Privacy notice

Last updated 11 September 2026.

Comment exists because the usual way to report a bug — take a picture of the whole screen and send it — collects far more than anyone needed. This page says exactly what we do collect instead, who else sees it, where it sits, and how to get it removed.

Two different situations

They have different answers, so this page keeps them apart. In the first we decide what happens to your data. In the second our customer does, and we act on their instructions.

1. You used this website. You read commentunderscore.com, or you asked for early access. Here we are the controller.
2. You reported a problem on somebody else's website. A company installed Comment and you clicked their feedback button. Here that company is the controller and we are their processor. Their privacy notice governs; ours describes the mechanics.

1. This website, and the early-access form

What we collect

• The email address you type into the early-access form, and the optional free-text "your website" field, if you fill it in.
• The time you submitted it, and the country your request came from.
• A short-lived hash of your IP address, salted with the date, used only to count submissions per network so the form cannot be flooded. It is not stored alongside your address, it cannot be reversed into an IP, and it expires after an hour.

Our hosting provider (Cloudflare) sees the IP address of every request to this site as a normal part of routing and abuse prevention, and keeps its own logs. We do not have a separate copy of them.

What this site does not do

• It sets no cookies and uses no local storage.
• It runs no analytics, no advertising pixels, and no third-party scripts. Its Content-Security-Policy refuses them, so a tracker cannot be added by accident.
• It does not profile you, and there is no automated decision-making.

Why, and on what basis

To reply to you about early access — nothing else. You asked us to get in touch, which is your consent (GDPR Art 6(1)(a)); you can withdraw it at any time and we will delete the entry. We do not sell the list, rent it, or use it for unrelated marketing.

Who else receives it

• Cloudflare serves this page and stores the signup list in its key-value store.
• Google receives a copy of your address and the website field, because the form also writes into a Google Form so the list lands in a spreadsheet with an email alert. This copy is made from our server, not from your browser — Google does not run any code on this page and cannot see your visit.

The full list, including the services behind the product itself, is on the subprocessors page.

How long we keep it

Until early access ends and we no longer need to contact you, or until you ask us to remove you — whichever comes first. Ask at privacy@commentunderscore.com and we will delete the entry from both the store and the spreadsheet.

2. The product: what the widget captures

This is the part worth reading closely, because it is the part everyone assumes. Comment takes no screenshot and reads no page text. What follows is the complete list, and each line matches what the capture code actually does.

When someone files a report

• The message they typed into the feedback box, up to 4,000 characters, stored as written. This is the one piece of free text in the system, and it is theirs.
• The page address, without the query string or the fragment. Everything after ? or # is dropped in the browser, before anything is sent.
• A description of the element they marked: its ARIA role, its tag name, and its accessible name, truncated to 80 characters. The accessible name comes from labels — aria-label, an associated <label>, image alt text, or the visible text of a link or button. The value of an input, a placeholder, and a title attribute are never read.
• A structural selector made of tag names and positions only (form > button:nth-of-type(2)). No ids, classes, attribute values, or text, any of which can carry personal data.
• Coarse geometry: where the mark sits as whole-number percentages of the viewport, plus the viewport's width and height in pixels.
• The markup they drew — pin, area, and freehand strokes — stored as vectors with the colour they chose. Never as an image.
• A file, only if they attach one themselves. If a reporter chooses to take a screenshot and upload it, we store the file they picked. That is their decision and their content; our code still never reads a pixel of the page.

The context around the report

While the reporter has the panel open — and, if the site's owner turns on context replay, a short rolling window from before they opened it — Comment keeps a bounded list of:

• Clicks, reduced to the same role / tag / accessible name / coarse geometry described above. Not the pointer path, not the pixel trail.
• Route changes, as origin and path only, again without the query string.
• Console errors and warnings, rendered to text and truncated. An Error contributes its name and message; every other object contributes a type marker such as [object] rather than its contents. Stack traces are not kept.
• Failed network requests: method, status code, and the URL cut back to origin and path. Never the request or response body, and never headers.
• A spam signal made of counts and coarse timing — how many keystrokes, how much pointer movement, how long the form took. Not which keys, not the text, not where the pointer went. An open-source bot-detection library also runs in the browser; we serve it from our own origin and its own telemetry is switched off, so it reports nothing to its vendor.

What Comment never captures

• Page pixels, screenshots, or video of the page.
• A copy of the page's text.
• Keystrokes or typed input — including anything typed into the site's own forms.
• Pointer paths or mouse-movement trails.
• URL query strings or fragments.
• Request or response bodies.
• Request headers or cookies.
• The contents of password, payment, or any other input field.
• Anything at all outside the capture window.

What the customer's own site can add

A site that installs Comment may attach up to 20 metadata values to a session — things like a build revision, a plan name, or a feature flag. It may also identify the visitor through the reserved keys user.id, user.email and user.name. That is the site owner's choice and their responsibility to disclose; we refuse any key that looks like a credential (password, token, secret, authorization, cookie).

IP addresses

We do not attach an IP address to a report. We use it in memory to rate-limit public endpoints, and we record it in a security log when a request is refused or rate-limited — a wrong origin, an invalid review link, a flood. That log is deliberately content-free: identifiers and coarse context only.

Being straight about a limit: those security-log rows are not yet covered by the automatic retention purge, so today they persist until deleted by hand. Ask us and we will remove them.

Redaction before storage

Captured context is scanned before it is stored. Email addresses, JSON web tokens, payment card numbers, and well-known API-key formats are replaced in place with a label such as [redacted:email], and a workspace can add its own deny-terms. The report records that something was removed and which rule removed it — never the value itself.

The reporter's own message is treated differently: it is kept exactly as written, and detections against it are counted and flagged for the team rather than silently editing what a person said.

Storage in the visitor's own browser

The widget sets no cookies on the site it runs on. It does keep a few preferences in that browser's local storage — how marks should look, the panel size, and any sticky notes the reporter left for themselves. Those stay on the device; the notes in particular are never sent to us.

Telling visitors it is running

The reporter can see that capture is active before they send anything, and can close the panel to stop it. Comment does not ask a visitor to agree to terms; the site that installs it is responsible for whatever notice or consent its own law requires.

Where your data is

The United States. The application, the database, and uploaded files run in DigitalOcean's San Francisco region. The marketing site and the early-access list are on Cloudflare, which serves from its network worldwide. The Google copy of the early-access list is held on Google's infrastructure.

There is no EU region and no data-residency option, and we are not going to pretend otherwise. For customers in the EU or the UK we offer Standard Contractual Clauses as part of the data processing agreement, which is what makes the transfer lawful while the infrastructure is US-only.

How long product data is kept

A workspace owner sets the retention window for their own capture data; the default is to keep it until they delete it. Erasure of a session, and a full export of a workspace, are available today through the API and on request by email. See the security page for what is automated and what is still done by hand.

Your rights

If you are in the EU, the UK, or a US state with a comparable law, you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to a use, or complain to your supervisory authority. Write to privacy@commentunderscore.com and we will answer within a month.

If you reported a problem on somebody else's website, ask them first — they decide what happens to that report. We will help them answer you, and we will act on their instruction rather than going around them.

Children

Comment is a tool for people who run websites. It is not directed at children and we do not knowingly collect data from them.

Changes

When this notice changes materially we will change the date at the top and, for customers with an account, say so by email before it takes effect.