Security

Comment Coach takes the security of your data seriously. This page describes the measures we use to protect your information.

1. Encryption

Field-Level Encryption at Rest

Every comment, study note, coaching suggestion, and draft you write is encrypted individually using AES-256-GCM before it touches our database — not just the disk, but the column that holds it. To provide features like AI coaching and sharing, our system decrypts your content when you use it.

The one exception, and why it is there

Search is the exception, and we would rather name it than round it off. So that you can find your own words again — “where did I write about endurance?” — your comments are also held in a search index in the clear, in the same database. Publishers' text is never indexed, and neither is anything you import; that was a deliberate change and it is described on the Content & Copyright page. But a copy of our database would reveal the text of your comments, and so would a backup of it. Anyone who tells you a searchable database is also an opaque one is describing something other than how search works.

Corrected August 27, 2026. Until this date, this page said encryption covered “every column of every row” and that a copy of the database “does not reveal your content”, and the Privacy Policy said backups kept your content encrypted. The search index above is why that was wrong, and it had been there the whole time — the claim was written against the tables that carry an encryption flag, and the index does not have one. The encryption described below is real and unchanged; what changed is that this page now states the exception to it. Corrections to our content pages are logged on Content & Copyright.

This applies to all users automatically. There is nothing to enable or configure.

Where the Key Lives

The encryption key is held in our hosting provider's secret store, injected into the running application and never written to the database, the repository, or any backup. A backup therefore carries the encrypted columns as ciphertext, and carries the search index as described above. We hold an offline copy of the key elsewhere, so that losing the host does not mean losing your data.

In Transit

All connections use HTTPS/TLS. HTTP requests are automatically redirected to HTTPS. HSTS is enforced with a one-year max-age.

Passwords

Stored as salted bcrypt hashes via BetterAuth. We never store or log plaintext passwords.

2. Authentication & Sessions

• Email verification required before account access
• Secure, HTTP-only session cookies with SameSite=Lax and Secure flags
• Sessions expire after 30 days with 1-day rolling refresh
• Password reset via time-limited, single-use email links
• Account lockout protection via rate limiting on login attempts

3. Security Headers

Every response from Comment Coach includes the following security headers:

4. API & Rate Limiting

• Rate limiting on authentication endpoints (login, signup, password reset)
• Rate limiting on AI coaching calls (daily and monthly caps)
• Rate limiting on share reactions to prevent abuse
• Server-side validation on all API inputs

5. BYOK (Bring Your Own Key)

When you provide your own API key for AI services:

• Your key is stored only in your browser's localStorage — never on our servers
• Keys are transmitted to our server only to relay your AI request, then immediately discarded
• Keys are never written to our database or logs
• You can remove your key at any time from Settings

6. AI & Transcription Data Handling

• Comment text is sent to Anthropic (Claude) for coaching — no personal identifiers are included
• Anthropic does not use API inputs for model training (Anthropic Privacy Policy)
• AI responses are stored in your account as coaching history — you can delete this by deleting the comment or your account
• Audio sent to Deepgram for live transcription is encrypted in transit. mip_opt_out is always enabled, so audio is not retained after processing and is not used for model improvement (Deepgram Privacy Policy)
• Audio recordings from live capture are stored temporarily in your browser (IndexedDB) with a 24-hour expiry — they are never uploaded to our servers unless you explicitly transcribe them
• Images and PDFs uploaded for text extraction are processed in server memory and immediately discarded. They are never written to disk or stored.

7. Infrastructure

• Hosted on Fly.io with private networking and encrypted volumes
• Automated deployments via GitHub Actions CI/CD pipeline
• SQLite database with WAL mode for reliability
• Automated daily backups — encrypted columns stay encrypted in every copy; the search index over your own comments is carried as-is (see §1)

8. Breach Notification

In the event of a data breach affecting your personal information, we will:

• Notify affected users via email within 72 hours of discovery
• Report to relevant authorities as required by applicable law (GDPR, CCPA)
• Provide clear information about what data was affected and recommended actions

9. Responsible Disclosure

If you discover a security vulnerability in Comment Coach, please report it responsibly:

• Email: contact@comment.coach
• Subject line: "Security Vulnerability Report"
• Include steps to reproduce the vulnerability

Please do not publicly disclose the vulnerability until we have had a chance to address it. We aim to acknowledge reports within 48 hours and resolve confirmed vulnerabilities promptly.