Privacy notice

Last updated 25 September 2026.

This notice explains what personal data Comment collects, why we collect it, who receives it, where it is stored, and how to request its deletion. It covers commentunderscore.com and the Comment feedback widget installed on customers' websites.

Who is responsible for your data

• This website and early-access requests. We are the controller for data collected when you visit commentunderscore.com or request early access.
• Reports on a customer's website. If a company installs Comment and you use its feedback button, that company is the controller and we are its processor. We act on its instructions. Its privacy notice governs the processing; this notice describes how the product handles the data.

Website visits and early-access requests

Data we collect

• Form details: the email address you enter in the early-access form and the optional free-text "your website" field, if completed.
• Submission details: the time of submission and the country the request came from.
• A short-lived IP address hash: salted with the date and used only to count submissions per network to prevent flooding of the form. The hash is not stored alongside your email address, cannot be reversed into an IP address, and expires after an hour.

Our hosting provider, Cloudflare, sees the IP address of every request to this site for routing and abuse prevention. It keeps its own logs. We do not have a separate copy of those logs.

Cookies, tracking and profiling

• This website sets no cookies and uses no local storage.
• This website runs no analytics or advertising pixels. The one script from outside our own site is Cloudflare Turnstile, which runs on the early-access form (and on account creation in the app) to tell people from bots. It loads from Cloudflare and runs its check in its own frame. Our Content-Security-Policy allows that one origin and blocks everything else, preventing trackers from being added by accident.
• This website does not profile you or carry out automated decision-making.

Purpose and legal basis

We use early-access signup data only to reply to you about early access. The legal basis is your consent when you ask us to contact you (GDPR Art 6(1)(a)). You can withdraw consent at any time, and we will delete the entry. We do not sell or rent the list or use it for unrelated marketing.

Recipients of signup data

• Cloudflare serves this page, stores the signup list in its key-value store, and runs Turnstile, the bot check on the form. Turnstile sees signals from your browser needed to tell a person from a bot; we receive only a pass or fail.
• Google receives a copy of your email address and the website field. The form writes to a Google Form, which adds the details to a spreadsheet with an email alert. The copy is sent from our server, not your browser. Google runs no code on this page and cannot see your visit.

The subprocessors page lists all recipients, including the services used by the product.

Retention of signup data

We keep your signup data until early access ends and we no longer need to contact you, or until you ask us to remove you, whichever comes first. To request deletion, email privacy@commentunderscore.com. We will delete the entry from both the key-value store and the spreadsheet.

Data collected by the feedback widget

Comment reads no page text. The following sections give the complete list of data collected by the capture code.

Data included in a report

• Feedback message: the message entered in the feedback box, up to 4,000 characters, stored as written. This is the only piece of free text in the system. It belongs to the reporter.
• Page address: the URL without its query string or fragment. Everything after ? or # is removed in the browser before anything is sent.
• Marked element: its ARIA role, tag name and accessible name. The accessible name is truncated to 80 characters. It comes from aria-label, an associated <label>, image alt text, or the visible text of a link or button. Input values, placeholders and title attributes are never read.
• Structural selector: tag names and positions only, such as form > button:nth-of-type(2). It contains no ids, classes, attribute values or text, each of which can carry personal data.
• Coarse geometry: the mark's position as whole-number percentages of the viewport, and the viewport's width and height in pixels.
• Markup: pins, areas and freehand strokes, stored as vectors with the reporter's chosen colour, never as an image.
• Screenshot: when a reporter submits a report and has marked something by pinning an element, dragging an area, or drawing a stroke, arrow or ellipse, Comment captures an image of the page as it appeared in their browser window at that moment: the visible area at their scroll position, with their marks drawn on top in the colour they chose. If nothing was marked, no image is captured. The image is rendered from the page's own content in the browser tab through an SVG <foreignObject>. There is no screen-recording prompt or video, nothing outside the browser tab is included, and the feedback panel itself is left out. Text typed into form fields and editable areas is hidden in the image: the fields appear, but their contents do not. The image is a JPEG, capped at 1600px on its long edge and stored as an attachment on the report. Capture is bounded and failure-safe: if it fails or takes too long, the report is sent without it.
• Attachments: if a file is attached to a report, we store it as sent. Attachments are the reporter's own content.

Context collected with a report

Comment keeps a bounded list of context while the reporter has the panel open. If the site owner enables context replay, this also includes a short rolling window before the panel was opened. The list contains:

• Clicks: the same role, tag, accessible name and coarse geometry described above. Pointer paths and pixel trails are not collected.
• Route changes: origin and path only, without the query string.
• Console errors and warnings: rendered to text and truncated. An Error contributes its name and message. Every other object contributes a type marker, such as [object], rather than its contents. Stack traces are not kept.
• Failed network requests: the method, status code and URL reduced to origin and path. Request and response bodies and headers are never collected.
• Spam signal: counts and coarse timing, including the number of keystrokes, amount of pointer movement and time taken to complete the form. The signal does not include which keys were pressed, the text entered or where the pointer moved. An open-source bot-detection library also runs in the browser. We serve it from our own origin with its telemetry switched off. It reports nothing to its vendor.

Data Comment never captures

• Video or screen recording of the page, or anything outside the browser tab.
• Page text as text. Visible page text can appear as pixels in a screenshot image.
• Keystrokes or typed input, including anything typed into the site's own forms.
• Pointer paths or mouse-movement trails.
• URL query strings or fragments.
• Request or response bodies.
• Request headers or cookies.
• The contents of password, payment or any other input field.
• Anything outside the capture window.

Data added by the customer's website

A website that installs Comment may attach up to 20 metadata values to a session, such as a build revision, plan name or feature flag. It may also identify the visitor through the reserved keys user.id, user.email and user.name. The site owner chooses whether to add this data and is responsible for disclosing it. We reject any key that looks like a credential, including password, token, secret, authorization and cookie.

IP addresses and security logs

We do not attach IP addresses to reports. We use them in memory to rate-limit public endpoints. We record an IP address in a security log when a request is refused or rate-limited, such as for a wrong origin, an invalid review link or a flood of requests. The log contains only identifiers and coarse context, without content.

Security-log rows are not yet covered by the automatic retention purge. They persist until deleted by hand. We will remove them on request.

Redaction before storage

Captured context is scanned before storage. Email addresses, JSON web tokens, payment card numbers and well-known API-key formats are replaced in place with a label such as [redacted:email]. A workspace can add its own deny-terms. The report records that a value was removed and which rule removed it, but never the value itself.

The reporter's message is kept exactly as written. Detections in the message are counted and flagged for the team; the message is not edited.

Redaction does not reach the screenshot or other attachments. Other page text that is visible in the screenshot appears as pixels, which the redaction rules cannot scan.

Cookies and local storage in the widget

The widget sets no cookies on the site where it runs. It uses the browser's local storage for preferences about how marks look, panel size and any sticky notes the reporter leaves for themselves. These stay on the device. Sticky notes are never sent to us.

Capture notice and consent

Reporters can see that capture is active before sending anything and can close the panel to stop it. Comment does not ask visitors to agree to terms. The site that installs it is responsible for whatever notice or consent its own law requires.

Retention, deletion and export of product data

Workspace owners set the retention window for their capture data. By default, it is kept until they delete it. Session erasure and full workspace export are available through the API and on request by email. The security page describes which processes are automated and which are performed by hand.

Data locations and international transfers

The application, database and uploaded files are hosted in the United States, in DigitalOcean's San Francisco region. The marketing site and early-access list are on Cloudflare, which serves from its worldwide network. The Google copy of the early-access list is held on Google's infrastructure.

There is no EU region and no data-residency option. For customers in the EU or the UK, we offer Standard Contractual Clauses as part of the data processing agreement. These make the transfer lawful while the infrastructure is US-only.

Your data protection rights

If you are in the EU, the UK or a US state with a comparable law, you can request a copy of your data, correction or deletion, object to a use, or complain to your supervisory authority. Email privacy@commentunderscore.com. We will respond within a month.

For reports submitted on a customer's website, contact that company first. We will help it respond to your request and act on its instructions.

Children

Comment is a tool for people who run websites. It is not directed at children, and we do not knowingly collect data from them.

Changes to this notice

When this notice changes materially, we will update the date at the top. We will notify customers with an account by email before the change takes effect.