Legal

Privacy Policy

Last updated: July 21, 2026

1. Overview and Data Controller

This Privacy Policy describes how commentable <html> (“commentable”, “we”, “us”, “our”), the operator of html.commentable.link, collects, uses, stores, and shares your personal data, and explains the rights you have over it.

Data Controller: The data controller for personal data processed through this Service is the individual operator of commentable, located in Israel. Israel has been recognised by the European Commission as providing an adequate level of data protection for the purposes of GDPR (adequacy decision). For all data-related enquiries, use our contact form. A Data Protection Officer has not been appointed as the operator does not meet the thresholds requiring mandatory DPO designation under GDPR Article 37.

We have designed this Service with privacy as a core architectural constraint. The most sensitive data you provide — your HTML content — is encrypted in your browser before it leaves your device. We are technically incapable of reading it under normal operation (see Section 3 for scope and limitations).

TL;DR

✓Your HTML content is encrypted client-side. We cannot read it under normal operation (one exception for the MCP/Claude connector — see Section 3).
✓We store your email address for passwordless authentication and service emails.
✓Comments are stored unencrypted — do not include sensitive data in comments.
✓Paid plans: payments are handled by Polar; we never see your full card details.
✓Branding you upload (logo, name, colors) is stored unencrypted and shown publicly on your pages.
✓IP addresses are captured in server logs by our providers. Product analytics are first-party and anonymous — aggregate event counts only, no third-party trackers.
✓We do not sell, share for advertising, or trade your personal data.
✓Sub-processors: Supabase (database/auth), Vercel (hosting/domains), Resend (email), Polar (payments).

2. Personal Data We Collect

2.1 Account Information

To publish pages you must create an account. We collect your email address, used to send passwordless sign-in links and service-related emails (such as notifications when someone comments on your page). We do not collect your name or phone number.

2.2 Payment Information (paid plans)

If you subscribe to a paid plan, payment is processed by our payment provider, Polar. We do not collect or store your full payment-card details. We store only a customer/subscription identifier, your plan, and its renewal date, which we use to determine your access to paid features. See Polar's privacy policy for how they handle payment data.

2.3 Branding and Custom Domain Data (paid plans)

If you configure branding, we store the business name, colors, and any logo you upload, and — if you connect one — your custom domain name. Unlike your HTML content, this data is not encrypted: logos are stored in a public storage bucket and branding is served publicly so it can appear on your shared pages. Do not upload anything here you do not want to be public.

2.4 API Keys

If you create an API key (for example, to publish via the Claude connector), we store only a one-way hash of the key plus a label and usage timestamps — never the key itself after it is first shown to you.

2.5 Artifact Metadata

When you publish an HTML page or PDF, we store in our database:

A randomly generated URL slug (e.g. k3mX9pQr)
The optional title you provide
Your encrypted HTML content — an opaque AES-256-GCM ciphertext (see Section 3)
Visibility setting (unlisted or public)
Optional expiration timestamp
A PBKDF2-SHA256 hash of any page password you set — never the password in plaintext
Your user ID (linked to your email)
Creation timestamp

2.6 Comment Data

Anyone with a page link may leave comments without creating an account. When a comment is submitted, we store the commenter's chosen display name, comment text, pin coordinates, timestamp, and the associated artifact ID.

Comments are not encrypted and are readable by us. Do not include sensitive personal data in comments.

2.7 IP Addresses and Server Logs

Every HTTP request — including page views, comment submissions, and contact form submissions — is processed by our hosting provider (Vercel) and database provider (Supabase), both of which capture standard server logs containing IP addresses, browser user-agent strings, referring URLs, and request timestamps. This applies to registered users, anonymous visitors, and commenters alike.

We do not routinely access these logs; they are retained and used only for debugging, fraud prevention, and service security.

Product analytics are first-party and anonymous: our own servers count aggregate events (page views, button clicks, publish counts) with no user identifier, no IP address, and no cookie attached. These counters cannot be tied to a person and are used solely to understand which features are used. We do not operate third-party analytics, tracking pixels, or behavioural advertising SDKs.

Link view counts: so a link's owner can tell whether recipients opened it, we record an anonymous count of opens. When a page is opened we store only a random token generated in that browser (in its localStorage) — never an IP address, user-agent, cookie, or anything identifying the person. The owner sees how many opens and how manydistinct browsers, and can never see who. Owners' own opens are not counted. You can clear the token any time via your browser storage.

2.8 Cookies and Browser Storage

We use a first-party authentication cookie set by Supabase (sb-<project-ref>-auth-token), a strictly necessary, HttpOnly session cookie. No consent is required for strictly necessary cookies under the EU ePrivacy Directive; you can delete it at any time through your browser settings, which will sign you out.

We store one item in your browser's localStorage per page you publish: the full share URL including the decryption key fragment. This data never leaves your device. It is not a cookie and is not subject to cookie consent rules.

If you start creating a page before signing in, your draft HTML is kept temporarily in your browser's localStorage (pending:publish) so it survives the sign-in step. The draft exists only on your device — it is never transmitted to us unencrypted — and is deleted automatically when the page is published, or whenever you clear your browser's site data.

Do Not Track / Global Privacy Control: We do not engage in cross-site tracking or behavioural advertising. Our Service responds to DNT and GPC signals by confirmation of our existing practice — no tracking occurs regardless of signal.

3. End-to-End Encryption — Scope and Limitations

When you publish an HTML page, your browser generates a random AES-256-GCM key, encrypts your HTML content locally, and transmits only the resulting ciphertext to our servers. The decryption key is appended to the share URL as a #fragment.

URL fragments are not transmitted to HTTP servers — they remain in the browser. Under normal operation:

We cannot read, search, or share the contents of your HTML pages.
A breach of our database would expose only meaningless ciphertext.
We cannot produce your HTML content in response to legal requests because we do not hold the decryption key.
If you lose the full URL (including the #key=… fragment), the content is cryptographically unrecoverable.

Limitations: This guarantee would not apply if: (a) a court required us to modify client-side code to intercept keys; (b) a browser extension or network attacker intercepted the key before encryption; or (c) your device was already compromised. If you require absolute confidentiality against legal compulsion, consider self-hosting.

Exception — MCP / Claude connector: The guarantee above describes pages you create at html.commentable.link in your browser. Pages published or updated through our MCP API (the Claude connector) work differently: because the connecting application cannot perform browser-based encryption itself, your HTML content — and, when updating an existing page, its decryption key — is sent to our server, which performs the encryption there instead. That content and key are held only in memory for the duration of the request; they are never logged, cached, or written to disk, and our database still stores only the resulting ciphertext, exactly as with the browser flow. If you need the stronger guarantee that content and key never reach our servers at all, publish directly at html.commentable.link instead of through the connector.

Key backup (on by default): So that your dashboard can open your own links from any device, the page key is stored in our database wrapped under a per-account key, which is itself encrypted with a server-held secret. Stored keys are used for exactly one purpose: producing your own share links, for you, after you sign in — they are never used to read page content on our side, and the wrapped values are inaccessible to other users and to unauthenticated database roles. If you prefer that we hold no key material at all, switch to zero-knowledge mode in Settings (per account, with an option to delete already-stored keys) or untick key backup for an individual link when publishing. In zero-knowledge mode the bullets above apply without qualification — including that a lost link is unrecoverable.

4. How We Use Your Personal Data

Email address — Sending passwordless sign-in links and, if you enable them, notifications when someone comments on your page (contractual necessity).
Artifact metadata — Storing, retrieving, and displaying your published pages (contractual necessity).
Comment data — Displaying feedback threads (contractual necessity).
Payment and subscription data — Processing payments through Polar and granting access to paid features (contractual necessity).
Branding, domain, and API-key data — Applying your branding to shared pages, routing your custom domain, and authenticating programmatic publishing (contractual necessity).
IP addresses / server logs — Service reliability, debugging, and abuse prevention (legitimate interest). We access these logs only reactively and do not build profiles from them.

We do not use your data to train machine-learning models, serve advertisements, build behavioural profiles, or for any purpose incompatible with those listed above.

6. Retention Periods

Artifacts: Retained until deleted by you, or until the expiration date you set.
Comments: Retained for as long as the associated artifact exists; deleted when the artifact is deleted.
Email address / account: Retained until you request account deletion via our contact form.
Branding, custom domain, and API keys: Retained until you remove them or close your account.
Subscription records: Retained while your subscription is active and afterwards as needed for tax, accounting, and legal obligations.
IP addresses / server logs: Retained by Vercel and Supabase per their own policies (typically 30–90 days). We do not maintain a separate copy.
Draft pages (before sign-in): Stored only in your own browser's localStorage, never on our servers; deleted automatically on publish or when you clear your browser's site data.

7. Your Rights

All users

You may request access to, correction of, or deletion of personal data we hold about you via our contact form. We will respond in accordance with applicable law.

EU / EEA / UK residents (GDPR / UK GDPR)

You have the following rights:

Access (Art. 15) — obtain a copy of the personal data we hold about you.
Rectification (Art. 16) — correct inaccurate or incomplete data.
Erasure (Art. 17) — request deletion of your data, subject to legal retention obligations.
Restriction (Art. 18) — restrict our processing while a dispute is resolved.
Portability (Art. 20) — receive your personal data in a structured, machine-readable format (JSON).
Object (Art. 21) — object to processing based on legitimate interest. We will cease processing unless we can demonstrate compelling legitimate grounds.
Withdraw consent — where we rely on consent, withdraw it at any time without affecting prior lawful processing.

You may also lodge a complaint with your local supervisory authority. In the EU, find your authority at edpb.europa.eu. In the UK, contact the ICO. In Israel, contact the Privacy Protection Authority.

California residents (CCPA / CPRA)

We do not sell or share personal information for cross-context behavioural advertising. You have the right to know, delete, correct, and opt out of sale (not applicable). We do not discriminate against users who exercise these rights. Submit requests via our contact form.

Israeli residents (Privacy Protection Law 5741-1981)

You have the right to access personal information we hold about you and to request its correction. Requests may be submitted via our contact form.

8. Security Measures

We apply the following technical safeguards:

AES-256-GCM client-side encryption for all HTML content
HTTPS (TLS 1.2 minimum) for all connections
PBKDF2-SHA256 (100,000 iterations) for page password hashing
Row-level security (RLS) policies at the database layer
No third-party scripts loaded on artifact view pages
Sandboxed iframe rendering (null-origin) for all published HTML

No system is perfectly secure. In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify the relevant supervisory authority as required by applicable law, and will notify affected individuals where required.

9. Children's Privacy

The Service is not directed to children under the age of 13 (or 16 in the EU/EEA). We do not knowingly collect personal data from children below these ages. If you believe a child has provided us with personal data without appropriate consent, contact us via our contact form and we will delete the data promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date above. Your continued use of the Service after any changes constitutes acceptance. If you do not accept the changes, you may request account deletion via our contact form.

11. Contact and Complaints

For all privacy-related questions, data subject requests, or to exercise any right listed in Section 7, use our contact form or email us at support@commentable.link.

If you are unsatisfied with our response, you have the right to lodge a complaint with your national supervisory authority (see Section 7 for authority links).