Privacy Policy

Last updated 23 August 2026

co-mment is a commenting layer that teams install on their own non-production websites, operated by Planetary Corporation. This policy covers co-mment.com, the dashboard, and the widget served from our API, and describes what the service does today.

Who is responsible for what

Two different relationships run through this service, and they have different answers.

Your account. When you sign in as an editor, we decide what to store about you and why. For that data we are the controller, and this policy is the whole story.
Comments on your site. When someone leaves a comment on a site you instrumented, you chose to collect it and you decide who may read it. For that data you are the controller and we process it on your behalf, under your project’s settings. If your own visitors need to be told about it, that notice is yours to give.

What we store about editors

Your email address, and a display name if you set one.
Six-digit sign-in codes, which are single-use and expire ten minutes after they are sent. At most three are issued to one address in ten minutes.
A session record. The browser holds a matching cmt_session cookie, which is HttpOnly and SameSite=Lax, and both expire after 30 days.
Your projects and their settings: names, allowed origins, and members.
If you connect Linear, the API key you paste. It is encrypted before it is stored and it is never sent back to a browser.

What we store about commenters

A commenter has no account. They type a name and an email address once, and from then on the widget knows them by a token kept in that browser. Each comment stores:

The name and email address they entered, and the text they wrote.
The URL and path of the page, and the anchor: a selector chain to the element they pointed at, the click offsets within it, and the first ~80 characters of its text, which is how a pin survives a redeploy.
The reporting environment: viewport width and height, device pixel ratio, scroll position, operating system, browser, and browser version.
A screenshot of the area around the pin, captured in the browser at the moment the comment is written.

Screenshots are stored privately and served only through signed URLs that expire within minutes, to members of the project the comment belongs to.

What we do not do

No analytics, no advertising trackers, no third-party scripts on this site. The only cookie we set is the sign-in session above.
The live demo on our homepage writes nothing to a server. Pins you drop there stay in your own browser’s storage and no other visitor can see them.
We do not sell personal data, and we do not use comment content or screenshots to train models.

Browser storage on your site

The widget keeps a few values in the browser’s localStorage, on the origin it is installed on: the commenter’s token, name, and email; an editor token if one was granted; and the ids of threads that browser has already opened, which is how unread state works. These are readable only by that site, and clearing site data removes them.

Who else sees it

We use these processors to run the service:

Hosting and object storage. The application runs on Vercel, and screenshots are held in Vercel Blob.
The database, a managed Postgres run by Neon, which holds accounts, projects, threads, and comments.
Email delivery. Sign-in codes, reply and mention notifications, and claim links are sent through Resend. They see the recipient address and the message.
Linear, only for projects that connect it, and only for threads an editor pushes. The issue includes the thread’s text and its screenshot.
OpenRouter, only at that same moment: the thread’s text is sent to a small model to write the issue’s one-line title. No screenshot is sent, and nothing is sent for threads that are never pushed.

We also disclose data where the law requires it, and to a buyer if the service changes hands — in which case this policy travels with it.

Server logs and abuse prevention

Requests to the widget API are rate limited per IP address. The address is held in memory for that check and is not stored alongside comments. Our hosting provider keeps ordinary request logs on its own schedule.

How long it is kept

Comments, threads, and screenshots stay until a project member deletes them or the project is deleted. Deleting a message leaves a marker showing that something was removed, without its text.
Sign-in codes: ten minutes. Sessions and editor links: 30 days.
When an account or project is deleted, its data is removed from our live systems straight away and from routine backups within 30 days.

Where it is processed

We are a company in the United States and the service runs there, so your data is stored and processed in the United States by us and by the processors named above. If you are in the UK or the EEA, using the service means your data is transferred there.

Your rights

Depending on where you live, you can ask for a copy of your data, ask us to correct or delete it, or object to how we use it. For comments left on a customer’s site, send the request to that customer — they decide, and we act on their instruction. For anything we hold about you directly, write to legal@planetary.co and we will answer within 30 days.

Children

This is a tool for people building websites. It is not directed at children, and we do not knowingly collect data from anyone under 16.

Changes

If we change this policy we will update the date above, and we will email account holders before anything material takes effect.

Contact

Planetary Corporation, legal@planetary.co.