Privacy Policy
Policy Version: v1
Effective Date: 2026-09-20
Last Updated: 2026-09-20
Contracting Entity: Comentr LLC
Comentr LLC operates the Comentr platform. This Privacy Policy explains what information we collect, how we use it, and the privacy request options available to users.
This policy applies to the United-States-only service. Comentr is not offered to people located outside the United States. The service commitments below are jurisdiction-neutral; applicable law may provide other rights in addition to those described here.
1. Information We Collect
1.1. Information You Provide
- Account information — email address, username, password (stored hashed, never in plaintext), and any optional profile details you choose to add.
- Content and media — threads, comments, votes, and uploaded media or other content you provide through the platform.
- Communications — messages you send through Mod Mail, appeals, or reports.
1.2. Information Generated by Your Use
- Standing and reputation data — Global Standing, Local Standing, Standing Tier, and related scores computed from your activity.
- Reporter Reliability Score — derived from the accuracy of reports you file. This score is internal and not publicly visible.
- View events — aggregated by country and time to surface trending content. We do not maintain a persistent log of which specific threads you visited.
- Moderation records — reports, enforcement actions, sanctions, and appeals. Only a sanitized, community-scoped subset of moderation actions is anonymously readable; actor- and target-oriented records remain moderator-only.
1.3. Information Collected Automatically
- Log data — production application and infrastructure logs may contain IP addresses and request, browser, operating-system, referral, and timestamp metadata used for security and debugging. Application container logs rotate by size: configured to retain five files per container and rotate files at 10 MiB, with rotation checks every 10 seconds. This is a size-based rotation policy, not a fixed retention duration. Other infrastructure logs do not have a fixed deletion period stated in this policy; their lifetime depends on operational rotation and storage limits.
Production Log Retention: Size-based rotation; no fixed time limit
- Device identifiers — used for the Immune System (account compromise detection) and to enforce suspensions. These are hashed and not linked to advertising profiles.
1.4. Automated Bot-Detection Signals
To protect the platform from automated abuse — spam, scripted account creation, credential stuffing, and ban evasion — we use Cloudflare bot-management features and Cloudflare Turnstile (a human-verification challenge). To distinguish automated traffic from legitimate users, the following signals are processed:
- Network signals — IP address, autonomous system number (ASN), and approximate country.
- Connection signals — TLS/connection fingerprint.
- Behavioral signals — request timing, velocity, and patterns consistent with automated tooling.
Cloudflare processes these signals at the network edge as our service provider (see §3.2). The application does not persist raw IP addresses in its abuse graph; it stores a one-way IP hash and short-lived network metadata. The exact application-side classes are listed in §4. Cloudflare's own processing follows the security features enabled for the service.
1.5. Information We Do NOT Collect
- We do not use advertising trackers or sell data to advertisers.
- We do not use third-party analytics that track individual users across sites.
- We do not collect biometric data.
1.6. Do Not Track and Cross-Site Collection
Comentr does not change its behavior in response to a browser Do Not Track
(DNT) signal because the service does not use cross-site advertising or
analytics trackers. Operational processing needed for security, account
features, and the providers described in §3.2 continues whether or not a
browser sends DNT.
Comentr does not use or permit third parties to collect data through the service about a user's online activities over time and across unrelated websites for behavioral advertising or profiling. We do not receive or use cross-site advertising profiles. This statement does not turn off the operational provider processing and strictly necessary security cookies described in this policy.
2. How We Use Your Information
We use your information for the following purposes:
| Purpose | Why it is necessary |
|---|---|
| Operate your account and deliver the service | Provide the features you request |
| Detect abuse, spam, and compromised accounts (Immune System) | Protect users and platform integrity |
| Operate automated bot detection and human-verification challenges (Cloudflare bot management, Turnstile) | Prevent automated abuse while allowing human review/challenge paths |
| Compute Standing, reputation, and reliability scores | Operate participation and moderation features |
| Aggregate view counts and trending content | Operate aggregate service analytics |
| Enforce System Rules and Community Rules | Apply the service's safety rules |
| Comply with court orders, governmental requests, and other applicable requirements | Meet legal obligations |
| Send service-critical notifications (e.g., Terms changes, security alerts) | Communicate about the service and account security |
We do not use your information for:
- Targeted advertising.
- Sale to third parties.
- Automated decision-making with legal or similarly significant effects, except as described in this policy (e.g., Standing-based feature gating and automated abuse prevention, described below).
Automated abuse prevention. Our abuse systems score each request for risk. For the small fraction of requests that match high-confidence abuse signals, a request may be blocked automatically. For ambiguous "might be abuse" signals, we instead present a human-verification challenge (Turnstile) rather than blocking you — the challenge is a deliberate safeguard that prevents legitimate users from being hard-blocked on probabilistic signals. If you believe an automated decision was made in error, contact [email protected] to contest it.
3. How We Share Your Information
3.1. Public by Design
Content you post (threads, comments) and your public profile are visible to other users. A sanitized subset of community moderation actions is anonymously readable in a community-scoped log; internal records are not public. Community Handles are public within their respective communities.
3.2. Service Providers
The following providers support the service:
| Provider | Purpose | Data involved |
|---|---|---|
| Cloudflare | Website delivery, secure network transport, abuse protection, Turnstile challenges, and media storage | Requests, security signals, uploaded media, and public service-identity metadata |
| Cherry Servers | Origin compute in Chicago, Illinois | Service traffic and stored application data on the origin |
| Amazon Web Services (SES and STS) | Authentication and service-notification email and workload identity for email delivery | Recipient addresses, message content and metadata, and service workload-identity information |
| Anthropic | Curator-assisted classification, summaries, and source screening of linked source articles | Source article text submitted for processing and generated classifications, summaries, and screening results |
The production email service is configured to use workload identity for Amazon SES email delivery. Workload-identity information identifies the service rather than a user.
Curator uses Anthropic to assist with classification, summaries, and source screening of linked source articles. Candidate articles may enter an operator review queue; fetching or classifying an article does not mean it will be published. Cassandra, Redis, and Meilisearch are self-hosted components rather than separate third-party processors.
3.3. Legal Requirements
We may disclose your information if required by law, subpoena, court order, or governmental request. Where legally permitted, we will notify you before doing so.
3.4. Business Transfers
If comentr is acquired, merged, or sells substantially
all of its assets, your information may be transferred as
part of that transaction. We will notify you via email
and/or an in-platform banner before your information
becomes subject to a different privacy policy.
3.5. No Sale of Personal Data
We do not sell your personal information. We do not share your personal information with third parties for their own marketing purposes.
4. Data Retention
| Data class | Retention |
|---|---|
| Account identity, credentials, profile, standing, reliability score, social graph, and authored content after a deletion request | Kept during the exact 30-day recovery window; terminal erasure begins when the deadline expires |
| Authentication sessions and sign-in contexts | At most 37 days by storage TTL, and revoked earlier when the session or account state requires it |
| Authentication audit events | 365 days by storage TTL |
| Production application and infrastructure logs | Application container logs are configured to retain five files per container and rotate files at 10 MiB, checked every 10 seconds; these are rotation targets, not a guaranteed size ceiling or fixed retention duration. Other infrastructure logs have no fixed deletion period stated in this policy; their lifetime depends on operational rotation and storage limits. |
| Per-visitor thread-view deduplication signal | 24 hours; no per-user or raw-IP view history is persisted |
| Aggregate thread-view counts by country | 90 days; all-time aggregate thread-view totals have no automatic expiry |
| Abuse IP/network metadata | 24 hours |
| Abuse cluster classification metadata | No automatic expiration in the checked-in schema |
| Transient abuse-cluster cardinality signal | 7 days |
| Abuse identity graph and canonical account/IP projections | 365 days |
| Ranked account/IP association publication metadata, pages, and computed counts | 6 days, 7 days, and 3 hours, respectively |
| Cluster/fingerprint penalty ledgers and positive-signal ledger | 180 days |
| Moderator penalty-rate rows | 30 days |
| Moderation records and completed erasure ledger | No automatic expiration; access is limited by role and only the sanitized community-scoped log is anonymously readable |
| Erased-subject state in Tally WAL and Hopper snapshot artifacts | Normally removed within 24 hours while the service is healthy, or before serving after the next start; Tally's active tail WAL may retain semantically void pre-erasure bytes longer, but the durable erase record prevents replay |
| Erased actor identifiers in other recipients' Hopper digest state | No implemented retention bound; recipient-scoped erasure does not yet scrub every actor reference held in another recipient's digest state |
| User-initiated soft-deleted comments | Indefinite; the current product retains the non-public soft-deleted row unless a later compliance-erasure path scrubs it |
| Hidden threads | Indefinite in the current HIDDEN state unless a later terminal-erasure path scrubs user-linked fields |
| Retracted notifications | Indefinite; retraction changes delivery state but has no automatic storage expiry |
| Delivered direct messages | Indefinite; when a participant reaches terminal erasure, attribution to that participant is scrubbed while the surviving participant keeps the delivered body |
| Uploaded media at terminal account erasure | User-owned objects are deleted; community- or forum-owned objects are retained while their uploader attribution is removed |
After the recovery deadline, terminal erasure scrubs optional account identity and profile data, standing and reliability data, and the social graph. Every canonical user counter is removed rather than retained as a zero-valued row. The application-managed WAL and snapshot limits above do not claim forensic removal from operator-managed storage, and the cross-recipient digest reference is an explicit remaining gap. In the current storage model, required username and thread-title residue remains in non-public terminal rows. Authored threads and comments are hard-removed with comment bodies and author linkage cleared; thread bodies, URLs, and author linkage are cleared while the required title remains. They are not retained publicly under a generic deleted-user identity. Delivered direct-message bodies remain available to a surviving participant, but attribution to the erased account is removed. User-owned uploaded-media objects are deleted; community- or forum-owned objects remain available but their uploader attribution is removed. The completed erasure ledger is retained internally. Backup copies may retain information until removed under the applicable backup retention policy. Deletion from the live service does not imply immediate removal from every backup or recovery artifact. No fixed backup deletion period is promised by this policy.
5. Your Rights
We provide these jurisdiction-neutral, service-level privacy request options:
- Access — request a copy of the personal data we hold about you.
- Correction — request correction of inaccurate data.
- Deletion — request deletion of your data (subject to legal retention obligations).
Correction and account deletion also have product controls. To request access or exercise another privacy request option, contact [email protected]. We will respond as required by applicable law.
6. Security
We implement industry-standard technical and organizational measures to protect your data, including:
- Passwords stored using strong one-way hashing (never plaintext).
- TLS protects public traffic to the Cloudflare edge, and Cloudflare Tunnel protects edge-to-origin transport. Traffic from the tunnel connector and internal service-to-service traffic on the private cluster network is currently plaintext rather than mTLS.
- Access controls limiting employee/operator access to personal data.
- Immune System monitoring for account compromise.
No system is perfectly secure. If we discover a breach that affects your personal data, we will notify you and the relevant authorities as required by applicable law.
7. Children's Privacy
The service is not offered to children under 13, and there is no parent or guardian consent pathway for an under-13 account. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete that information promptly. If you believe a child under 13 has provided us with personal data, contact [email protected].
8. Cookies and Similar Technologies
We do not use advertising cookies, tracking pixels, or third-party analytics cookies. The application uses these functional cookie classes:
| Cookie(s) | Purpose and duration |
|---|---|
access_token, refresh_token |
Authentication. Remembered sessions use the backend access-token lifetime and a refresh cookie lasting up to 30 days; otherwise these are browser-session cookies. Both are HttpOnly and SameSite=Lax. |
account_recovery_grant, account_recovery_deadline, account_deletion_receipt_deadline |
Account-deletion recovery state, scoped to the recovery route for up to 15 minutes; HttpOnly and SameSite=Strict. |
comentr-appearance, view_mode, pinned_collapsed, forum_panel_closed |
User-requested appearance and layout preferences, each lasting up to 1 year with SameSite=Lax. |
Secure transport is required for authentication cookies in the
HTTPS deployment. Cloudflare may set strictly necessary
security cookies such as __cf_bm when Bot Management is enabled,
and cf_clearance after a challenge or when optional Turnstile
pre-clearance is enabled. Turnstile does not necessarily set a
clearance cookie. These security cookies are not used by Comentr for
advertising.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Each substantive change receives a new policy version and effective date, shown on this page. Account creation requires explicit agreement to the current policy bundle. We will provide notice of material changes as required by applicable law.
10. Contact
Privacy Contact: mailto:[email protected]
For questions about this Privacy Policy or to exercise your data rights, contact Comentr LLC at [email protected].