaded, notification and email delivery records, or records in shared projects that contain your name), you can ask us to delete or anonymize it by writing to info@axonjira.com. We will carry out your request within 30 days at the latest, subject to our legal retention obligations.
The main technical and organizational measures we take to protect your data are:
• All traffic between your browser and Axon is encrypted with HTTPS (TLS).
• Database records and uploaded files are encrypted at rest by our infrastructure provider.
• We never see or store your password; passwords are irreversibly hashed by our authentication provider.
• Integration tokens and webhook signing secrets are encrypted with AES-256-GCM. The encryption keys are held in a separate key management service, and these secrets are decrypted only on the server.
• Only an irreversible hash (SHA-256) of each API key is stored; the full key is shown only once, when it is created.
• Database access rules make sure project content can be read only by that project's members. Sensitive server records such as tokens cannot be accessed from the browser.
• The session cookie is set so that scripts on the page cannot read it (HttpOnly) and it is sent only over secure connections.
• Webhook deliveries are signed, and request limits protect password resets, the API and other operations against abuse.
• Access to data is limited to the people needed to operate the service.
No system is completely secure. To protect your account, we recommend a strong password that you do not use anywhere else. If we become aware of a security breach affecting your data, we will notify you and the relevant authorities within the legal time limits. If you find a security vulnerability, please report it to security@axonjira.com.
Axon uses only the cookies and browser storage needed for the service to work and to remember your preferences. We do not use analytics, advertising, retargeting or cross-site tracking cookies, and we do not place third-party tracking code on our pages.
• Session cookie - tells the server that you are signed in. It is valid for at most 7 days and cannot be accessed by scripts on the page.
• Language cookie - remembers the language you chose and is deleted when you close your browser.
• Local storage - stores your theme preference, your choice on the cookie notice and your recent searches. When recurring tasks were last checked is kept only for the current browser session.
• Offline cache - so that the app opens quickly and keeps working when the connection drops, your sign-in information and project data are stored in your browser's database (IndexedDB) and the app's files in the browser cache. The project data cache is cleared when you sign out.
Because all of these are needed for the service to work, your choice on the cookie notice does not change how they are used. You can delete cookies and stored data from your browser settings at any time; doing so signs you out and resets your preferences.
Under Article 11 of the KVKK, you have the right to apply to us to:
• learn whether your personal data is processed, • request information about it if it has been processed, • learn the purpose of the processing and whether your data is used in line with that purpose, • know the third parties in Turkey or abroad to whom your data is transferred, • ask for your data to be corrected if it is incomplete or inaccurate, • ask for your data to be deleted or destroyed under the conditions in Article 7 of the KVKK, • ask for corrections, deletions or destructions to be notified to the third parties your data was transferred to, • object to an outcome against you that results solely from the analysis of your data by automated systems, • claim compensation if you suffer damage because of unlawful processing.
If you are in the European Economic Area, under the GDPR you also have the right to access your data, have it corrected or erased, restrict its processing, receive it in a structured, machine-readable format (portability), object to processing based on legitimate interests, and withdraw your consent at any time where processing is based on consent.
You can exercise some of these rights directly in the app: you can edit your profile, turn email notifications on or off, export the tasks in your projects as CSV or JSON, and delete your account.
If you are not satisfied with the outcome of your application or do not receive an answer in time, you can lodge a complaint with the Turkish Personal Data Protection Board in Turkey, or with the data protection authority of the country where you live or work in the European Economic Area.
To exercise your rights, send your request to info@axonjira.com from the email address registered to your Axon account (or, if you have no account, from the email address you use). Writing "Personal data request" in the subject line helps us handle it faster.
In your request, include your full name; your Turkish ID number if you are a Turkish citizen, or otherwise your nationality and passport or ID number; your address or the email address for our reply; and the subject of your request. If we cannot verify your identity, we may ask for more information.
We will handle your request as quickly as its nature allows, within 30 days at the latest and free of charge. If the request involves an additional cost, we may charge the fee set by the Turkish Personal Data Protection Board's tariff.
We do not make decisions about you based solely on automated processing that produce legal effects for you or similarly significantly affect you, and we do not profile you. The automated processes in Axon (for example linking a commit to the related task, sending reminders for tasks that are nearly due, or calculating project statistics) serve only to run the service.
Axon is not designed for children under 16, and we do not knowingly collect personal data from anyone under that age. If you believe your child has given Axon personal data, write to info@axonjira.com and we will delete the account and the data.
If you would like to support Axon, the support link in the app and on the website takes you to a third-party donation platform's own page. The donation takes place entirely on that platform; your card and payment details are not passed to us and are not stored by Axon.
The platform may share some information about your donation with us under its own policy (for example your name or nickname, the amount and any note you leave). We use this information only to see your donation and to thank you. To learn how the donation platform processes your data, read that platform's privacy policy.
We may update this policy when we add a new feature, change our service providers or when the law changes. The current version is always on this page, and the "Last updated" date at the top changes accordingly. We will announce changes that significantly affect how we process your data by email or in-app notice before they take effect.
Axon General and personal data requests: info@axonjira.com Security and vulnerability reports: security@axonjira.com Product support: support@axonjira.com Website: https://axonjira.com