Privacy Policy

1. What This Policy Covers

This policy explains how Comment Coach collects, uses, stores, and protects your personal information. We are committed to transparency about our data practices.

Comment Coach is operated by Eitel, LLC, a Wyoming limited liability company, 2232 Dell Range Blvd, Suite 303 #1726, Cheyenne, WY 82009-4976, United States. For data-protection purposes Eitel, LLC is the controller of your personal data. What we rely on to process it, and how transfers out of the EEA are covered, is set out on Your Data Rights.

2. Information We Collect

2a. Account Information

• Name — displayed on shared content and feedback
• Email address — used for login, verification, password reset, and share notifications
• Username — optional, used for direct sharing and displayed on shared content
• Password — stored as a salted hash, never in plain text

2b. Content You Create

• Subjects, paragraphs, comments, coaching feedback
• Reactions and text feedback on shared content
• This content is encrypted field by field (AES-256-GCM) before being stored in our database, and is only accessible by you (or by recipients if you share it)
• One deliberate exception: so that you can search your own words, your comments are also held in a search index in the clear. Nothing you import is — publishers' text is kept out of that index entirely. Security §1 describes this and what it means for backups
• This includes the working copy the outliner keeps of any paragraph you import or paste: it is encrypted too, and it is never pooled with another user's or shown to anyone else

2c. Payment Information

• Subscription billing is processed entirely by Stripe
• We never see, store, or have access to your credit card numbers
• We store only your Stripe customer ID to link your subscription to your account

2d. Automatically Collected

• IP address — used for rate limiting and anonymous reaction deduplication
• User agent — used for reaction fingerprinting (not stored long-term). Views of a Vault document are the exception, where it is kept with the view record; see 2f.
• Usage metrics — page views, feature usage events (aggregated, used for product improvement)

2e. What We Do NOT Collect

• We do not use tracking cookies or third-party analytics (no Google Analytics, no Facebook Pixel)
• We do not sell, rent, or trade your personal information to third parties
• We do not collect location data beyond IP-derived country
• We do not store your API keys on our servers. When you add your own API key (BYOK), it is saved locally in your browser and transmitted to our server only to relay your AI requests. The key is discarded immediately after each request — it is never written to our database or logs.

2f. Vault Document Recipients

A Vault document is a private brief sent to a named recipient through a passcode-protected link. If you opened one, you are almost certainly not a Comment Coach account holder — you were sent a link. This section is for you, because the visit is recorded and you would otherwise have no way to know it.

• Your IP address, and the country and city derived from it — to distinguish a real read from an automatic link preview, and to see roughly where interest is coming from
• Your user agent, plus a salted fingerprint computed from it and your IP — so that one person reading three times counts once rather than three times
• Section reactions and any written feedback — recorded because you chose to send them

The purpose is narrow: to know whether a document we sent was actually read. We do not build a profile, we do not use any of it for advertising, and we do not share it. It is stored under the recipient link it belongs to and is removed when that record is deleted. We do not currently expire it on a timer, so if you want it gone sooner, ask and we will delete it.

The controller is Eitel, LLC, and the rights described in section 7 — access, correction, deletion, objection, and complaint to a supervisory authority — apply to you exactly as they do to an account holder. Write to contact@comment.coach.

3. How We Use Your Information

• Provide the service — store and display your comments, subjects, and coaching results
• AI coaching — your comment content is sent to Anthropic (Claude AI) for coaching, scoring, generation, and translation. See section 4 for what Anthropic does with it.
• Email communication — verification, password reset, and share notifications via Resend
• Payment processing — subscription management via Stripe
• Abuse prevention — rate limiting, reaction deduplication
• Product improvement — aggregated usage metrics (not individual tracking)

4. AI & Transcription Processing Disclosure

When you use AI coaching features, your comment text is sent to Anthropic's Claude API for processing. This includes:

• Comment content (the text you write)
• Source paragraph text (context for coaching)
• Language preference

We do not send your email, name, or other personal identifiers to the AI service. We send your text to Anthropic under their commercial terms, which means: inputs and outputs are deleted from Anthropic's systems within 30 days; retained data is not used to train models without our express permission; and content that Anthropic's automated trust-and-safety systems flag as violating their usage policy may be held for up to two years. See Anthropic's privacy policy and their commercial data retention policy.

When you use live transcription with Deepgram, audio from your microphone is streamed to Deepgram's API for real-time speech recognition. This includes:

• Audio stream (voice and ambient sound within microphone range)
• Language preference

We enable Deepgram's mip_opt_out setting on every request. This means your audio is kept only long enough to process the transcription, then discarded. It is not retained, stored, or used for model training. Deepgram does not share your data with third parties without permission. Your name, email, and other personal identifiers are never sent to Deepgram. See Deepgram's privacy policy.

When you provide your own API key (BYOK) for Anthropic, OpenAI, or Deepgram, the request is billed to your key rather than ours. Your key is stored only in your browser's local storage; it is sent to our server to relay the request and discarded immediately afterwards, never written to our database or logs. One thing BYOK does not change: the request still reaches the provider, and it is now your account's retention settings and agreement with that provider — not ours — that govern how long they keep it.

5. Third-Party Service Providers

6. Data Retention

7. Your Rights

All Users

• Access — export all your data via Settings > Download My Data
• Deletion — delete your account and all associated data via Settings > Delete Account
• Portability — export your data as JSON for use elsewhere
• Correction — update your name, email, and password in Settings

California Residents (CCPA/CPRA)

You have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.

EU/EEA Residents (GDPR)

We process your data mainly to perform our contract with you — running the account and providing the features you signed up for. We also rely on legitimate interests for security and abuse prevention, on consent for optional extras such as the newsletter, and on legal obligation for copyright notices. Your Data Rights sets each of these out, along with our transfer safeguards.

You have the right to access, rectify, erase, restrict processing, object, and data portability, and to lodge a complaint with your national supervisory authority. Contact us at contact@comment.coach to exercise these rights.

8. Data Security

We protect your data with:

• HTTPS encryption for all data in transit
• Salted password hashing (bcrypt via BetterAuth)
• Fly.io private networking for secure server access
• Rate limiting on authentication and API endpoints
• Server-side session management with secure cookies

9. Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users via email within 72 hours of discovery, and report to relevant authorities as required by applicable law.

10. Children's Privacy

Comment Coach is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us and we will promptly delete it.

11. Cookies and Tracking

Comment Coach uses only essential cookies for authentication (session management). We do not use tracking cookies, advertising cookies, or third-party analytics scripts.

For anonymous reaction deduplication, we generate a server-side fingerprint from your IP address and user agent. This fingerprint is stored as a salted hash and cannot be reversed to identify you.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or in-app notification. The "Last updated" date at the top indicates the most recent revision.

13. Contact Us

For privacy questions or to exercise your data rights, contact us at contact@comment.coach.

You can also manage your data directly:

• Settings — update profile, export data, delete account