Privacy Policy

DRAFT — NOT FOR ASSENT. This document incorporates the owner's approved U.S.-only, age, and jurisdiction-neutral rights posture, but it is not legal advice or evidence of legal review. Its effective date, verified privacy contact, and deployment inventory remain release gates.

Policy Version: public-beta-v1-draft.2

Effective Date: PENDING_RELEASE_APPROVAL

Last Updated: 2026-09-02

Contracting Entity: PENDING_CONTRACTING_ENTITY_VERIFICATION

The entity operating the comentr platform will be identified before release; the field above is an explicit release gate. This Privacy Policy explains what information the service collects, how it is used, and the privacy request options available to users.

This policy applies to the United-States-only Public Beta. The Public Beta is not offered to people located outside the United States. The service commitments below are jurisdiction-neutral; applicable law may provide other rights that this draft does not attempt to enumerate.

1. Information We Collect

1.1. Information You Provide

• Account information — email address, username, password (stored hashed, never in plaintext), and any optional profile details you choose to add.
• Content and media — threads, comments, votes, and uploaded media or other content you provide through the platform.
• Communications — messages you send through Mod Mail, appeals, or reports.

1.2. Information Generated by Your Use

• Standing and reputation data — Global Standing, Local Standing, Standing Tier, and related scores computed from your activity.
• Reporter Reliability Score — derived from the accuracy of reports you file. This score is internal and not publicly visible.
• View events — aggregated by country and time to surface trending content. We do not maintain a persistent log of which specific threads you visited.
• Moderation records — reports, enforcement actions, sanctions, and appeals. Only a sanitized, community-scoped subset of moderation actions is anonymously readable; actor- and target-oriented records remain moderator-only.

1.3. Information Collected Automatically

• Log data — production application and infrastructure logs may contain IP addresses and request, browser, operating-system, referral, and timestamp metadata used for security and debugging. The repository-configured production OpenObserve retention target is 14 days (ZO_COMPACT_DATA_RETENTION_DAYS=14). That desired-state value does not prove the active service setting; a live release-deployment readback must confirm the effective application and infrastructure log duration. This remains a PENDING_PRODUCTION_LOG_RETENTION_VERIFICATION release gate.

Production Log Retention: PENDING_PRODUCTION_LOG_RETENTION_VERIFICATION

• Device identifiers — used for the Immune System (account compromise detection) and to enforce suspensions. These are hashed and not linked to advertising profiles.

1.4. Automated Bot-Detection Signals

To protect the platform from automated abuse — spam, scripted account creation, credential stuffing, and ban evasion — we use Cloudflare bot-management features and Cloudflare Turnstile (a human-verification challenge). To distinguish automated traffic from legitimate users, the following signals are processed:

• Network signals — IP address, autonomous system number (ASN), and approximate country.
• Connection signals — TLS/connection fingerprint.
• Behavioral signals — request timing, velocity, and patterns consistent with automated tooling.

Cloudflare processes these signals at the network edge as our service provider (see §3.2). The application does not persist raw IP addresses in its abuse graph; it stores a one-way IP hash and short-lived network metadata. The exact application-side classes are listed in §4. Cloudflare's own processing follows the security features actually enabled in the launch deployment and must be verified against that deployment before release.

1.5. Information We Do NOT Collect

• We do not use advertising trackers or sell data to advertisers.
• We do not use third-party analytics that track individual users across sites.
• We do not collect biometric data.

1.6. Do Not Track and Cross-Site Collection

Comentr does not change its behavior in response to a browser Do Not Track (DNT) signal because the service does not use cross-site advertising or analytics trackers. Operational processing needed for security, account features, and the providers described in §3.2 continues whether or not a browser sends DNT.

Comentr does not use or permit third parties to collect data through the service about a user's online activities over time and across unrelated websites for behavioral advertising or profiling. We do not receive or use cross-site advertising profiles. This statement does not turn off the operational provider processing and strictly necessary security cookies described in this policy.

2. How We Use Your Information

We use your information for the following purposes:

We do not use your information for:

• Targeted advertising.
• Sale to third parties.
• Automated decision-making with legal or similarly significant effects, except as described in this policy (e.g., Standing-based feature gating and automated abuse prevention, described below).

Automated abuse prevention. Our abuse systems score each request for risk. For the small fraction of requests that match high-confidence abuse signals, a request may be blocked automatically. For ambiguous "might be abuse" signals, we instead present a human-verification challenge (Turnstile) rather than blocking you — the challenge is a deliberate safeguard that prevents legitimate users from being hard-blocked on probabilistic signals. If you believe an automated decision was made in error, you may contest it through the route identified in the released policy. That route is a CONTACT CHANNEL PENDING VERIFICATION release gate.

3. How We Share Your Information

3.1. Public by Design

Content you post (threads, comments) and your public profile are visible to other users. A sanitized subset of community moderation actions is anonymously readable in a community-scoped log; internal records are not public. Community Handles are public within their respective communities.

3.2. Service Providers

The checked-in Public Beta topology and configuration identify the following provider roles. Release must verify that the deployed inventory matches this table; a provider may not be enabled silently.

The reviewed Anvil successor projects a 600-second k3s service-account token, exchanges it with AWS STS, and requests a 2,700-second role session. Cloudflare hosts only the public discovery document and JWKS; the private signing key stays in k3s. The repository hold anvil-ses-web-identity-v1 remains active, so the current deployed Anvil remains held on the static-credential path until a separately authorized live proof and receipt-correct cutover. Release must verify which credential path is actually deployed rather than inferring it from the landed repository implementation.

The optional Anthropic-backed Curator AI integration is disabled by the checked-in default. It must not be enabled for Public Beta unless its data flow and retention are approved and the launch runtime inventory is re-verified. Cassandra, Redis, Meilisearch, and OpenObserve are self-hosted components in the target topology, not separate third-party processors.

3.3. Legal Requirements

We may disclose your information if required by law, subpoena, court order, or governmental request. Where legally permitted, we will notify you before doing so.

3.4. Business Transfers

If comentr is acquired, merged, or sells substantially all of its assets, your information may be transferred as part of that transaction. We will notify you via email and/or an in-platform banner before your information becomes subject to a different privacy policy.

3.5. No Sale of Personal Data

We do not sell your personal information. We do not share your personal information with third parties for their own marketing purposes.

4. Data Retention

After the recovery deadline, terminal erasure scrubs optional account identity and profile data, standing and reliability data, and the social graph. Every canonical user counter is removed rather than retained as a zero-valued row. The application-managed WAL and snapshot limits above do not claim forensic removal from operator-managed storage, and the cross-recipient digest reference is an explicit remaining gap. In the current storage model, required username and thread-title residue remains in non-public terminal rows. Authored threads and comments are hard-removed with comment bodies and author linkage cleared; thread bodies, URLs, and author linkage are cleared while the required title remains. They are not retained publicly under a generic deleted-user identity. Delivered direct-message bodies remain available to a surviving participant, but attribution to the erased account is removed. User-owned uploaded-media objects are deleted; community- or forum-owned objects remain available but their uploader attribution is removed. The completed erasure ledger is retained internally, but that ledger alone does not make a backup restore safe. Release requires a separately retained erasure record and a fail-closed restore/replay fence that reapplies completed erasures before restored data can be served. This is a PENDING_BACKUP_RESTORE_ERASURE_FENCE_VERIFICATION release gate.

5. Your Rights

The released policy will provide these jurisdiction-neutral, service-level privacy request options:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate data.
• Deletion — request deletion of your data (subject to legal retention obligations).

Correction and account deletion also have product controls. Access and other contact-based requests depend on the verified route that will appear in the released policy. CONTACT CHANNEL PENDING VERIFICATION: this draft does not represent an email address as a verified inbound or reply-capable privacy contact. Responses will follow applicable requirements; this draft does not promise an unsupported fixed response window.

6. Security

We implement industry-standard technical and organizational measures to protect your data, including:

• Passwords stored using strong one-way hashing (never plaintext).
• TLS protects public traffic to the Cloudflare edge, and Cloudflare Tunnel protects edge-to-origin transport. Traffic from the tunnel connector and internal service-to-service traffic on the private cluster network is currently plaintext rather than mTLS.
• Access controls limiting employee/operator access to personal data.
• Immune System monitoring for account compromise.

No system is perfectly secure. If we discover a breach that affects your personal data, we will notify you and the relevant authorities as required by applicable law.

7. Children's Privacy

The Public Beta is not offered to children under 13, and there is no parent or guardian consent pathway for an under-13 account. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete that information promptly. If you believe a child under 13 has provided us with personal data, please use the verified contact route in the released policy. That route is currently a CONTACT CHANNEL PENDING VERIFICATION release gate.

8. Cookies and Similar Technologies

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. The application uses these functional cookie classes:

Secure transport is required for authentication cookies in the HTTPS deployment. Cloudflare may set strictly necessary security cookies such as __cf_bm when Bot Management is enabled, and cf_clearance after a challenge or when optional Turnstile pre-clearance is enabled. Turnstile does not necessarily set a clearance cookie. The launch release must verify the enabled edge features and their then-current cookie behavior; these security cookies are not used by Comentr for advertising.

9. Changes to This Policy

We may update this Privacy Policy from time to time. A substantive change receives a new immutable policy-bundle version and effective date. Before an updated version governs, it must be connected to the service's versioned notice and assent flow. Server issue #3772 and comentr-web PR #810 have completed the fail-closed assent mechanism. comentr-web issue #615 remains pending for final rendered publication and assent enablement of the released bundle, so PENDING_POLICY_ASSENT_INTEGRATION remains a release gate.

10. Contact

Privacy Contact: PENDING_CONTACT_CHANNEL_VERIFICATION

For questions about this Privacy Policy or to exercise your data rights, use the route that will appear in the released version. CONTACT CHANNEL PENDING VERIFICATION: no email address is represented by this draft as a verified inbound or reply-capable privacy contact.

The contracting entity field at the top of this policy remains a PENDING_CONTRACTING_ENTITY_VERIFICATION release gate.